.gitlab-ci.yml

# You can override the included template(s) by including variable overrides
# SAST customization: https://docs.gitlab.com/ee/user/application_security/sast/#customizing-the-sast-settings
# Secret Detection customization: https://docs.gitlab.com/ee/user/application_security/secret_detection/#customizing-settings
# Dependency Scanning customization: https://docs.gitlab.com/ee/user/application_security/dependency_scanning/#customizing-the-dependency-scanning-settings
# Container Scanning customization: https://docs.gitlab.com/ee/user/application_security/container_scanning/#customizing-the-container-scanning-settings
# Note that environment variables can be set in several places
# See https://docs.gitlab.com/ee/ci/variables/#cicd-variable-precedence
stages:
- build
- test
- deploy
- manifest

include:
- remote: https://gitlab.com/yobasystems/gitlab-ci-templates/raw/master/container_scanning_all_arch.yml
- template: Security/Secret-Detection.gitlab-ci.yml
- template: Security/SAST.gitlab-ci.yml

.build_template: &build_definition
  image: yobasystems/alpine-docker:dind
  stage: build
  script:
    - echo "Build Timestamp ${CI_COMMIT_TIMESTAMP} - ${CI_COMMIT_SHORT_SHA}"
    - echo "Building for ARCH=${ARCH}, PLATFORM=${PLATFORM}"
    - |
      if [[ "$NODE_VERSION" == "lts" ]]; then
        NODE_VERSION=$CI_COMMIT_TAG
      fi
    - apk add --update git
    - |
      if [[ "$NODE_VERSION" == "current" ]]; then
        cd alpine-nodejs-current-${ARCH}/
      elif [[ "$NODE_VERSION" == "min" ]]; then
        cd alpine-nodejs-min-${ARCH}/
      else
        cd alpine-nodejs-${ARCH}/
      fi
    - docker build
      --build-arg VCS_REF=${CI_COMMIT_SHORT_SHA}
      --build-arg BUILD_DATE=${CI_COMMIT_TIMESTAMP}
      -t ${CI_REGISTRY_IMAGE}/${CI_COMMIT_SHORT_SHA}:${ARCH}${NODE_VERSION:+-$NODE_VERSION}
      --platform linux/${PLATFORM}
      .
    - echo "$CI_JOB_TOKEN" | docker login -u gitlab-ci-token "$CI_REGISTRY" --password-stdin
    - docker push ${CI_REGISTRY_IMAGE}/${CI_COMMIT_SHORT_SHA}:${ARCH}${NODE_VERSION:+-$NODE_VERSION}

# Latest build jobs
amd64 nodejs build:
  <<: *build_definition
  tags:
    - amd64
  variables:
    ARCH: amd64
    PLATFORM: amd64

arm32v7 nodejs build:
  <<: *build_definition
  tags:
    - armhf
  variables:
    ARCH: armhf
    PLATFORM: arm/v7

arm64v8 nodejs build:
  <<: *build_definition
  tags:
    - aarch64
  variables:
    ARCH: aarch64
    PLATFORM: arm64/v8

# Current build jobs
amd64 nodejs build current:
  <<: *build_definition
  tags:
    - amd64
  variables:
    ARCH: amd64
    PLATFORM: amd64
    NODE_VERSION: current

arm32v7 nodejs build current:
  <<: *build_definition
  tags:
    - armhf
  variables:
    ARCH: armhf
    PLATFORM: arm/v7
    NODE_VERSION: current

arm64v8 nodejs build current:
  <<: *build_definition
  tags:
    - aarch64
  variables:
    ARCH: aarch64
    PLATFORM: arm64/v8
    NODE_VERSION: current

# Min build jobs
amd64 nodejs build min:
  <<: *build_definition
  tags:
    - amd64
  variables:
    ARCH: amd64
    PLATFORM: amd64
    NODE_VERSION: min

arm32v7 nodejs build min:
  <<: *build_definition
  tags:
    - armhf
  variables:
    ARCH: armhf
    PLATFORM: arm/v7
    NODE_VERSION: min

arm64v8 nodejs build min:
  <<: *build_definition
  tags:
    - aarch64
  variables:
    ARCH: aarch64
    PLATFORM: arm64/v8
    NODE_VERSION: min

