.nvidia-ci.yml

# Copyright (c) 2021-2022, NVIDIA CORPORATION.  All rights reserved.
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
#     http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.

default:
  image: docker
  services:
    - name: docker:dind
      command: ["--experimental"]
  tags:
    - cnt
    - container-dev
    - docker/multi-arch
    - docker/privileged
    - os/linux
    - type/docker

variables:
  GIT_SUBMODULE_STRATEGY: recursive

  DOCKER_DRIVER: overlay2
  DOCKER_TLS_CERTDIR: "/certs"
  # Release "devel"-tagged images off the main branch
  RELEASE_DEVEL_BRANCH: "main"
  DEVEL_RELEASE_IMAGE_VERSION: "devel"
  # On the multi-arch builder we don't need the qemu setup.
  SKIP_QEMU_SETUP: "1"
  # Define the public staging registry
  STAGING_REGISTRY: ghcr.io/nvidia
  STAGING_VERSION: ${CI_COMMIT_SHORT_SHA}
  ARTIFACTORY_REPO_BASE: "https://urm.nvidia.com/artifactory/sw-gpu-cloudnative"
  KITMAKER_RELEASE_FOLDER: "kitmaker"
  PACKAGE_ARCHIVE_RELEASE_FOLDER: "releases"

stages:
  - pull
  - scan
  - release
  - ngc-publish

.pipeline-trigger-rules:
  rules:
    # We trigger the pipeline if started manually
    - if: $CI_PIPELINE_SOURCE == "web"
    # We trigger the pipeline on the main branch
    - if: $CI_COMMIT_BRANCH == "main"
    # We trigger the pipeline on the release- branches
    - if: $CI_COMMIT_BRANCH =~ /^release-.*$/
    # We trigger the pipeline on tags
    - if: $CI_COMMIT_TAG && $CI_COMMIT_TAG != ""

workflow:
  rules:
    # We trigger the pipeline on a merge request
    - if: $CI_PIPELINE_SOURCE == 'merge_request_event'
    # We then add all the regular triggers
    - !reference [.pipeline-trigger-rules, rules]

# Download the regctl binary for use in the release steps
.regctl-setup:
  before_script:
    - export REGCTL_VERSION=v0.4.5
    - apk add --no-cache curl
    - mkdir -p bin
    - curl -sSLo bin/regctl https://github.com/regclient/regclient/releases/download/${REGCTL_VERSION}/regctl-linux-amd64
    - chmod a+x bin/regctl
    - export PATH=$(pwd)/bin:${PATH}

# .copy-images copies the required application and packaging images from the
# IN_IMAGE="${IN_IMAGE_NAME}:${IN_IMAGE_TAG}${TAG_SUFFIX}"
# to
# OUT_IMAGE="${OUT_IMAGE_NAME}:${OUT_IMAGE_TAG}${TAG_SUFFIX}"
# The script also logs into IN_REGISTRY and OUT_REGISTRY using the supplied
# username and tokens.
.copy-images:
  parallel:
    matrix:
      - TAG_SUFFIX: ["", "-packaging"]
  before_script:
    - !reference [.regctl-setup, before_script]
    - apk add --no-cache make bash
  variables:
    REGCTL: regctl
  script:
    - |
      if [ -n ${IN_REGISTRY} ] && [ -n ${IN_REGISTRY_USER} ]; then
        echo "Logging in to ${IN_REGISTRY}"
        ${REGCTL} registry login "${IN_REGISTRY}" -u "${IN_REGISTRY_USER}" -p "${IN_REGISTRY_TOKEN}" || exit 1
      fi

      if [ -n ${OUT_REGISTRY} ] && [ -n ${OUT_REGISTRY_USER} ] && [ "${IN_REGISTRY}" != "${OUT_REGISTRY}" ]; then
        echo "Logging in to ${OUT_REGISTRY}"
        ${REGCTL} registry login "${OUT_REGISTRY}" -u "${OUT_REGISTRY_USER}" -p "${OUT_REGISTRY_TOKEN}" || exit 1
      fi

      export IN_IMAGE="${IN_IMAGE_NAME}:${IN_IMAGE_TAG}${TAG_SUFFIX}"
      export OUT_IMAGE="${OUT_IMAGE_NAME}:${OUT_IMAGE_TAG}${TAG_SUFFIX}"

      echo "Copying ${IN_IMAGE} to ${OUT_IMAGE}"
      ${REGCTL} image copy ${IN_IMAGE} ${OUT_IMAGE}

