.gitlab-ci.yml

# .gitlab-ci.yml
# paritytech/scripts
#

stages:
  - build
  - test
  - prod

variables:                         &default-vars
  REGISTRY_PATH:                   docker.io/paritytech
  REGISTRY_NAME:                   docker.io

default:
  cache:                           {}
  retry:
    max: 2
    when:
      - runner_system_failure
      - unknown_failure
      - api_failure

.build:                            &docker_build
  stage:                           build
  image:                           quay.io/buildah/stable
  rules:
    - if: $IMAGE_NAME == $CI_JOB_NAME
  tags:
    - kubernetes-parity-build

# Push to Dockerhub using buildah
.push_to_docker_hub:               &push_to_docker_hub
  - export IMAGE_DATE_TAG="$CI_COMMIT_SHORT_SHA-$(date +%Y%m%d)"
  - buildah version
  - buildah bud
      --format=docker
      --build-arg VCS_REF="$CI_COMMIT_SHA"
      --build-arg BUILD_DATE="$(date +%Y%m%d)"
      --build-arg REGISTRY_PATH="$REGISTRY_PATH"
      --tag "$REGISTRY_PATH/$IMAGE_NAME:$IMAGE_DATE_TAG"
      --tag "$REGISTRY_PATH/$IMAGE_NAME:latest"
      --file "dockerfiles/$IMAGE_NAME/Dockerfile" dockerfiles
  - buildah info
  - echo "$DOCKER_PASSWORD" |
      buildah login --username "$DOCKER_USER" --password-stdin "$REGISTRY_NAME"
  - buildah push --format=v2s2 "$REGISTRY_PATH/$IMAGE_NAME:$IMAGE_DATE_TAG"
  - buildah push --format=v2s2 "$REGISTRY_PATH/$IMAGE_NAME:latest"
  - buildah logout "$REGISTRY_NAME"

.push_to_staging:                  &push_to_staging
  - buildah bud
      --format=docker
      --build-arg VCS_REF="$CI_COMMIT_SHA"
      --build-arg BUILD_DATE="$(date +%Y%m%d)"
      --build-arg REGISTRY_PATH="$REGISTRY_PATH"
      --tag "$REGISTRY_PATH/$IMAGE_NAME:staging"
      --file "dockerfiles/$IMAGE_NAME/Dockerfile" dockerfiles
  - echo "$DOCKER_PASSWORD" |
      buildah login --username "$DOCKER_USER" --password-stdin "$REGISTRY_NAME"
  - buildah info
  - buildah push --format=v2s2 "$REGISTRY_PATH/$IMAGE_NAME:staging"
  - buildah logout "$REGISTRY_NAME"

.publish_as_latest_too:            &publish_as_latest_too
  - echo "$DOCKER_PASSWORD" |
      buildah login --username "$DOCKER_USER" --password-stdin "$REGISTRY_NAME"
  - buildah info
  - buildah tag "$REGISTRY_PATH/$IMAGE_NAME:staging" "$REGISTRY_PATH/$IMAGE_NAME:latest"
  - buildah push --format=v2s2 "$REGISTRY_PATH/$IMAGE_NAME:latest"
  - buildah logout "$REGISTRY_NAME"

.push_to_production:               &push_to_production
  - export IMAGE_DATE_TAG="$CI_COMMIT_SHORT_SHA-$(date +%Y%m%d)"
  - env REGISTRY_AUTH_FILE= buildah pull "$REGISTRY_PATH/$IMAGE_NAME:staging"
  - buildah tag "$REGISTRY_PATH/$IMAGE_NAME:staging" "$REGISTRY_PATH/$IMAGE_NAME:production"
  - buildah tag "$REGISTRY_PATH/$IMAGE_NAME:staging" "$REGISTRY_PATH/$IMAGE_NAME:$IMAGE_DATE_TAG"
  - echo "$DOCKER_PASSWORD" |
      buildah login --username "$DOCKER_USER" --password-stdin "$REGISTRY_NAME"
  - buildah info
  - buildah push --format=v2s2 "$REGISTRY_PATH/$IMAGE_NAME:production"
  - buildah push --format=v2s2 "$REGISTRY_PATH/$IMAGE_NAME:$IMAGE_DATE_TAG"
  - buildah logout "$REGISTRY_NAME"