# LTS build jobs
amd64 nodejs build lts:
  <<: *build_definition
  tags:
    - amd64
  variables:
    ARCH: amd64
    PLATFORM: amd64
    NODE_VERSION: lts

arm32v7 nodejs build lts:
  <<: *build_definition
  tags:
    - armhf
  variables:
    ARCH: armhf
    PLATFORM: arm/v7
    NODE_VERSION: lts

arm64v8 nodejs build lts:
  <<: *build_definition
  tags:
    - aarch64
  variables:
    ARCH: aarch64
    PLATFORM: arm64/v8
    NODE_VERSION: lts

sast:
  stage: test

.deploy_template: &deploy_definition
  image: yobasystems/alpine-docker:dind
  stage: deploy
  rules:
    - if: $CI_COMMIT_TAG
    - if: $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH
  script:
    - |
      if [[ "$NODE_VERSION" == "lts" ]]; then
        NODE_VERSION=$CI_COMMIT_TAG
      fi
    - echo "$CI_JOB_TOKEN" | docker login -u gitlab-ci-token "$CI_REGISTRY" --password-stdin
    - echo "$DOCKERHUB_PASSWORD" | docker login -u "$DOCKERHUB_USERNAME" --password-stdin
    - echo "$QUAY_PASSWORD" | docker login -u "$QUAY_USERNAME" quay.io --password-stdin
    - echo "$GITHUB_TOKEN" | docker login ghcr.io -u "$GITHUB_USERNAME" --password-stdin
    - docker pull ${CI_REGISTRY_IMAGE}/${CI_COMMIT_SHORT_SHA}:${ARCH}${NODE_VERSION:+-$NODE_VERSION}
    - docker tag ${CI_REGISTRY_IMAGE}/${CI_COMMIT_SHORT_SHA}:${ARCH}${NODE_VERSION:+-$NODE_VERSION} $CI_REGISTRY_IMAGE:${ARCH}${NODE_VERSION:+-$NODE_VERSION}
    - docker tag ${CI_REGISTRY_IMAGE}/${CI_COMMIT_SHORT_SHA}:${ARCH}${NODE_VERSION:+-$NODE_VERSION} $DOCKER_REGISTRY_DOCKERHUB_REPO:${ARCH}${NODE_VERSION:+-$NODE_VERSION}
    - docker tag ${CI_REGISTRY_IMAGE}/${CI_COMMIT_SHORT_SHA}:${ARCH}${NODE_VERSION:+-$NODE_VERSION} quay.io/$DOCKER_REGISTRY_QUAY_REPO:${ARCH}${NODE_VERSION:+-$NODE_VERSION}
    - docker tag ${CI_REGISTRY_IMAGE}/${CI_COMMIT_SHORT_SHA}:${ARCH}${NODE_VERSION:+-$NODE_VERSION} ghcr.io/$DOCKER_REGISTRY_GHCR_REPO:${ARCH}${NODE_VERSION:+-$NODE_VERSION}
    - docker tag ${CI_REGISTRY_IMAGE}/${CI_COMMIT_SHORT_SHA}:${ARCH}${NODE_VERSION:+-$NODE_VERSION} $CI_REGISTRY_IMAGE:${ARCH2}${NODE_VERSION:+-$NODE_VERSION}
    - docker tag ${CI_REGISTRY_IMAGE}/${CI_COMMIT_SHORT_SHA}:${ARCH}${NODE_VERSION:+-$NODE_VERSION} $DOCKER_REGISTRY_DOCKERHUB_REPO:${ARCH2}${NODE_VERSION:+-$NODE_VERSION}
    - docker tag ${CI_REGISTRY_IMAGE}/${CI_COMMIT_SHORT_SHA}:${ARCH}${NODE_VERSION:+-$NODE_VERSION} quay.io/$DOCKER_REGISTRY_QUAY_REPO:${ARCH2}${NODE_VERSION:+-$NODE_VERSION}
    - docker tag ${CI_REGISTRY_IMAGE}/${CI_COMMIT_SHORT_SHA}:${ARCH}${NODE_VERSION:+-$NODE_VERSION} ghcr.io/$DOCKER_REGISTRY_GHCR_REPO:${ARCH2}${NODE_VERSION:+-$NODE_VERSION}
    - docker push $CI_REGISTRY_IMAGE:${ARCH}${NODE_VERSION:+-$NODE_VERSION}
    - docker push $DOCKER_REGISTRY_DOCKERHUB_REPO:${ARCH}${NODE_VERSION:+-$NODE_VERSION}
    - docker push quay.io/$DOCKER_REGISTRY_QUAY_REPO:${ARCH}${NODE_VERSION:+-$NODE_VERSION}
