.gitlab-ci.yml

###
image: docker:dind

variables:
  GIT_REPO_PATH: src/github.com/Axway # overridden from variables.yml
  GIT_REPO_NAME: agent-sdk

  # for agent trigger jobs
  AWS_DISCOVERY_PROJECT_ID: 7397
  V7_DISCOVERY_PROJECT_ID: 7540
  AZURE_DISCOVERY_PROJECT_ID: 8585

  # Fortify
  FORTIFY_PROJECT: "10566"
  FORTIFY_BUILD_ID: "apic_agents_sdk"
  FORTIFY_INCLUDE: "**/*.go"
  FORTIFY_EXCLUDE: "**/*_test.go"

  # Blackduck
  BLACKDUCK_PROJECT_NAME: "Amplify - APIC Agent SDK"

  # SRM
  SRM_PROJECT_NAME: "$BLACKDUCK_PROJECT_NAME"
  SRM_PROJECT_ID: "225"

  # just to be sure we don't do vendoring
  GOFLAGS: "-mod=mod"

############################################################
# Section for external includes
############################################################
include:
  - project: "apigov/gitlabci"
    ref: master
    file: "/.gitlab-ci-sonar.yml"
  - project: "apigov/beano_cicd"
    ref: $BEANO_CICD_LATEST
    # the order of these include files is important
    file:
      - "/gitlabci/variables.yml"
      - "/gitlabci/restrictions.yml"
      - "/gitlabci/jobs.yml"
  - project: "scurity/gitlabci"
    ref: $SCURITY_LATEST
    file:
      - "/.gitlab-ci-fortify.yml"
      - "/.gitlab-ci-twistlock.yml"
      - "/.gitlab-ci-iriusrisk.yml"
      - "/.gitlab-ci-blackduck.yml"
      - "/.gitlab-ci-csr.yml"
  - project: "apigov/beano_cicd"
    ref: $BEANO_CICD_LATEST
    # this one MUST be after the scurity jobs in order for overrides to work correctly!
    file:
      - "/gitlabci/csrjobs.yml"
      - "/gitlabci/csrjobsformirror.yml"

stages:
  - test
  - qa-test
  - sonar-preview
  - sonar-publish
  - security-scans
  - security-review
  - update-dep

############################################################
# Section for triggering agent updates
############################################################
.trigger-downstream-agent:
  stage: update-dep
  when: manual
  script:
    - apk update && apk add curl ca-certificates
    - echo "triggering downstream agent with SDK_SHA = ${CI_COMMIT_SHA}"
    - curl --request POST --form "token=${CI_JOB_TOKEN}" --form "variables[SDK_SHA]=${CI_COMMIT_SHA}" --form ref=master ${CURL_URL_FOR_TRIGGER}/${PROJECT_ID}/trigger/pipeline
  extends: .only-default-branch
  except:
    refs:
      - schedules

trigger-aws-apigw-discovery-agent:
  before_script:
    - export PROJECT_ID=${AWS_DISCOVERY_PROJECT_ID}
  extends: .trigger-downstream-agent

trigger-v7-discovery-agent:
  before_script:
    - export PROJECT_ID=${V7_DISCOVERY_PROJECT_ID}
  extends: .trigger-downstream-agent

trigger-azure-discovery-agent:
  before_script:
    - export PROJECT_ID=${AZURE_DISCOVERY_PROJECT_ID}
  extends: .trigger-downstream-agent

twistlock-discovery:on-schedule:
  rules:
    - !reference [.only-never-rule, rules]

twistlock-traceability:on-schedule:
  rules:
    - !reference [.only-never-rule, rules]

upload-files-to-srm:
  rules:
    - !reference [.only-never-rule, rules]

upload-files-to-srm:on-schedule:
  rules:
    - !reference [.only-never-rule, rules]

# For these 2, override the 'needs' from base
run-csr:
  needs:
    - fetch-fortify

update-csr:
  needs:
    - fetch-fortify:on-schedule
    - fetch-third-party:on-schedule