#### stage:                        build

# Build and push to docker hub
ansible:
  <<:                              *docker_build
  script:
    - *push_to_docker_hub

base-ci-linux:
  <<:                              *docker_build
  script:
    - *push_to_docker_hub

base-ci:
  <<:                              *docker_build
  script:
    - *push_to_docker_hub

ci-linux:
  <<:                              *docker_build
  script:
    - *push_to_staging

ink-ci-linux:
  <<:                              *docker_build
  script:
    - *push_to_staging

parity-scale-codec:
  <<:                              *docker_build
  script:
    - *push_to_staging

ink-waterfall-ci:
  <<:                              *docker_build
  script:
    - *push_to_docker_hub

contracts-ci-linux:
  <<:                              *docker_build
  script:
    - *push_to_staging
    - *publish_as_latest_too

debian10:
  <<:                              *docker_build
  script:
    - *push_to_docker_hub

bridges-ci:
  <<:                              *docker_build
  script:
    - *push_to_staging

cachepot-ci:
  <<:                              *docker_build
  script:
    - *push_to_staging

awscli:
  <<:                              *docker_build
  script:
    - *push_to_docker_hub

tools:
  <<:                              *docker_build
  script:
    - *push_to_docker_hub

benchmarks:
  <<:                              *docker_build
  script:
    - *push_to_docker_hub

query-exporter:
  <<:                              *docker_build
  script:
    - *push_to_docker_hub

redis-exporter:
  <<:                              *docker_build
  script:
    - *push_to_docker_hub

molecule:
  <<:                              *docker_build
  script:
    - *push_to_docker_hub

multisig-ci:
  <<:                              *docker_build
  script:
    - *push_to_docker_hub

node-bench-regression-guard:
  <<:                              *docker_build
  script:
    - *push_to_docker_hub

node-wrk:
  <<:                              *docker_build
  script:
    - *push_to_docker_hub

# special case as version tags are introduced
kubetools:
  <<:                              *docker_build
  variables:
    <<:                            *default-vars
    # https://github.com/kubernetes/kubernetes/releases
    BUILD_KUBE_VERSION:            "1.18.2"
    # https://github.com/kubernetes/helm/releases
    # will be overwritten by the global variable at
    # https://gitlab.parity.io/groups/parity/-/settings/ci_cd
    BUILD_HELM_VERSION:            "2.16.11"
  script:
    - |
      cat <<-EOT
      |
      | # build of kubetools image
      |
      | KUBE_VERSION = $BUILD_KUBE_VERSION
      | HELM_VERSION = $BUILD_HELM_VERSION
      |
      EOT
    # beware that latest is helm2, not helm3
    # TODO: helm3 should be latest
    - buildah bud
      --format=docker
      --build-arg VCS_REF="$CI_COMMIT_SHA"
      --build-arg BUILD_DATE="$(date -u '+%Y-%m-%dT%H:%M:%SZ')"
      --build-arg REGISTRY_PATH="$REGISTRY_PATH"
      --build-arg KUBE_VERSION="$BUILD_KUBE_VERSION"
      --build-arg HELM_VERSION="$BUILD_HELM_VERSION"
      --tag "$REGISTRY_PATH/$IMAGE_NAME:latest"
      --tag "$REGISTRY_PATH/$IMAGE_NAME:helm2"
      --tag "$REGISTRY_PATH/$IMAGE_NAME:$BUILD_HELM_VERSION"
      --file "dockerfiles/$IMAGE_NAME/Dockerfile" dockerfiles
    # Push to Dockerhub
    - echo "$DOCKER_PASSWORD" |
        buildah login --username "$DOCKER_USER" --password-stdin "$REGISTRY_NAME"
    - buildah info
    - buildah push --format=v2s2 "$REGISTRY_PATH/$IMAGE_NAME:latest"
    - buildah push --format=v2s2 "$REGISTRY_PATH/$IMAGE_NAME:helm2"
    - buildah push --format=v2s2 "$REGISTRY_PATH/$IMAGE_NAME:$BUILD_HELM_VERSION"
    - buildah logout "$REGISTRY_NAME"

