pipeline.yml

env:
  APP_NAME: ${BUILDKITE_PIPELINE_SLUG}
  IMAGE_REPO: ghcr.io/theopenlane/${APP_NAME}
  IMAGE_REPO_TC: ghcr.io/theopenlane/${APP_NAME}-tc
  IMAGE_TAG: ${BUILDKITE_BUILD_NUMBER}-${BUILDKITE_COMMIT:0:8}
  SONAR_HOST: "https://sonarcloud.io"
  INCLUDE_TRUST_CENTER: "false"
  GOPRIVATE: github.com/theopenlane/corejobs

steps:
  - group: ":test_tube: Tests"
    key: "tests"
    steps:
      - label: ":golangci-lint: lint :lint-roller:"
        key: "lint"
        if_changed:
          - "**.go"
          - .golangci.yaml
        cancel_on_build_failing: true
        command: "task go:tidy > /dev/null 2>&1 && task go:lint:ci"
        plugins:
          - docker#v5.13.0:
              image: "ghcr.io/theopenlane/build-image:latest"
              always-pull: true
      - label: ":golang: go test"
        key: "go_test"
        if_changed:
          - go.{mod,sum}
          - "**.go"
        cancel_on_build_failing: true
        command: |
          task go:tidy > /dev/null 2>&1
          task go:test:cover
        plugins:
          - docker#v5.13.0:
              image: "ghcr.io/theopenlane/build-image:latest"
              always-pull: true
        artifact_paths: ["coverage.out"]
      - label: ":github: upload PR reports"
        key: "scan-upload-pr"
        if: build.pull_request.id != null
        if_changed:
          - go.{mod,sum}
          - "**.go"
        depends_on: ["go_test"]
        plugins:
          - cluster-secrets#v1.0.0:
              variables:
                SONAR_TOKEN: SONAR_TOKEN
          - artifacts#v1.9.4:
              download: "coverage.out"
              step: "go_test"
          - docker#v5.13.0:
              image: "sonarsource/sonar-scanner-cli:11.2"
              environment:
                - "SONAR_TOKEN"
                - "SONAR_HOST_URL=$SONAR_HOST"
                - "SONAR_SCANNER_OPTS=-Dsonar.pullrequest.branch=$BUILDKITE_BRANCH -Dsonar.pullrequest.base=$BUILDKITE_PULL_REQUEST_BASE_BRANCH -Dsonar.pullrequest.key=$BUILDKITE_PULL_REQUEST"
      - label: ":github: upload reports"
        key: "scan-upload"
        if_changed:
          - go.{mod,sum}
          - "**.go"
        if: build.branch == "main"
        depends_on: ["go_test"]
        plugins:
          - cluster-secrets#v1.0.0:
              variables:
                SONAR_TOKEN: SONAR_TOKEN
          - artifacts#v1.9.4:
              download: coverage.out
              step: "go_test"
          - docker#v5.13.0:
              image: "sonarsource/sonar-scanner-cli:11.2"
              environment:
                - "SONAR_TOKEN"
                - "SONAR_HOST_URL=$SONAR_HOST"
  - group: ":golang: Builds"
    key: "go-builds"
    steps:
      - label: ":golang: build"
        key: "gobuild-server"
        command: |
          task go:tidy > /dev/null 2>&1
          task go:build:ci
        artifact_paths: "bin/${APP_NAME}"
        plugins:
          - docker#v5.13.0:
              image: "ghcr.io/theopenlane/build-image:latest"
              always_pull: true
              environment:
                - CGO_ENABLED=0
                - GOOS=linux
  - group: ":docker: Image Build"
    depends_on: "go-builds"
    key: "image-build"
    steps:
      - label: ":docker: docker pr build"
        key: "docker-pr-build"
        cancel_on_build_failing: true
        if: build.branch != "main" && build.tag == null
        if_changed:
          - go.{mod,sum}
          - "**.go"
        matrix:
          setup:
            platform:
              - amd64
              - arm64
        commands: |
          #!/bin/bash
          ls
        plugins:
          - cluster-secrets#v1.0.0:
              variables:
                SECRET_GHCR_PUBLISH_TOKEN: SECRET_GHCR_PUBLISH_TOKEN
          - docker-login#v3.0.0:
              username: openlane-bender
              password-env: SECRET_GHCR_PUBLISH_TOKEN