    - docker push ghcr.io/$DOCKER_REGISTRY_GHCR_REPO:${ARCH}${NODE_VERSION:+-$NODE_VERSION}
    - docker push $CI_REGISTRY_IMAGE:${ARCH2}${NODE_VERSION:+-$NODE_VERSION}
    - docker push $DOCKER_REGISTRY_DOCKERHUB_REPO:${ARCH2}${NODE_VERSION:+-$NODE_VERSION}
    - docker push quay.io/$DOCKER_REGISTRY_QUAY_REPO:${ARCH2}${NODE_VERSION:+-$NODE_VERSION}
    - docker push ghcr.io/$DOCKER_REGISTRY_GHCR_REPO:${ARCH2}${NODE_VERSION:+-$NODE_VERSION}
    - |
      if [[ "$CI_COMMIT_TAG" ]]; then
        docker tag ${CI_REGISTRY_IMAGE}/${CI_COMMIT_SHORT_SHA}:${ARCH}${NODE_VERSION:+-$NODE_VERSION} $CI_REGISTRY_IMAGE:${CI_COMMIT_TAG}-${ARCH}${NODE_VERSION:+-$NODE_VERSION}
        docker tag ${CI_REGISTRY_IMAGE}/${CI_COMMIT_SHORT_SHA}:${ARCH}${NODE_VERSION:+-$NODE_VERSION} $DOCKER_REGISTRY_DOCKERHUB_REPO:${CI_COMMIT_TAG}-${ARCH}${NODE_VERSION:+-$NODE_VERSION}
        docker tag ${CI_REGISTRY_IMAGE}/${CI_COMMIT_SHORT_SHA}:${ARCH}${NODE_VERSION:+-$NODE_VERSION} quay.io/$DOCKER_REGISTRY_QUAY_REPO:${CI_COMMIT_TAG}-${ARCH}${NODE_VERSION:+-$NODE_VERSION}
        docker tag ${CI_REGISTRY_IMAGE}/${CI_COMMIT_SHORT_SHA}:${ARCH}${NODE_VERSION:+-$NODE_VERSION} ghcr.io/$DOCKER_REGISTRY_GHCR_REPO:${CI_COMMIT_TAG}-${ARCH}${NODE_VERSION:+-$NODE_VERSION}
        docker tag ${CI_REGISTRY_IMAGE}/${CI_COMMIT_SHORT_SHA}:${ARCH}${NODE_VERSION:+-$NODE_VERSION} $CI_REGISTRY_IMAGE:${CI_COMMIT_TAG}-${ARCH2}${NODE_VERSION:+-$NODE_VERSION}
        docker tag ${CI_REGISTRY_IMAGE}/${CI_COMMIT_SHORT_SHA}:${ARCH}${NODE_VERSION:+-$NODE_VERSION} $DOCKER_REGISTRY_DOCKERHUB_REPO:${CI_COMMIT_TAG}-${ARCH2}${NODE_VERSION:+-$NODE_VERSION}
        docker tag ${CI_REGISTRY_IMAGE}/${CI_COMMIT_SHORT_SHA}:${ARCH}${NODE_VERSION:+-$NODE_VERSION} quay.io/$DOCKER_REGISTRY_QUAY_REPO:${CI_COMMIT_TAG}-${ARCH2}${NODE_VERSION:+-$NODE_VERSION}
        docker tag ${CI_REGISTRY_IMAGE}/${CI_COMMIT_SHORT_SHA}:${ARCH}${NODE_VERSION:+-$NODE_VERSION} ghcr.io/$DOCKER_REGISTRY_GHCR_REPO:${CI_COMMIT_TAG}-${ARCH2}${NODE_VERSION:+-$NODE_VERSION}
        docker push $CI_REGISTRY_IMAGE:${CI_COMMIT_TAG}-${ARCH}${NODE_VERSION:+-$NODE_VERSION}
        docker push $DOCKER_REGISTRY_DOCKERHUB_REPO:${CI_COMMIT_TAG}-${ARCH}${NODE_VERSION:+-$NODE_VERSION}
        docker push quay.io/$DOCKER_REGISTRY_QUAY_REPO:${CI_COMMIT_TAG}-${ARCH}${NODE_VERSION:+-$NODE_VERSION}
        docker push ghcr.io/$DOCKER_REGISTRY_GHCR_REPO:${CI_COMMIT_TAG}-${ARCH}${NODE_VERSION:+-$NODE_VERSION}
        docker push $CI_REGISTRY_IMAGE:${CI_COMMIT_TAG}-${ARCH2}${NODE_VERSION:+-$NODE_VERSION}
        docker push $DOCKER_REGISTRY_DOCKERHUB_REPO:${CI_COMMIT_TAG}-${ARCH2}${NODE_VERSION:+-$NODE_VERSION}
        docker push quay.io/$DOCKER_REGISTRY_QUAY_REPO:${CI_COMMIT_TAG}-${ARCH2}${NODE_VERSION:+-$NODE_VERSION}
        docker push ghcr.io/$DOCKER_REGISTRY_GHCR_REPO:${CI_COMMIT_TAG}-${ARCH2}${NODE_VERSION:+-$NODE_VERSION}
      fi

