.gitlab-ci.yml

stages:
  - prepare
  - test
  - release
  - trigger deploy
  - static scans
  - publish pages

variables:
  MYSQL_ROOT_PASSWORD: "root"
  MYSQL_DATABASE: "ota_tuf"
  MYSQL_USER: "ota_tuf"
  MYSQL_PASSWORD: "ota_tuf"
  # VAULT_ADDR: defined in GitLab variables
  # The same image have to be used by test and code coverage jobs:
  TEST_IMAGE: advancedtelematic/gitlab-jobs:0.2.5
  TEST_IMAGE_SONAR: advancedtelematic/gitlab-jobs-sonar:0.0.3

build CI nginx:
  stage: prepare
  image: advancedtelematic/gitlab-jobs:0.2.5
  except:
    - schedules
  only:
    changes:
      - cli/src/test/resources/*
      - deploy/ci.nginx.Dockerfile
  tags:
    - docker-sock
    - vault-token
  script:
    - export VAULT_TOKEN=$(cat /opt/vault/token)
    - gitlab-docker-login $VAULT_ADDR
    - cd deploy && ./build-tuf-nginx.sh
    - docker push advancedtelematic/tuf-nginx:latest

test:
  stage: test
  except:
    refs:
      - deploy/sit
  services:
    - name: advancedtelematic/tuf-nginx:latest
      alias: tuf-nginx
    - name: mariadb:10.4.31
      alias: db
      command:
        - --character-set-server=utf8
        - --collation-server=utf8_unicode_ci
        - --max_connections=1000
  image: $TEST_IMAGE
  variables:
    DB_URL: "jdbc:mariadb://db:3306/ota_tuf"
    MTLS_REPOSERVER_URI: "https://tuf-nginx:8181/"
  before_script:
    - ./deploy/gitlab-db-setup.sh mysql db
  script:
    - sbt -sbt-dir ./.sbt -ivy ./.ivy2 clean coverage ut:test
  artifacts:
    paths:
      - "libtuf/target/scala-*/scoverage-data"
      - "libtuf/target/scala-*/src_managed"
      - "libtuf/target/scala-*/classes"
      - "libtuf-server/target/scala-*/scoverage-data"
      - "libtuf-server/target/scala-*/src_managed"
      - "libtuf-server/target/scala-*/classes"
      - "keyserver/target/scala-*/scoverage-data"
      - "keyserver/target/scala-*/src_managed"
      - "keyserver/target/scala-*/classes"
      - "cli/target/scala-*/scoverage-data"
      - "cli/target/scala-*/src_managed"
      - "cli/target/scala-*/classes"
      - "reposerver/target/scala-*/scoverage-data"
      - "reposerver/target/scala-*/src_managed"
      - "reposerver/target/scala-*/classes"

  cache:
    paths:
      - .ivy2/
      - .sbt/

code coverage:
  extends: .report_scala_coverage
  needs: ["test"]
  except:
    refs:
      - deploy/sit
  allow_failure: true
  image: $TEST_IMAGE_SONAR
  script:
    - sbt -Dsonar.login=$SONARQUBE_TOKEN -sbt-dir ./.sbt -ivy ./.ivy2 coverageReport sonarScan
    - mv keyserver/target/scala-*/scoverage-report/ keyserver-coverage
    - mv libtuf/target/scala-*/scoverage-report/ libtuf-coverage
    - mv libtuf-server/target/scala-*/scoverage-report/ libtuf-server-coverage
    - mv cli/target/scala-*/scoverage-report/ cli-coverage
    - mv reposerver/target/scala-*/scoverage-report/ reposerver-coverage
  artifacts:
    expire_in: 3 weeks
    paths:
      - keyserver-coverage
      - libtuf-coverage
      - libtuf-server-coverage
      - cli-coverage
      - reposerver-coverage
    reports:
      coverage_report:
        coverage_format: cobertura
        path: "keyserver/target/scala-*/coverage-report/cobertura.xml, libtuf/target/scala-*/coverage-report/cobertura.xml, libtuf-server/target/scala-*/coverage-report/cobertura.xml, cli/target/scala-*/coverage-report/cobertura.xml, reposerver/target/scala-*/coverage-report/cobertura.xml"