              server: ghcr.io
          - theopenlane/docker-metadata#v1.0.1:
              images:
                - "${IMAGE_REPO}"
              extra_tags:
                - "${IMAGE_TAG}"
              tag_prefix: "{{matrix.platform}}-"
          - theopenlane/container-build#v1.1.1:
              dockerfile: docker/Dockerfile
              push: false
              platforms: linux/{{matrix.platform}}
              build-args:
                - NAME=${APP_NAME}
                - BUILDTAGS=""
              secret-file: 'id=id_ed25519,src=$HOME/.ssh/id_ed25519'
          - equinixmetal-buildkite/trivy#v1.22.0:
              severity: CRITICAL,HIGH
              ignore-unfixed: true
              security-checks: config,secret,vuln
              skip-files: "cosign.key,Dockerfile.dev"
              trivy-version: "0.69.2"
      - label: ":docker: docker pr build with trust center"
        key: "docker-pr-build-tc"
        cancel_on_build_failing: true
        if: build.branch != "main" && build.tag == null
        if_changed:
          - go.{mod,sum}
          - "**.go"
        matrix:
          setup:
            platform:
              - amd64
              - arm64
        commands: |
          #!/bin/bash
          ls
        plugins:
          - cluster-secrets#v1.0.0:
              variables:
                GITHUB_SSH_PRIVATE_KEY: GITHUB_SSH_PRIVATE_KEY
                SECRET_GHCR_PUBLISH_TOKEN: SECRET_GHCR_PUBLISH_TOKEN
          - docker-login#v3.0.0:
              username: openlane-bender
              password-env: SECRET_GHCR_PUBLISH_TOKEN
              server: ghcr.io
          - theopenlane/docker-metadata#v1.0.1:
              images:
                - "${IMAGE_REPO_TC}"
              extra_tags:
                - "${IMAGE_TAG}"
              tag_prefix: "{{matrix.platform}}-"
          - theopenlane/container-build#v1.1.1:
              dockerfile: docker/Dockerfile
              push: false
              platforms: linux/{{matrix.platform}}
              build-args:
                - NAME=${APP_NAME}
                - BUILDTAGS=trustcenter
              secret-file: 'id=id_ed25519,src=$HOME/.ssh/id_ed25519'
          - equinixmetal-buildkite/trivy#v1.22.0:
              severity: CRITICAL,HIGH
              ignore-unfixed: true
              security-checks: config,secret,vuln
              skip-files: "cosign.key,Dockerfile.dev"
              trivy-version: "0.69.2"
      - label: ":docker: docker build and publish with tags"
        key: "docker-build"
        cancel_on_build_failing: true
        matrix:
          setup:
            platform:
              - amd64
              - arm64
        if: build.branch == "main"
        commands: |
          #!/bin/bash
          ls
        plugins:
          - cluster-secrets#v1.0.0:
              variables:
                SECRET_GHCR_PUBLISH_TOKEN: SECRET_GHCR_PUBLISH_TOKEN
          - docker-login#v3.0.0:
              username: openlane-bender
              password-env: SECRET_GHCR_PUBLISH_TOKEN
              server: ghcr.io
          - theopenlane/docker-metadata#v1.0.1:
              images:
                - "${IMAGE_REPO}"
              extra_tags:
                - "${IMAGE_TAG}"
                - latest
              tag_prefix: "{{matrix.platform}}-"
          - theopenlane/container-build#v1.1.1:
              dockerfile: docker/Dockerfile
              push: true
              platforms: linux/{{matrix.platform}}
              build-args:
                - NAME=${APP_NAME}
              secret-file: 'id=id_ed25519,src=$HOME/.ssh/id_ed25519'
          - equinixmetal-buildkite/trivy#v1.22.0:
              severity: CRITICAL,HIGH
              ignore-unfixed: true
              security-checks: config,secret,vuln
              skip-files: "cosign.key,Dockerfile.dev"
              trivy-version: "0.69.2"