# Latest deploy jobs
amd64 nodejs deploy:
  <<: *deploy_definition
  tags:
    - amd64
  variables:
    ARCH: amd64
    ARCH2: x86_64
    PLATFORM: amd64
  needs:
    - amd64 nodejs build

arm32v7 nodejs deploy:
  <<: *deploy_definition
  tags:
    - armhf
  variables:
    ARCH: armhf
    ARCH2: arm32v7
    PLATFORM: arm/v7
  needs:
    - arm32v7 nodejs build

arm64v8 nodejs deploy:
  <<: *deploy_definition
  tags:
    - aarch64
  variables:
    ARCH: aarch64
    ARCH2: arm64v8
    PLATFORM: arm64/v8
  needs:
    - arm64v8 nodejs build

# Current deploy jobs
amd64 nodejs deploy current:
  <<: *deploy_definition
  tags:
    - amd64
  variables:
    ARCH: amd64
    ARCH2: x86_64
    PLATFORM: amd64
    NODE_VERSION: current
  needs:
    - amd64 nodejs build current

arm32v7 nodejs deploy current:
  <<: *deploy_definition
  tags:
    - armhf
  variables:
    ARCH: armhf
    ARCH2: arm32v7
    PLATFORM: arm/v7
    NODE_VERSION: current
  needs:
    - arm32v7 nodejs build current

arm64v8 nodejs deploy current:
  <<: *deploy_definition
  tags:
    - aarch64
  variables:
    ARCH: aarch64
    ARCH2: arm64v8
    PLATFORM: arm64/v8
    NODE_VERSION: current
  needs:
    - arm64v8 nodejs build current

# Min deploy jobs
amd64 nodejs deploy min:
  <<: *deploy_definition
  tags:
    - amd64
  variables:
    ARCH: amd64
    ARCH2: x86_64
    PLATFORM: amd64
    NODE_VERSION: min
  needs:
    - amd64 nodejs build min

arm32v7 nodejs deploy min:
  <<: *deploy_definition
  tags:
    - armhf
  variables:
    ARCH: armhf
    ARCH2: arm32v7
    PLATFORM: arm/v7
    NODE_VERSION: min
  needs:
    - arm32v7 nodejs build min

arm64v8 nodejs deploy min:
  <<: *deploy_definition
  tags:
    - aarch64
  variables:
    ARCH: aarch64
    ARCH2: arm64v8
    PLATFORM: arm64/v8
    NODE_VERSION: min
  needs:
    - arm64v8 nodejs build min

# LTS deploy jobs
amd64 nodejs deploy lts:
  <<: *deploy_definition
  tags:
    - amd64
  variables:
    ARCH: amd64
    ARCH2: x86_64
    PLATFORM: amd64
    NODE_VERSION: lts
  needs:
    - amd64 nodejs build lts

arm32v7 nodejs deploy lts:
  <<: *deploy_definition
  tags:
    - armhf
  variables:
    ARCH: armhf
    ARCH2: arm32v7
    PLATFORM: arm/v7
    NODE_VERSION: lts
  needs:
    - arm32v7 nodejs build lts

arm64v8 nodejs deploy lts:
  <<: *deploy_definition
  tags:
    - aarch64
  variables:
    ARCH: aarch64
    ARCH2: arm64v8
    PLATFORM: arm64/v8
    NODE_VERSION: lts
  needs:
    - arm64v8 nodejs build lts