release:
  stage: release
  except:
    - schedules
  only:
    refs:
      - master
  variables:
    AWS_BUCKET_ID: "ota-tuf-cli-releases"
    AWS_REGION: "eu-west-1"
    DOCKER_TLS_CERTDIR: ""
    DOCKER_HOST: tcp://docker:2375
  image: advancedtelematic/gitlab-jobs:0.3.3
  services:
    - docker:19.03.12-dind
  script:
    - git fetch origin
    - git describe
    - gitlab-docker-login $VAULT_ADDR
    - eval $(set-vault-env -v $VAULT_ADDR --secret gitlab/ats-aws-key --secret gitlab/maven-publish)
    - sbt -x -sbt-dir ./.sbt -ivy ./.ivy2 -batch release
    - docker tag advancedtelematic/tuf-keyserver:${CI_COMMIT_SHA} hcr.data.here.com/ota_saas/tuf-keyserver:${CI_COMMIT_SHA}
    - docker push hcr.data.here.com/ota_saas/tuf-keyserver:${CI_COMMIT_SHA}
    - docker tag advancedtelematic/tuf-reposerver:${CI_COMMIT_SHA} hcr.data.here.com/ota_saas/tuf-reposerver:${CI_COMMIT_SHA}
    - docker push hcr.data.here.com/ota_saas/tuf-reposerver:${CI_COMMIT_SHA}
  cache:
    paths:
      - .ivy2/
      - .sbt/

trigger dev reposerver deploy:
  stage: trigger deploy
  except:
    - schedules
  only:
    refs:
      - master
  variables:
    ENV: "dev"
    NEW_TAG: $CI_COMMIT_SHA
    SERVICE: tuf-reposerver
    CREATE_COMMIT: "true"
  trigger:
    project: OLP/EDGE/OTA/infra/deployment-descriptors
    branch: master

trigger dev keyserver deploy:
  stage: trigger deploy
  except:
    - schedules
  only:
    - master
  variables:
    ENV: "dev"
    NEW_TAG: $CI_COMMIT_SHA
    SERVICE: tuf-keyserver
    CREATE_COMMIT: "true"
  trigger:
    project: OLP/EDGE/OTA/infra/deployment-descriptors
    branch: master


trigger sit keyserver deploy:
  stage: trigger deploy
  except:
    - schedules
  only:
    - deploy/sit
  variables:
    ENV: "sit"
    NEW_TAG: $CI_COMMIT_SHA
    SERVICE: tuf-keyserver
    CREATE_COMMIT: "true"
  trigger:
    project: OLP/EDGE/OTA/infra/deployment-descriptors
    branch: master


trigger sit reposerver deploy:
  stage: trigger deploy
  except:
    - schedules
  only:
    - deploy/sit
  variables:
    ENV: "sit"
    NEW_TAG: $CI_COMMIT_SHA
    SERVICE: tuf-reposerver
    CREATE_COMMIT: "true"
  trigger:
    project: OLP/EDGE/OTA/infra/deployment-descriptors
    branch: master


pages:
  # the name of this job is pre-defined by Gitlab
  stage: publish pages
  only:
    refs:
      - schedules
  # See https://github.com/advancedtelematic/infra-dockerfiles/tree/master/gitlab-jobs for latest version:
  image: advancedtelematic/gitlab-jobs:0.2.5
  script:
    - mkdir -p public
    - mv *-coverage public/
  artifacts:
    paths:
      - public
    expire_in: 30 days

include:
  - project: "poit/spc/be/prodsec-secret-detection"
    file: "ITT-Secret-Detection.gitlab-ci.yml"
  - template: Dependency-Scanning.gitlab-ci.yml
  - project: olp/edge/ota/infra/security
    ref: v0.1.1
    file: /shared.yaml