      - label: ":docker: docker build and publish with tags includes trust center"
        key: "docker-build-tc"
        cancel_on_build_failing: true
        matrix:
          setup:
            platform:
              - amd64
              - arm64
        if: build.branch == "main"
        commands: |
          #!/bin/bash
          ls
        plugins:
          - cluster-secrets#v1.0.0:
              variables:
                SECRET_GHCR_PUBLISH_TOKEN: SECRET_GHCR_PUBLISH_TOKEN
                GITHUB_SSH_PRIVATE_KEY: GITHUB_SSH_PRIVATE_KEY
          - docker-login#v3.0.0:
              username: openlane-bender
              password-env: SECRET_GHCR_PUBLISH_TOKEN
              server: ghcr.io
          - theopenlane/docker-metadata#v1.0.1:
              images:
                - "${IMAGE_REPO_TC}"
              extra_tags:
                - "${IMAGE_TAG}"
                - latest
              tag_prefix: "{{matrix.platform}}-"
          - theopenlane/container-build#v1.1.1:
              dockerfile: docker/Dockerfile
              push: true
              platforms: linux/{{matrix.platform}}
              build-args:
                - NAME=${APP_NAME}
                - BUILDTAGS=trustcenter
              secret-file: 'id=id_ed25519,src=$HOME/.ssh/id_ed25519'
          - equinixmetal-buildkite/trivy#v1.22.0:
              severity: CRITICAL,HIGH
              ignore-unfixed: true
              security-checks: config,secret,vuln
              skip-files: "cosign.key,Dockerfile.dev"
              trivy-version: "0.69.2"
      - label: ":docker: docker build and publish"
        key: "docker-build-and-tag"
        if: build.tag != null && build.tag !~ /trustcenter\//
        matrix:
          setup:
            platform:
              - amd64
              - arm64
        commands: |
          #!/bin/bash
        plugins:
          - cluster-secrets#v1.0.0:
              variables:
                SECRET_GHCR_PUBLISH_TOKEN: SECRET_GHCR_PUBLISH_TOKEN
          - docker-login#v3.0.0:
              username: openlane-bender
              password-env: SECRET_GHCR_PUBLISH_TOKEN
              server: ghcr.io
          - theopenlane/docker-metadata#v1.0.1:
              images:
                - "${IMAGE_REPO}"
              extra_tags:
                - "${BUILDKITE_TAG}"
              tag_prefix: "{{matrix.platform}}-"
          - theopenlane/container-build#v1.1.1:
              dockerfile: docker/Dockerfile
              push: true
              platforms: linux/{{matrix.platform}}
              build-args:
                - NAME=${APP_NAME}
              secret-file: 'id=id_ed25519,src=$HOME/.ssh/id_ed25519'
      - label: ":docker: docker build and publish with trust center"
        key: "docker-build-and-tag-tc"
        if: build.tag != null && build.tag !~ /trustcenter\//
        matrix:
          setup:
            platform:
              - amd64
              - arm64
        commands: |
          #!/bin/bash
        plugins:
          - cluster-secrets#v1.0.0:
              variables:
                SECRET_GHCR_PUBLISH_TOKEN: SECRET_GHCR_PUBLISH_TOKEN
                GITHUB_SSH_PRIVATE_KEY: GITHUB_SSH_PRIVATE_KEY
          - docker-login#v3.0.0:
              username: openlane-bender
              password-env: SECRET_GHCR_PUBLISH_TOKEN
              server: ghcr.io
          - theopenlane/docker-metadata#v1.0.1:
              images:
                - "${IMAGE_REPO_TC}"
              extra_tags:
                - "${BUILDKITE_TAG}"
              tag_prefix: "{{matrix.platform}}-"
          - theopenlane/container-build#v1.1.1:
              dockerfile: docker/Dockerfile
              push: true
              platforms: linux/{{matrix.platform}}
              build-args:
                - NAME=${APP_NAME}
                - BUILDTAGS=trustcenter
              secret-file: 'id=id_ed25519,src=$HOME/.ssh/id_ed25519'