# waits until kubetools job above is deprecated, "latest" tag remains after the old image
kubetools-helm3:
  <<:                              *docker_build
  variables:
    <<:                            *default-vars
    IMAGE_NAME:                    kubetools
    # https://kubernetes.io/docs/tasks/tools/install-kubectl-linux/
    BUILD_KUBE_VERSION:            "1.20.0"
    # https://github.com/helm/helm/releases
    BUILD_HELM_VERSION:            "3.5.3"
    BUILD_HELMFILE_VERSION:        "0.140.0"
    BUILD_HELM_DIFF_PLUGIN_VERSION: "3.1.3"

  script:
    - |
      cat <<-EOT
      |
      | # build of kubetools image
      |
      | KUBE_VERSION = $BUILD_KUBE_VERSION
      | HELM_VERSION = $BUILD_HELM_VERSION
      | BUILD_HELMFILE_VERSION = $BUILD_HELMFILE_VERSION
      | BUILD_HELM_DIFF_PLUGIN_VERSION = $BUILD_HELM_DIFF_PLUGIN_VERSION
      |
      EOT
    - buildah bud
      --format=docker
      --build-arg VCS_REF="$CI_COMMIT_SHA"
      --build-arg BUILD_DATE="$(date -u '+%Y-%m-%dT%H:%M:%SZ')"
      --build-arg REGISTRY_PATH="$REGISTRY_PATH"
      --build-arg KUBE_VERSION="$BUILD_KUBE_VERSION"
      --build-arg HELM_VERSION="$BUILD_HELM_VERSION"
      --build-arg HELMFILE_VERSION="$BUILD_HELMFILE_VERSION"
      --build-arg HELM_DIFF_PLUGIN_VERSION="$BUILD_HELM_DIFF_PLUGIN_VERSION"
      --tag "$REGISTRY_PATH/kubetools:helm3"
      --tag "$REGISTRY_PATH/kubetools:$BUILD_HELM_VERSION"
      --file "dockerfiles/kubetools/helm3.Dockerfile" dockerfiles
    # Push to Dockerhub
    - echo "$DOCKER_PASSWORD" |
        buildah login --username "$DOCKER_USER" --password-stdin "$REGISTRY_NAME"
    - buildah info
    - buildah push --format=v2s2 "$REGISTRY_PATH/kubetools:helm3"
    - buildah push --format=v2s2 "$REGISTRY_PATH/kubetools:$BUILD_HELM_VERSION"
    - buildah logout "$REGISTRY_NAME"

terraform:
  <<:                              *docker_build
  variables:
    <<:                            *default-vars
    # https://releases.hashicorp.com/terraform/
    TERRAFORM_VERSION:             "1.0.4"
    # https://releases.hashicorp.com/vault/
    VAULT_VERSION:                 "1.8.0"
  script:
    - |
      cat <<-EOT
      |
      | # build of terraform image
      |
      | TERRAFORM_VERSION = $TERRAFORM_VERSION
      | VAULT_VERSION     = $VAULT_VERSION
      |
      EOT
    - buildah bud
      --format=docker
      --build-arg VCS_REF="$CI_COMMIT_SHA"
      --build-arg BUILD_DATE="$(date -u '+%Y-%m-%dT%H:%M:%SZ')"
      --build-arg REGISTRY_PATH="$REGISTRY_PATH"
      --build-arg TERRAFORM_VERSION="$TERRAFORM_VERSION"
      --build-arg VAULT_VERSION="$VAULT_VERSION"
      --tag "$REGISTRY_PATH/$IMAGE_NAME:latest"
      --tag "$REGISTRY_PATH/$IMAGE_NAME:$TERRAFORM_VERSION"
      --file "dockerfiles/$IMAGE_NAME/Dockerfile" dockerfiles
    # Push to Dockerhub
    - echo "$DOCKER_PASSWORD" |
        buildah login --username "$DOCKER_USER" --password-stdin "$REGISTRY_NAME"
    - buildah info
    - buildah push --format=v2s2 "$REGISTRY_PATH/$IMAGE_NAME:latest"
    - buildah push --format=v2s2 "$REGISTRY_PATH/$IMAGE_NAME:$TERRAFORM_VERSION"
    - buildah logout "$REGISTRY_NAME"

