stages:
  - build
  - test
  - sast
  - tag
  # - deploy

include:
  - template: Jobs/SAST-IaC.gitlab-ci.yml
  - template: Jobs/SAST.gitlab-ci.yml
  - template: Jobs/Secret-Detection.gitlab-ci.yml

default:
  retry: 1

variables:
  BASE_IMAGE_NAME: $CI_REGISTRY_IMAGE
  TRIVY_CACHE_DIR: .cache/trivy
  TRIVY_NO_PROGRESS: "true"
  TRIVY_TIMEOUT: "10m0s"
  TRIVY_USERNAME: $CI_REGISTRY_USER
  TRIVY_PASSWORD: $CI_REGISTRY_PASSWORD
  TRIVY_REGISTRY: $CI_REGISTRY
  DOCKER_HOST: "tcp://docker:2375"
  DOCKER_TLS_CERTDIR: ""

cache:
  key: "${CI_COMMIT_REF_SLUG}"
  paths:
    - $TRIVY_CACHE_DIR
  policy: pull-push

.docker-job: &docker-job
  image: docker.io/docker:cli
  tags:
    - k8s
  services:
    - docker.io/docker:dind
  before_script:
    - echo $CI_REGISTRY_PASSWORD | docker login -u "$CI_REGISTRY_USER" --password-stdin $CI_REGISTRY

.buildah-job: &buildah-job
  image: quay.io/containers/buildah:latest
  tags:
    - k8s
  variables:
    STORAGE_DRIVER: vfs
    BUILDAH_FORMAT: oci
    BUILDAH_ISOLATION: chroot
  before_script:
    - buildah login -u "$CI_REGISTRY_USER" -p "$CI_REGISTRY_PASSWORD" $CI_REGISTRY

.trivy-fs-template: &trivy-fs-scan
  image:
    name: docker.io/aquasec/trivy:latest
    entrypoint: [""]
  cache:
    paths:
      - $TRIVY_CACHE_DIR
    policy: pull-push
  before_script:
    - mkdir -p $TRIVY_CACHE_DIR
  script:
    - trivy filesystem --skip-files $TRIVY_CACHE_DIR --format cyclonedx --output fs-sbom.json .
    - trivy filesystem --skip-files $TRIVY_CACHE_DIR --format sarif --output gl-sast-fs-report.json .
  allow_failure: true
  artifacts:
    reports:
      sast: gl-sast-fs-report.json
    paths:
      - fs-sbom.json
      - gl-sast-fs-report.json
    expire_in: 1 week
    when: always
  rules:
    - if: $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH
    - if: $CI_COMMIT_TAG
    - if: $CI_PIPELINE_SOURCE == 'merge_request_event'
    - if: $SAST_DISABLED
      when: never

.trivy-image-template: &trivy-image-scan
  image:
    name: docker.io/aquasec/trivy:latest
    entrypoint: [""]
  cache:
    paths:
      - $TRIVY_CACHE_DIR
    policy: pull-push
  before_script:
    - mkdir -p $TRIVY_CACHE_DIR
  script:
    - |
      trivy image \
        --scanners vuln \
        --format cyclonedx \
        --output image-sbom-${IMAGE_TYPE}.json \
        $IMAGE_NAME:$CI_COMMIT_SHA
    - |
      trivy image \
        --format sarif \
        --output gl-sast-image-${IMAGE_TYPE}-report.json \
        $IMAGE_NAME:$CI_COMMIT_SHA
  allow_failure: true
  artifacts:
    reports:
      sast: gl-sast-image-${IMAGE_TYPE}-report.json
    paths:
      - image-sbom-${IMAGE_TYPE}.json
      - gl-sast-image-${IMAGE_TYPE}-report.json
    expire_in: 1 week
    when: always
  rules:
    - if: $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH
    - if: $CI_COMMIT_TAG
    - if: $CI_PIPELINE_SOURCE == 'merge_request_event'
    - if: $SAST_DISABLED
      when: never

# .webhook-template: &webhook-config
#   image: curlimages/curl:latest
#   script:
#     - |
#       curl -sf -X POST \
#         -H "Content-Type: application/json" \
#         -H "Authorization: Bearer $WEBHOOK_SECRET_TOKEN" \
#         -H "Webhook-Identifier: $WEBHOOK_BYPASS_TOKEN" \
#         "$WEBHOOK_URL"
#   rules:
#     - if: $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH
#       when: on_success

.build-template: &build-config
  <<: *buildah-job
  stage: build
  script:
    - |
      buildah bud \
        --tag $IMAGE_NAME:$CI_COMMIT_SHA \
        --file $CONTAINERFILE \
        --target $BUILDTARGET \
        --build-arg SERVICE=${SERVICE_NAME} \
        --layers \
        --cache-from $IMAGE_NAME-cache \
        --cache-to $IMAGE_NAME-cache \
        .
    - buildah push $IMAGE_NAME:$CI_COMMIT_SHA
  rules:
    - if: $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH
      when: always
    - if: $CI_COMMIT_TAG
      when: always
    - if: $CI_PIPELINE_SOURCE == 'merge_request_event'
      when: manual
      allow_failure: true

