.gitlab-ci.yml

include:
  - file: /Scan/trivy.yml
    project: jitesoft/gitlab-ci-lib
  - file: /OCI/buildbase.yml
    project: jitesoft/gitlab-ci-lib

stages:
  - pre
  - download
  - build
  - containerize
  - post
  - scan

variables:
  REGISTRIES: "ghcr.io/jitesoft/nginx,jitesoft/nginx,${CI_REGISTRY_IMAGE},quay.io/jitesoft/nginx"

check:
  image: registry.gitlab.com/jitesoft/dockerfiles/misc:latest
  rules:
    - if: '$CI_PIPELINE_SOURCE == "schedule"'
      when: always
    - if: '$CI_PIPELINE_SOURCE == "web"'
      when: always
    - when: never
  variables:
    GIT_STRATEGY: none
  stage: pre
  script:
    - touch STABLE.txt
    - touch MAINLINE.txt
    - VERSIONS=$(wget -qO- https://nginx.org/en/download.html | grep -oP '(?<=\<a href=\"/download/nginx\-)([0-9]{0,2}(\.?)){2}([0-9]{0,2})' | awk '{print $1}' | uniq | head -n2)
    - MAINLINE=$(echo $VERSIONS | awk '{print $1}');
    - STABLE=$(echo $VERSIONS | awk '{print $2}');
    - |
      if [ ! -z "${FORCE_BUILD+x}" ] || [ "${MAINLINE}" != "$(cat MAINLINE.txt)" ]; then
        curl -F token=${CI_JOB_TOKEN} -F ref=master -F "variables[VERSION]=${MAINLINE}" -F "variables[BUILD]=true" -F "variables[TYPE]=MAINLINE" https://gitlab.com/api/v4/projects/${CI_PROJECT_ID}/trigger/pipeline
      else
        curl -F token=${CI_JOB_TOKEN} -F ref=master -F "variables[VERSION]=${MAINLINE}" -F "variables[SCAN]=true" https://gitlab.com/api/v4/projects/${CI_PROJECT_ID}/trigger/pipeline
      fi
    - |
      if [ ! -z "${FORCE_BUILD+x}" ] || [ "${STABLE}" != "$(cat STABLE.txt)" ]; then
        curl -F token=${CI_JOB_TOKEN} -F ref=master -F "variables[VERSION]=${STABLE}" -F "variables[BUILD]=true" -F "variables[TYPE]=STABLE" https://gitlab.com/api/v4/projects/${CI_PROJECT_ID}/trigger/pipeline
      else
        curl -F token=${CI_JOB_TOKEN} -F ref=master -F "variables[VERSION]=${STABLE}" -F "variables[SCAN]=true" https://gitlab.com/api/v4/projects/${CI_PROJECT_ID}/trigger/pipeline
      fi
  cache:
    paths:
      - MAINLINE.txt
      - STABLE.txt
    key: nginx.versions
    policy: pull

scan:
  stage: scan
  extends: .container_scanning
  rules:
    - if: $SCAN == "true"
      when: always
    - if: "$VERSION"
      when: always
    - when: never
  variables:
    SCANNING_IMAGE_NAME: "${CI_REGISTRY_IMAGE}:${VERSION}"
    GIT_STRATEGY: none

gpg:import:
  rules:
    - if: "$BUILD"
      when: always
    - when: never
  image: registry.gitlab.com/jitesoft/dockerfiles/misc:latest
  stage: pre
  script:
    - |
      if [ -f keys.out ]; then
        gpg --import keys.out
      fi
    - |
      for key in `cat pgpkeys.txt`; do
        gpg --list-keys ${key} || (
          gpg --keyserver pgp.mit.edu --recv-keys "${key}" ||
          gpg --keyserver keyserver.pgp.com --recv-keys "${key}" ||
          gpg --keyserver ha.pool.sks-keyservers.net --recv-keys "${key}"
        )
      done
    - gpg --export > keys.out
  cache:
    key: nginx.gpg.keyring
    paths:
      - keys.out
  artifacts:
    paths:
      - keys.out
    expire_in: 1 day

download:
  rules:
    - if: "$BUILD"
      when: on_success
    - when: never
  stage: download
  image: registry.gitlab.com/jitesoft/dockerfiles/misc:latest
  variables:
    GIT_STRATEGY: none
  needs:
    - job: gpg:import
      artifacts: true
  script:
    - gpg --import keys.out
    - curl -L https://nginx.org/download/nginx-${VERSION}.tar.gz -o nginx-${TYPE}.tar.gz
    - curl -L https://nginx.org/download/nginx-${VERSION}.tar.gz.asc -o pgp.asc
    - gpg --verify pgp.asc nginx-${TYPE}.tar.gz
  artifacts:
    paths:
      - nginx-*.tar.gz
    expire_in: 1 day