# pull-images pulls images from the public CI registry to the internal CI registry.
pull-images:
  extends:
    - .copy-images
  stage: pull
  variables:
    IN_REGISTRY: "${STAGING_REGISTRY}"
    IN_IMAGE_NAME: ${STAGING_REGISTRY}/container-toolkit
    IN_IMAGE_TAG: "${STAGING_VERSION}"

    OUT_REGISTRY: "${CI_REGISTRY}"
    OUT_REGISTRY_USER: "${CI_REGISTRY_USER}"
    OUT_REGISTRY_TOKEN: "${CI_REGISTRY_PASSWORD}"
    OUT_IMAGE_NAME: "${CI_REGISTRY_IMAGE}/container-toolkit"
    OUT_IMAGE_TAG: "${CI_COMMIT_SHORT_SHA}"
  # We delay the job start to allow the public pipeline to generate the required images.
  rules:
    # If the pipeline is triggered from a tag or the WEB UI we don't delay the
    # start of the pipeline.
    - if: $CI_COMMIT_TAG || $CI_PIPELINE_SOURCE == "web"
    # If the pipeline is triggered through other means (i.e. a branch or MR)
    # we add a 30 minute delay to ensure that the images are available in the
    # public CI registry.
    - when: delayed
      start_in: 30 minutes
  timeout: 30 minutes
  retry:
    max: 2
    when:
      - job_execution_timeout
      - stuck_or_timeout_failure

# We skip the integration tests for the internal CI:
.integration:
  stage: test
  before_script:
    - echo "Skipped in internal CI"
  script:
    - echo "Skipped in internal CI"

# The .scan step forms the base of the image scan operation performed before releasing
# images.
scan-images:
  stage: scan
  needs:
  - pull-images
  image: "${PULSE_IMAGE}"
  parallel:
    matrix:
      - TAG_SUFFIX: [""]
        PLATFORM: ["linux/amd64", "linux/arm64"]
      - TAG_SUFFIX: "-packaging"
        PLATFORM: "linux/amd64"
  variables:
    IMAGE: "${CI_REGISTRY_IMAGE}/container-toolkit:${CI_COMMIT_SHORT_SHA}"
    IMAGE_ARCHIVE: "container-toolkit-${CI_JOB_ID}.tar"
  allow_failure: true
  script:
    - |
      docker login -u "${CI_REGISTRY_USER}" -p "${CI_REGISTRY_PASSWORD}" "${CI_REGISTRY}"
      export SCAN_IMAGE=${IMAGE}${TAG_SUFFIX}
      echo "Scanning image ${SCAN_IMAGE} for ${PLATFORM}"
      docker pull --platform="${PLATFORM}" "${SCAN_IMAGE}"
      docker save "${SCAN_IMAGE}" -o "${IMAGE_ARCHIVE}"
      AuthHeader=$(echo -n $SSA_CLIENT_ID:$SSA_CLIENT_SECRET | base64 -w0)
      export SSA_TOKEN=$(curl --request POST --header "Authorization: Basic $AuthHeader" --header "Content-Type: application/x-www-form-urlencoded" ${SSA_ISSUER_URL} | jq ".access_token" |  tr -d '"')
      if [ -z "$SSA_TOKEN" ]; then exit 1; else echo "SSA_TOKEN set!"; fi

      pulse-cli -n $NSPECT_ID --ssa $SSA_TOKEN scan -i $IMAGE_ARCHIVE -p $CONTAINER_POLICY -o
      rm -f "${IMAGE_ARCHIVE}"
  artifacts:
    when: always
    expire_in: 1 week
    paths:
      - pulse-cli.log
      - licenses.json
      - sbom.json
      - vulns.json
      - policy_evaluation.json