.tag-template: &tag-config
  <<: *buildah-job
  stage: tag
  script:
    - |
      set -euo pipefail

      buildah pull $IMAGE_NAME:$CI_COMMIT_SHA

      if [ -n "${CI_COMMIT_TAG:-}" ]; then
        buildah tag $IMAGE_NAME:$CI_COMMIT_SHA $IMAGE_NAME:$CI_COMMIT_TAG
        buildah push $IMAGE_NAME:$CI_COMMIT_TAG
      fi

      if [ -n "${CI_COMMIT_BRANCH:-}" ]; then
        buildah tag $IMAGE_NAME:$CI_COMMIT_SHA $IMAGE_NAME:$CI_COMMIT_REF_SLUG
        buildah push $IMAGE_NAME:$CI_COMMIT_REF_SLUG

        if [ "$CI_COMMIT_BRANCH" = "$CI_DEFAULT_BRANCH" ]; then
          buildah tag $IMAGE_NAME:$CI_COMMIT_SHA $IMAGE_NAME:latest
          buildah push $IMAGE_NAME:latest
        fi
      fi
  rules:
    - if: $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH
    - if: $CI_COMMIT_TAG
    - if: $CI_PIPELINE_SOURCE == 'merge_request_event'
      when: manual
      allow_failure: true

build-auth:
  <<: *build-config
  variables:
    IMAGE_NAME: $BASE_IMAGE_NAME/auth
    CONTAINERFILE: Containerfile
    BUILDTARGET: runtime
    SERVICE_NAME: auth

build-migrate:
  <<: *build-config
  variables:
    IMAGE_NAME: $BASE_IMAGE_NAME/migrate
    CONTAINERFILE: Containerfile
    BUILDTARGET: runtime
    SERVICE_NAME: migrate

golangci-lint:
  stage: test
  image: docker.io/golangci/golangci-lint:latest-alpine
  variables:
    GOLANGCI_LINT_CACHE: $CI_PROJECT_DIR/.cache/golangci-lint
  cache:
    key: golangci-lint
    paths:
      - .cache/golangci-lint
      - /go/pkg/mod
  script:
    - golangci-lint run -c .golangci.yaml ./...
  allow_failure: true
  rules:
    - if: $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH
    - if: $CI_PIPELINE_SOURCE == 'merge_request_event'
    - if: $CI_COMMIT_TAG

# test:
#   <<: *docker-job
#   stage: test
#   tags:
#     - beta
#   variables:
#     COMPOSE_PROFILES: |
#       --profile migrations
#       --profile tests
#       --profile ml
#   script:
#     - apk add --no-cache docker-compose
#     - export PROFILES="$(printf '%s ' $COMPOSE_PROFILES)"
#     - cp "$TEST_STAGE_FIREBASE_CONF" ./infrastructure/configs/backend/firebase.json
#     - |
#       (
#         while true; do
#           docker compose -f compose.yaml $PROFILES logs -f 2>&1
#           sleep 1
#         done
#       ) | tee -a compose.log &
#     - LOGS_PID=$!
#     - |
#       REGISTRY_PREFIX=$CI_REGISTRY_IMAGE IMAGE_TAG=$CI_COMMIT_SHA \
#       docker compose -f compose.yaml -f compose.prod.yaml \
#       $PROFILES up -d --quiet-pull --quiet-build 2>&1 | tee compose.log
#     - |
#       TEST_CONTAINER_ID=$(docker compose -f compose.yaml $PROFILES ps -q tests -a)
#       timeout 600 docker wait $TEST_CONTAINER_ID
#       TEST_EXIT_CODE=$(docker inspect --format "{{.State.ExitCode}}" $TEST_CONTAINER_ID)

#       if [ $TEST_EXIT_CODE -eq 0 ]; then
#         echo "Tests passed."
#       else
#         echo "Tests failed with exit code $TEST_EXIT_CODE."
#         exit 1
#       fi
#     - |
#       docker compose -f compose.yaml $PROFILES down
#     - cat .cov/coverage.txt
#   artifacts:
#     paths:
#       - ./.cov
#       - ./compose.log
#     reports:
#       coverage_report:
#         coverage_format: cobertura
#         path: .cov/coverage.xml
#     expire_in: 1 week
#     when: always
#   coverage: /TOTAL.*? (100(?:\.0+)?\%|[1-9]?\d(?:\.\d+)?\%)$/
#   rules:
#     - if: $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH
#     - if: $CI_PIPELINE_SOURCE == 'merge_request_event'
#   dependencies:
#     - build-runtime
#     - build-tests
#     - build-migrations

sast-filesystem:
  <<: *trivy-fs-scan

sast-image-auth:
  <<: *trivy-image-scan
  variables:
    IMAGE_NAME: $BASE_IMAGE_NAME/auth
    IMAGE_TYPE: auth
  dependencies:
    - build-auth

tag-auth:
  <<: *tag-config
  variables:
    IMAGE_NAME: $BASE_IMAGE_NAME/auth

# webhook-backend-deploy:
#   <<: *webhook-config
#   stage: deploy
#   variables:
#     WEBHOOK_URL: $WEBHOOK_URL_BACKEND
#   environment:
#     name: staging
#     url: https://datarush.itqdev.xyz
#   resource_group: staging
#   dependencies:
#     - build-runtime
#     - sast-image-runtime

workflow:
  rules:
    - if: $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH
    - if: $CI_PIPELINE_SOURCE == "merge_request_event"
    - if: $CI_COMMIT_TAG