sops:
  <<:                              *docker_build
  variables:
    <<:                            *default-vars
    # https://github.com/mozilla/sops/releases/
    SOPS_VERSION:                  "3.7.0"
    # https://releases.hashicorp.com/vault/
    VAULT_VERSION:                 "1.6.3"
  script:
    - |
      cat <<-EOT
      |
      | # build of terraform image
      |
      | SOPS_VERSION      = $SOPS_VERSION
      | VAULT_VERSION     = $VAULT_VERSION
      |
      EOT
    - buildah bud
      --format=docker
      --build-arg VCS_REF="$CI_COMMIT_SHA"
      --build-arg BUILD_DATE="$(date -u '+%Y-%m-%dT%H:%M:%SZ')"
      --build-arg REGISTRY_PATH="$REGISTRY_PATH"
      --build-arg SOPS_VERSION="$SOPS_VERSION"
      --build-arg VAULT_VERSION="$VAULT_VERSION"
      --tag "$REGISTRY_PATH/$IMAGE_NAME:latest"
      --tag "$REGISTRY_PATH/$IMAGE_NAME:$SOPS_VERSION"
      --file "dockerfiles/$IMAGE_NAME/Dockerfile" dockerfiles
    # Push to Dockerhub
    - echo "$DOCKER_PASSWORD" |
        buildah login --username "$DOCKER_USER" --password-stdin "$REGISTRY_NAME"
    - buildah info
    - buildah push --format=v2s2 "$REGISTRY_PATH/$IMAGE_NAME:latest"
    - buildah push --format=v2s2 "$REGISTRY_PATH/$IMAGE_NAME:$SOPS_VERSION"
    - buildah logout "$REGISTRY_NAME"


#### stage:                        test

container_scanning:
  image:
    name:                          docker.io/aquasec/trivy:latest
    entrypoint:                    [""]
  variables:
    FULL_IMAGE_NAME:               $REGISTRY_PATH/$IMAGE_NAME:$IMAGE_TAG
    GIT_STRATEGY:                  none
  script:
    - trivy --version
    # cache cleanup is needed when scanning images with the same tags, it does not remove the database
    - time trivy image --clear-cache
    # update vulnerabilities db
    - time trivy --download-db-only --no-progress --cache-dir .trivycache/
    # Build report
    - time trivy --exit-code 0 --cache-dir .trivycache/ --no-progress --format template --template "@/contrib/gitlab.tpl"
        --output "$CI_PROJECT_DIR/gl-container-scanning-report.json" "$FULL_IMAGE_NAME"
    # Print report
    - time trivy --exit-code 0 --cache-dir .trivycache/ --no-progress "$FULL_IMAGE_NAME"
    # Fail on high and critical vulnerabilities
    - time trivy --exit-code 1 --cache-dir .trivycache/ --severity CRITICAL --no-progress "$FULL_IMAGE_NAME"
  cache:
    # TODO: move this cache to k8s volume when it's configured
    paths:
      - .trivycache/
  artifacts:
    when:                          always
    reports:
      container_scanning:          gl-container-scanning-report.json
  rules:
    # $IMAGE_TAG is needed for trivy. Should me mentioned in schedule's variables. I.e. latest, staging, v2.0.0.
    - if: $IMAGE_NAME && $IMAGE_TAG
  # TODO: remove when all criticals are solved
  allow_failure:                   true
  tags:
    - kubernetes-parity-build

