.gitlab-ci.yml

stages:
  - conform
  - test
  - codequality
  - build
  - pages

include:
  template: Dependency-Scanning.gitlab-ci.yml

variables:
  APP_BUILD_VERSION: 0.0.0
  APP_BUILD_MODE: development
  IMAGE_GOLANG_ALPINE: docker.io/golang:1.21.5-alpine3.18@sha256:9390a996e9f957842f07dff1e9661776702575dd888084e72d86eaa382ad56e3
  IMAGE_PYTHON: docker.io/python:3.8-buster@sha256:04c3f641c2254c229fd2f704c5199ff4bea57d26c1c29008ae3a4afddde98709
  IMAGE_GOLANGCI_LINT: docker.io/golangci/golangci-lint:v1.53.3@sha256:1e0e2867b387bf68762427db499a963e43582b06819992db205fc31daa75ceea
  COSIGN_YES: "true"

.image-set-build-env: &image-set-build-env |
  echo "Commit made on '${CI_COMMIT_TIMESTAMP}'"
  export APP_BUILD_HASH="$CI_COMMIT_SHORT_SHA"
  export APP_BUILD_DATE=$(git show -s --format=%cd --date=format:'%Y.%m.%d.%H%M')
  export APP_BUILD_VERSION=0.0.0
  export APP_BUILD_MODE=development
  export IMAGE_DESTINATIONS="latest"
  if [[ ! -z "$CI_COMMIT_TAG" ]]; then
    export APP_BUILD_VERSION="$CI_COMMIT_TAG"
    export APP_BUILD_MODE=production
    export IMAGE_DESTINATIONS="$APP_BUILD_VERSION"
  fi

.setup-testing-repo: &setup-testing-repo |
  echo 'https://dl-cdn.alpinelinux.org/alpine/edge/testing' | tee -a /etc/apk/repositories

build-backend-smoketest:
  stage: codequality
  image: $IMAGE_GOLANG_ALPINE
  script:
    - go build -o /dev/null .

build-container:
  only:
    - main
    - tags
  stage: build
  image:
    name: $IMAGE_GOLANG_ALPINE
    entrypoint: [""]
  retry: 2
  id_tokens:
    SIGSTORE_ID_TOKEN:
      aud: "sigstore"
  variables:
    KO_DOCKER_REPO: "$CI_REGISTRY_IMAGE"
  before_script:
    - set -x
    - *setup-testing-repo
    - apk add --no-cache curl cosign ko git
    - export KO_DOCKER_REPO="$(echo ${KO_DOCKER_REPO} | tr '[:upper:]' '[:lower:]')"
    - ko login "${CI_REGISTRY}" -u "${CI_REGISTRY_USER}" -p "${CI_REGISTRY_PASSWORD}"
    - *image-set-build-env
  script:
    - |
      IMAGE="$(ko publish \
      --bare \
      --tags "${IMAGE_DESTINATIONS}" \
      .)"
    - cosign sign --recursive -y "$IMAGE"
    - cosign download sbom $IMAGE > /tmp/sbom-spdx.json
    - cosign attest -y --recursive --predicate /tmp/sbom-spdx.json $IMAGE

spell_check:
  stage: codequality
  image:
    name: $IMAGE_GOLANG_ALPINE
    entrypoint: [""]
  allow_failure: true
  before_script:
    - go install github.com/client9/misspell/cmd/misspell@latest
  script:
    - misspell -error main.go cmd pkg docs k8s-manifests README*

lint_backend:
  stage: codequality
  image:
    name: $IMAGE_GOLANG_ALPINE
    entrypoint: [""]
  allow_failure: true
  before_script:
    - go install golang.org/x/lint/golint@latest
  script:
    - golint -set_exit_status ./...

gotest:
  stage: codequality
  image: $IMAGE_GOLANG_ALPINE
  script:
    - go test -cover -v ./...

govet:
  stage: codequality
  image: $IMAGE_GOLANG_ALPINE
  script:
    - go vet -v ./...

gofmt:
  stage: codequality
  image: $IMAGE_GOLANG_ALPINE
  script:
    - find . -name "*.go" | grep -E -v vendor | xargs gofmt -s -l -d -w -s

goimports:
  stage: codequality
  image: $IMAGE_GOLANG_ALPINE
  before_script:
    - apk add --no-cache git
    - go install golang.org/x/tools/cmd/goimports@latest
  script:
    - find . -type f -name '*.go' -not -path './vendor/*' | xargs -I{} goimports -w {}
    - |
      if git diff --name-only --diff-filter=ACMRT | grep -E '(.*).go$'; then
        echo "error: changes detected, run 'find . -type f -name '*.go' -not -path './vendor/*' | xargs -I{} goimports -w {}'"
        exit 1
      fi

golangci-lint:
  stage: codequality
  image:
    name: $IMAGE_GOLANGCI_LINT
    entrypoint: [""]
  script:
    - golangci-lint run

govulncheck:
  stage: codequality
  image: $IMAGE_GOLANG_ALPINE
  before_script:
    - go install golang.org/x/vuln/cmd/govulncheck@latest
  script:
    - govulncheck ./...

pages:
  image: $IMAGE_PYTHON
  stage: pages
  before_script:
    - pip install mkdocs-material material-plausible-plugin
  script:
    - mkdocs build
    - mv site public
  artifacts:
    paths:
      - public
  only:
    - main

conform:
  stage: conform
  only:
    - merge_requests
  image:
    name: docker.io/library/alpine:3.18
    entrypoint: [""]
  before_script:
    - apk add --no-cache curl git
    - git fetch origin
    - |
      curl -sSL \
        -o /usr/local/bin/conform \
        https://github.com/siderolabs/conform/releases/download/v0.1.0-alpha.27/conform-linux-amd64
    - chmod +x /usr/local/bin/conform
  script:
    - conform enforce --commit-ref=refs/remotes/origin/main