.gitlab-ci.yml

stages:
  - prepare
  - test
  - release
  - trigger deploy
  - veracode scan
  - deps scan
  - generate pages

variables:
  MYSQL_ROOT_PASSWORD: "root"
  MYSQL_DATABASE: "ota_tuf"
  MYSQL_USER: "ota_tuf"
  MYSQL_PASSWORD: "ota_tuf"
  VAULT_ADDR: "http://vault.sit-ota.aws.in.here.com"

build CI nginx:
  stage: prepare
  image: advancedtelematic/gitlab-jobs:0.2.2
  except:
    - schedules
  only:
    changes:
      - cli/src/test/resources/*
      - deploy/ci.nginx.Dockerfile
  tags:
    - docker-sock
    - vault-token
  script:
    - export VAULT_TOKEN=$(cat /opt/vault/token)
    - gitlab-docker-login $VAULT_ADDR
    - cd deploy && ./build-tuf-nginx.sh
    - docker push advancedtelematic/tuf-nginx:latest

test:
  stage: test
  except:
    - schedules
  services:
    - name: advancedtelematic/tuf-nginx:latest
      alias: tuf-nginx
    - name: mariadb:10.2
      alias: db
      command:
        - --character-set-server=utf8
        - --collation-server=utf8_unicode_ci
        - --max_connections=1000
  image: advancedtelematic/gitlab-jobs:0.2.2
  variables:
    DB_URL: "jdbc:mariadb://db:3306/ota_tuf"
    MTLS_REPOSERVER_URI: "https://tuf-nginx:8181/"
  before_script:
    - ./deploy/gitlab-db-setup.sh mysql db
  script:
    - sbt -sbt-dir ./.sbt -ivy ./.ivy2 ut:test
  cache:
    paths:
      - .ivy2/
      - .sbt

release:
  stage: release
  except:
    - schedules
  only:
    refs:
      - master
  tags:
    - docker-sock
    - vault-token
  variables:
    AWS_BUCKET_ID: "ota-tuf-cli-releases"
    AWS_REGION: "eu-west-1"
  image: advancedtelematic/gitlab-jobs:0.2.2
  script:
    - git fetch origin
    - git describe
    - export VAULT_TOKEN=$(cat /opt/vault/token)
    - gitlab-docker-login $VAULT_ADDR
    - eval $(set-vault-env -v $VAULT_ADDR --secret gitlab/ats-aws-key --secret gitlab/maven-publish)
    - sbt -x -sbt-dir ./.sbt -ivy ./.ivy2 -batch release
  cache:
    paths:
      - .ivy2/
      - .sbt/

trigger dev reposerver deploy:
  stage: trigger deploy
  except:
    - schedules
  only:
    refs:
      - master
  variables:
    ENV: "dev"
    NEW_TAG: $CI_COMMIT_SHA
    SERVICE: tuf-reposerver
    CREATE_COMMIT: "true"
  trigger:
    project: OLP/EDGE/OTA/infra/deployment-descriptors
    branch: master

trigger dev keyserver deploy:
  stage: trigger deploy
  except:
    - schedules
  only:
    - master
  variables:
    ENV: "dev"
    NEW_TAG: $CI_COMMIT_SHA
    SERVICE: tuf-keyserver
    CREATE_COMMIT: "true"
  trigger:
    project: OLP/EDGE/OTA/infra/deployment-descriptors
    branch: master


trigger sit keyserver deploy:
  stage: trigger deploy
  except:
    - schedules
  only:
    - deploy/sit
  variables:
    ENV: "sit"
    NEW_TAG: $CI_COMMIT_SHA
    SERVICE: tuf-keyserver
    CREATE_COMMIT: "true"
  trigger:
    project: OLP/EDGE/OTA/infra/deployment-descriptors
    branch: master


trigger sit reposerver deploy:
  stage: trigger deploy
  except:
    - schedules
  only:
    - deploy/sit
  variables:
    ENV: "sit"
    NEW_TAG: $CI_COMMIT_SHA
    SERVICE: tuf-reposerver
    CREATE_COMMIT: "true"
  trigger:
    project: OLP/EDGE/OTA/infra/deployment-descriptors
    branch: master

veracode scan:
  # prepare and submit for static code analysis
  stage: veracode scan
  only:
    refs:
      - schedules
    variables:
      - $VERACODE_API_ID
  image: advancedtelematic/veracode:0.1.3
  before_script:
    - sbt package
  script:
    - run-veracode.sh
  artifacts:
    paths:
      - /tmp/package.zip

deps scan:
  # perform dependencies CVE analysis
  stage: deps scan
  only:
    - schedules
  image: advancedtelematic/gitlab-jobs:0.2.2
  script:
    - sbt dependencyCheckAggregate
    - mv target/scala-*/dependency-check-report.html ./depchk.html
  artifacts:
    paths:
      - depchk.html

pages:
  stage: generate pages
  only:
    - schedules
  dependencies:
    - deps scan
  script:
    - mkdir -p public
    - mv depchk.html public/index.html
  artifacts:
    paths:
      - public
    expire_in: 64 days