build:
  extends: .buildbase_variables
  parallel:
    matrix:
      - { BUILD_IMAGE: "$BUILDBASE_IMAGE_amd64_3_16", TAG: "native-amd64", ARCH: "amd64" }
      - { BUILD_IMAGE: "$BUILDBASE_IMAGE_arm64_3_16", TAG: "native-aarch64", ARCH: "arm64" }
      - { BUILD_IMAGE: "$BUILDBASE_IMAGE_arm_3_16", TAG: "buildx", ARCH: "arm" }
      - { BUILD_IMAGE: "$BUILDBASE_IMAGE_s390x_3_16", TAG: "buildx", ARCH: "s390x" }
      - { BUILD_IMAGE: "$BUILDBASE_IMAGE_386_3_16", TAG: "buildx", ARCH: "386" }
      - { BUILD_IMAGE: "$BUILDBASE_IMAGE_ppc64le_3_16", TAG: "buildx", ARCH: "ppc64le" }
  tags: [ $TAG ]
  image: $BUILD_IMAGE
  rules:
    - if: "$BUILD"
      when: on_success
    - when: never
  stage: build
  needs:
    - job: download
      artifacts: true
  before_script:
    - echo "My architecture is $(cat /etc/apk/arch)!"
    - export PATH="/usr/lib/ccache/bin:$PATH"
    - mkdir -p ${CI_PROJECT_DIR}/ccache
    - mkdir -p ${CI_PROJECT_DIR}/src
    - export CCACHE_DIR="${CI_PROJECT_DIR}/ccache"
    - ccache -s
    - export CPPFLAGS="${CPPFLAGS} -fstack-protector-strong -fpic -fpie -O2"
    - export CFLAGS="${CFLAGS} -fstack-protector-strong -fpic -fpie -O2"
    - tar -xzf nginx-${TYPE}.tar.gz -C src --strip-components=1
  script:
    - addgroup -g 1000 www-data && adduser -u 1000 -G www-data -s /bin/sh -D www-data
    - apk add --no-cache pcre-dev libxml2-dev libxslt-dev gd-dev geoip-dev perl-dev
    - cd src
    - |
      ./configure \
        --user=www-data \
        --group=www-data \
        --conf-path=/etc/nginx/nginx.conf \
        --with-http_addition_module \
        --with-http_addition_module \
        --with-http_auth_request_module \
        --with-http_dav_module \
        --with-http_geoip_module \
        --with-http_gzip_static_module \
        --with-http_image_filter_module \
        --with-http_perl_module \
        --with-http_realip_module \
        --with-http_ssl_module \
        --with-http_stub_status_module \
        --with-http_sub_module \
        --with-http_xslt_module \
        --with-ipv6 \
        --with-mail \
        --with-mail_ssl_module \
        --with-pcre-jit \
        --error-log-path=/proc/self/fd/2 \
        --http-log-path=/proc/self/fd/1 \
        --prefix=/usr/local/nginx \
        --sbin-path=/usr/local/bin
    - make
    - find -type f -name '*.a' -delete
    - make install
    - cd ..
    - cp entrypoint /usr/local/bin/
    - cp healthcheck /usr/local/bin/
    - $(cd /usr/local && tar -czf /tmp/nginx-${ARCH}.tar.gz *)
    - $(cd /etc/nginx && tar -czf /tmp/nginx-conf-${ARCH}.tar.gz *)
    - mkdir binaries
    - cp nginx.conf binaries/nginx.conf
    - cp healthcheck.conf binaries/healthcheck.conf
    - cp default.template binaries/default.template
    - mv /tmp/nginx-${ARCH}.tar.gz binaries/
    - mv /tmp/nginx-conf-${ARCH}.tar.gz binaries/
  after_script:
    - ccache -s
  cache:
    paths:
      - ccache
    key: nginx.build-ccache-${ARCH}-${TYPE}
  artifacts:
    paths:
      - binaries/
    when: on_success
    expire_in: 1 day

containerize:
  image: registry.gitlab.com/jitesoft/dockerfiles/misc:latest
  rules:
    - if: "$BUILD"
      when: on_success
    - when: never
  variables:
    ARCHS: "linux/arm64,linux/amd64,linux/386,linux/ppc64le,linux/s390x,linux/arm/v7"
  stage: containerize
  needs:
    - job: build
      artifacts: true
  script:
    - touch MAINLINE.txt
    - touch STABLE.txt
    - EXTRA_TAGS=""
    - if [  "${TYPE}" == "MAINLINE" ]; then EXTRA_TAGS=",latest"; fi
    - TYPE_TAG=$(echo "${TYPE}" | awk '{print tolower($0)}')
    - TAGS=$(helper "${REGISTRIES}" "${VERSION},${TYPE_TAG}${EXTRA_TAGS}")
    - docker buildx build --platform ${ARCHS} --push ${TAGS} --progress plain --build-arg VERSION=${VERSION} --build-arg BUILD_TIME="$(date -Iseconds)" .
    - echo -e "${VERSION}" > ${TYPE}.txt
  tags: [ buildx, protected ]
  cache:
    policy: pull-push
    paths:
      - MAINLINE.txt
      - STABLE.txt
    key: nginx.versions

#push:non-multi-arch:
#  rules:
#    - if: "$BUILD"
#      when: on_success
#    - when: never
#  stage: post
#  image: registry.gitlab.com/jitesoft/dockerfiles/misc:latest
#  script:
#    - TYPE_TAG=$(echo "${TYPE}" | awk '{print tolower($0)}')
#    - docker pull ${CI_REGISTRY_IMAGE}:${TYPE_TAG}
#    - helper multitag ${CI_REGISTRY_IMAGE}:${TYPE_TAG} quay.io/jitesoft/nginx:latest quay.io/jitesoft/nginx:${VERSION} quay.io/jitesoft/nginx:${TYPE_TAG}
#    - helper multipush quay.io/jitesoft/nginx:latest quay.io/jitesoft/nginx:${VERSION} quay.io/jitesoft/nginx:${TYPE_TAG}
#  tags: [ protected, buildx ]