ci-linux-test-substrate:
  stage:                           test
  variables:
    CI_IMAGE:                      "paritytech/ci-linux:staging"
    # this is to rewrite "-Dwarnings" we use in Substrate CI since new warnings
    # are often introduced and we do not want to fail on them in this case
    RUSTFLAGS:                     "-Cdebug-assertions=y"
  rules:
    - if: $IMAGE_NAME == "ci-linux"
  trigger:
    project:                       parity/substrate
    branch:                        master
    strategy:                      depend

ci-linux-test-polkadot:
  stage:                           test
  variables:
    CI_IMAGE:                      "paritytech/ci-linux:staging"
    # this is to rewrite "-Dwarnings" we use in Polkadot CI since new warnings
    # are often introduced and we do not want to fail on them in this case
    RUSTFLAGS:                     "-Cdebug-assertions=y"
  rules:
    - if: $IMAGE_NAME == "ci-linux"
  trigger:
    project:                       parity/polkadot
    branch:                        master
    strategy:                      depend

ink-ci-linux-test:
  stage:                           test
  variables:
    CI_IMAGE:                      "paritytech/ink-ci-linux:staging"
  rules:
    - if: $IMAGE_NAME == "ink-ci-linux"
  trigger:
    project:                       parity/ink
    branch:                        master
    strategy:                      depend

contracts-ci-linux-test:
  stage:                           test
  variables:
    CI_IMAGE:                      "paritytech/contracts-ci-linux:staging"
  rules:
    - if: $IMAGE_NAME == "contracts-ci-linux"
  trigger:
    project:                       parity/cargo-contract
    branch:                        master
    strategy:                      depend

cachepot-ci-test:
  stage:                           test
  variables:
    CI_IMAGE:                      "paritytech/cachepot-ci:staging"
  rules:
    - if: $IMAGE_NAME == "cachepot-ci"
  trigger:
    project:                       parity/cachepot
    branch:                        master
    strategy:                      depend

bridges-ci-test:
  stage:                           test
  variables:
    CI_IMAGE:                      "paritytech/bridges-ci:staging"
  rules:
    - if: $IMAGE_NAME == "bridges-ci"
  trigger:
    project:                       parity/parity-bridges-common
    branch:                        master
    strategy:                      depend

#### stage:                        prod

ci-linux-production:
  stage:                           prod
  image:                           quay.io/buildah/stable
  rules:
    - if: $IMAGE_NAME == "ci-linux"
  script:
    - *push_to_production
  tags:
    - kubernetes-parity-build

ink-ci-linux-production:           &push-after-triggered-pipeline
  stage:                           prod
  image:                           quay.io/buildah/stable
  needs:
    - job:                         ink-ci-linux-test
      artifacts:                   false
  rules:
    - if: $IMAGE_NAME == "ink-ci-linux"
  script:
    - *push_to_production
  tags:
    - kubernetes-parity-build

contracts-ci-linux-production:
  <<:                              *push-after-triggered-pipeline
  needs:
    - job:                         contracts-ci-linux-test
      artifacts:                   false
  rules:
    - if: $IMAGE_NAME == "contracts-ci-linux"


cachepot-ci-production:
  <<:                              *push-after-triggered-pipeline
  needs:
    - job:                         cachepot-ci-test
      artifacts:                   false
  rules:
    - if: $IMAGE_NAME == "cachepot-ci"

bridges-ci-production:
  <<:                              *push-after-triggered-pipeline
  needs:
    - job:                         bridges-ci-test
      artifacts:                   false
  rules:
    - if: $IMAGE_NAME == "bridges-ci"