upload-kitmaker-packages:
  stage: release
  needs:
    - pull-images
  variables:
    VERSION: "${CI_COMMIT_SHORT_SHA}"
    PACKAGE_REGISTRY: "${CI_REGISTRY}"
    PACKAGE_REGISTRY_USER: "${CI_REGISTRY_USER}"
    PACKAGE_REGISTRY_TOKEN: "${CI_REGISTRY_PASSWORD}"
    PACKAGE_IMAGE_NAME: "${CI_REGISTRY_IMAGE}/container-toolkit"
    PACKAGE_IMAGE_TAG: "${CI_COMMIT_SHORT_SHA}-packaging"
    KITMAKER_ARTIFACTORY_REPO: "${ARTIFACTORY_REPO_BASE}-generic-local/${KITMAKER_RELEASE_FOLDER}"
    ARTIFACTS_DIR: "${CI_PROJECT_DIR}/artifacts"
  script:
    - !reference [.regctl-setup, before_script]
    - apk add --no-cache bash git
    - regctl registry login "${PACKAGE_REGISTRY}" -u "${PACKAGE_REGISTRY_USER}" -p "${PACKAGE_REGISTRY_TOKEN}"
    - ./scripts/extract-packages.sh "${PACKAGE_IMAGE_NAME}:${PACKAGE_IMAGE_TAG}"
    - ./scripts/release-kitmaker-artifactory.sh "${KITMAKER_ARTIFACTORY_REPO}"
    - rm -rf ${ARTIFACTS_DIR}

push-images-to-staging:
  extends:
    - .copy-images
  stage: release
  needs:
    - scan-images
  variables:
    IN_REGISTRY: "${CI_REGISTRY}"
    IN_REGISTRY_USER: "${CI_REGISTRY_USER}"
    IN_REGISTRY_TOKEN: "${CI_REGISTRY_PASSWORD}"
    IN_IMAGE_NAME: "${CI_REGISTRY_IMAGE}/container-toolkit"
    IN_IMAGE_TAG: "${CI_COMMIT_SHORT_SHA}"

    OUT_REGISTRY: "${NGC_REGISTRY}"
    OUT_REGISTRY_USER: "${NGC_REGISTRY_USER}"
    OUT_REGISTRY_TOKEN: "${NGC_REGISTRY_TOKEN}"
    OUT_IMAGE_NAME: "${NGC_STAGING_REGISTRY}/container-toolkit"
    OUT_IMAGE_TAG: "${CI_COMMIT_SHORT_SHA}"

.publish-images:
  stage: ngc-publish
  needs:
    - scan-images
    - push-images-to-staging
  image:
    name: "${CNT_NGC_PUBLISH_IMAGE}"
    pull_policy: always
  variables:

  variables:
    GITLAB_ACCESS_TOKEN: "${CNT_GITLAB_TOKEN}"

    IN_IMAGE_TAG: "${CI_COMMIT_SHORT_SHA}"
    OUT_IMAGE_TAG: "${CI_COMMIT_TAG}"

    VERSION_FILE: "build-info-${CI_PIPELINE_ID}.txt"
    PROJECT_NAME: "nvidia-container-toolkit"
  before_script:
    - |
      if [ -n "${OVERRIDE_PUBLISHING_PROJECT_PATH}" ]; then
        NGC_PUBLISHING_PROJECT_PATH="${OVERRIDE_PUBLISHING_PROJECT_PATH}"
      fi

      if [ -z "${NGC_PUBLISHING_PROJECT_PATH}" ]; then
        echo "NGC_PUBLISHING_PROJECT_PATH not set"
        exit 1
      fi

      echo "publishing to ${NGC_PUBLISHING_PROJECT_PATH}"

      rm -f ${VERSION_FILE}
      echo "${IN_IMAGE_TAG} ${OUT_IMAGE_TAG}" >> ${VERSION_FILE}
      echo "${IN_IMAGE_TAG}-packaging ${OUT_IMAGE_TAG}-packaging" >> ${VERSION_FILE}
      cat ${VERSION_FILE}
  script:
    - cnt-ngc-publish render --project-name "${PROJECT_NAME}" --versions-file "${VERSION_FILE}" --output "${PROJECT_NAME}".yaml
    - cnt-ngc-publish merge-request --files "${PROJECT_NAME}.yaml"
  artifacts:
    paths:
      - "${VERSION_FILE}"
      - "${PROJECT_NAME}.yaml"


publish-images-to-ngc:
  extends:
    - .publish-images
  rules:
    - if: $CI_COMMIT_TAG

# We create a dummy MR that exercises the publishing logic.
# TODO: This MR should be closed automatically.
publish-images-dummy:
  extends:
    - .publish-images
  variables:
    OVERRIDE_PUBLISHING_PROJECT_PATH: "dl/container-dev/ngc-automation"
    OUT_IMAGE_TAG: "publish-${CI_COMMIT_SHORT_SHA}"
  rules:
    - if: $CI_COMMIT_TAG == null || $CI_COMMIT_TAG == ""