# Manifest jobs for current, min, and lts
manifest creation current:
  image: yobasystems/alpine-docker:dind
  stage: manifest
  needs:
    - amd64 nodejs deploy current
    - arm32v7 nodejs deploy current
    - arm64v8 nodejs deploy current
  rules:
    - if: $CI_COMMIT_TAG
    - if: $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH
  script:
    - mkdir -p ~/.docker
    - echo '{"experimental":"enabled"}' > ~/.docker/config.json
    - echo "$CI_JOB_TOKEN" | docker login -u gitlab-ci-token "$CI_REGISTRY" --password-stdin
    - echo "$DOCKERHUB_PASSWORD" | docker login -u "$DOCKERHUB_USERNAME" --password-stdin
    - echo "$QUAY_PASSWORD" | docker login -u "$QUAY_USERNAME" quay.io --password-stdin
    - echo "$GITHUB_TOKEN" | docker login ghcr.io -u "$GITHUB_USERNAME" --password-stdin
    - |
      create_and_push_manifest() {
        repo=$1
        tag=$2
        docker manifest create $repo:$tag \
          $repo:amd64-current \
          $repo:armhf-current \
          $repo:aarch64-current
        docker manifest annotate $repo:$tag $repo:amd64-current --os linux --arch amd64
        docker manifest annotate $repo:$tag $repo:armhf-current --os linux --arch arm --variant v7
        docker manifest annotate $repo:$tag $repo:aarch64-current --os linux --arch arm64 --variant v8
        docker manifest push $repo:$tag
      }
    - |
      for repo in $CI_REGISTRY_IMAGE $DOCKER_REGISTRY_DOCKERHUB_REPO quay.io/$DOCKER_REGISTRY_QUAY_REPO ghcr.io/$DOCKER_REGISTRY_GHCR_REPO; do
        create_and_push_manifest $repo current
      done

manifest creation min:
  image: yobasystems/alpine-docker:dind
  stage: manifest
  needs:
    - amd64 nodejs deploy min
    - arm32v7 nodejs deploy min
    - arm64v8 nodejs deploy min
  rules:
    - if: $CI_COMMIT_TAG
    - if: $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH
  script:
    - mkdir -p ~/.docker
    - echo '{"experimental":"enabled"}' > ~/.docker/config.json
    - echo "$CI_JOB_TOKEN" | docker login -u gitlab-ci-token "$CI_REGISTRY" --password-stdin
    - echo "$DOCKERHUB_PASSWORD" | docker login -u "$DOCKERHUB_USERNAME" --password-stdin
    - echo "$QUAY_PASSWORD" | docker login -u "$QUAY_USERNAME" quay.io --password-stdin
    - echo "$GITHUB_TOKEN" | docker login ghcr.io -u "$GITHUB_USERNAME" --password-stdin
    - |
      create_and_push_manifest() {
        repo=$1
        tag=$2
        docker manifest create $repo:$tag \
          $repo:amd64-min \
          $repo:armhf-min \
          $repo:aarch64-min
        docker manifest annotate $repo:$tag $repo:amd64-min --os linux --arch amd64
        docker manifest annotate $repo:$tag $repo:armhf-min --os linux --arch arm --variant v7
        docker manifest annotate $repo:$tag $repo:aarch64-min --os linux --arch arm64 --variant v8
        docker manifest push $repo:$tag
      }
    - |
      for repo in $CI_REGISTRY_IMAGE $DOCKER_REGISTRY_DOCKERHUB_REPO quay.io/$DOCKER_REGISTRY_QUAY_REPO ghcr.io/$DOCKER_REGISTRY_GHCR_REPO; do
        create_and_push_manifest $repo min
      done

manifest creation lts:
  image: yobasystems/alpine-docker:dind
  stage: manifest
  needs:
    - amd64 nodejs deploy lts
    - arm32v7 nodejs deploy lts
    - arm64v8 nodejs deploy lts
  rules:
    - if: $CI_COMMIT_TAG
    - if: $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH
  script:
    - mkdir -p ~/.docker
    - echo '{"experimental":"enabled"}' > ~/.docker/config.json
    - echo "$CI_JOB_TOKEN" | docker login -u gitlab-ci-token "$CI_REGISTRY" --password-stdin
    - echo "$DOCKERHUB_PASSWORD" | docker login -u "$DOCKERHUB_USERNAME" --password-stdin
    - echo "$QUAY_PASSWORD" | docker login -u "$QUAY_USERNAME" quay.io --password-stdin
    - echo "$GITHUB_TOKEN" | docker login ghcr.io -u "$GITHUB_USERNAME" --password-stdin
    - |
      create_and_push_manifest() {
        repo=$1
        tag=$2
        docker manifest create $repo:$tag \
          $repo:amd64 \
          $repo:armhf \
          $repo:aarch64
        
        # Add annotations
        docker manifest annotate $repo:$tag $repo:amd64 --os linux --arch amd64
        docker manifest annotate $repo:$tag $repo:armhf --os linux --arch arm --variant v7
        docker manifest annotate $repo:$tag $repo:aarch64 --os linux --arch arm64 --variant v8
        
        # Push manifest
        docker manifest push $repo:$tag
      }
    - |
      for repo in $CI_REGISTRY_IMAGE $DOCKER_REGISTRY_DOCKERHUB_REPO quay.io/$DOCKER_REGISTRY_QUAY_REPO ghcr.io/$DOCKER_REGISTRY_GHCR_REPO; do
        create_and_push_manifest $repo lts
      done