.gitlab-ci.yml

stages:
  - compile
  - build
  - test
  - deploy

# templates
.kanikoJob: &kanikoJob
  image:
    name: gcr.io/kaniko-project/executor:debug
    entrypoint: [""]
  before_script:
    - echo "{\"auths\":{\"$CI_REGISTRY\":{\"username\":\"$CI_REGISTRY_USER\",\"password\":\"$CI_REGISTRY_PASSWORD\"}}}" > /kaniko/.docker/config.json

# jobs
buildImage:
  stage: build
  <<: *kanikoJob
  script:
    - /kaniko/executor --cache --context $CI_PROJECT_DIR
      --dockerfile $CI_PROJECT_DIR/Dockerfile
      --destination $CI_REGISTRY_IMAGE:$CI_COMMIT_SHORT_SHA
  rules:
    - if: '$CI_COMMIT_BRANCH == "main"'
    - if: '$CI_MERGE_REQUEST_TARGET_BRANCH_NAME == "main"'

tagImage:
  stage: build
  <<: *kanikoJob
  script:
    - echo "FROM $CI_REGISTRY_IMAGE:$CI_COMMIT_SHORT_SHA" | /kaniko/executor --context $CI_PROJECT_DIR 
      --dockerfile /dev/stdin
      --destination $CI_REGISTRY_IMAGE:$CI_COMMIT_TAG
    - echo "FROM $CI_REGISTRY_IMAGE:$CI_COMMIT_SHORT_SHA" | /kaniko/executor --context $CI_PROJECT_DIR 
      --dockerfile /dev/stdin
      --destination $CI_REGISTRY_IMAGE:latest
  rules:
    - if: "$CI_COMMIT_TAG"

scanImage:
  stage: test
  image:
    name: ghcr.io/aquasecurity/trivy:0.19.2
    entrypoint: [""]
  variables:
    TRIVY_USERNAME: $CI_REGISTRY_USER
    TRIVY_PASSWORD: $CI_REGISTRY_PASSWORD
    TRIVY_NO_PROGRESS: "true"
  script:
    - trivy image $CI_REGISTRY_IMAGE:$CI_COMMIT_SHORT_SHA | tee -a image_security_scanning_report.txt
  artifacts:
    expire_in: 7 days
    paths:
      - image_security_scanning_report.txt
  rules:
    - if: '$CI_COMMIT_BRANCH == "main"'

pages:
  image: alpine/helm
  stage: deploy
  variables:
    TEMP_PUBLIC_DIR: ../public
  before_script:
    - cd charts
    - mkdir -p $TEMP_PUBLIC_DIR
  script:
    - "echo \"User-Agent: *\nDisallow: /\" > $TEMP_PUBLIC_DIR/robots.txt"
    - helm package */ --destination $TEMP_PUBLIC_DIR
    - helm repo index --url $CI_PAGES_URL $TEMP_PUBLIC_DIR
  artifacts:
    paths:
      - public
  rules:
    - if: '$CI_COMMIT_BRANCH == "main"'