.gitlab-ci.yml

stages:
  - lint
  - build
  - test
  - check
  - deploy

.registry_login: &registry_login
  echo "$CI_REGISTRY_PASSWORD" | docker login -u "$CI_REGISTRY_USER" --password-stdin "$CI_REGISTRY"

default:
  image: docker:latest
  services:
    - docker:dind
  before_script:
    - *registry_login
  after_script:
    - docker logout "$CI_REGISTRY"

include:
  - template: Security/Container-Scanning.gitlab-ci.yml
  - template: Security/Secret-Detection.gitlab-ci.yml

variables:
  DOCKER_DRIVER: overlay2
  DOCKER_HOST: tcp://docker:2375
  DOCKER_IMAGE: $CI_REGISTRY_IMAGE/commit:$CI_COMMIT_SHA
  DOCKER_IMAGE_HUB: kkopper/ktlint

.latest:
  rules:
    - if: $CI_COMMIT_BRANCH == "$CI_DEFAULT_BRANCH"
      changes:
        - Dockerfile

.tag:
  rules:
    - if: $CI_COMMIT_TAG
      changes:
        - Dockerfile

hadolint:
  stage: lint
  image: hadolint/hadolint:latest-debian
  inherit:
    default: false
    variables: false
  rules:
    - changes:
       - Dockerfile
       - .hadolint.yaml
  script:
    - hadolint Dockerfile

build:
  stage: build
  rules:
    - changes:
       - Dockerfile
  before_script:
    - token=$( wget -q -O - "https://gitlab.com/jwt/auth?service=container_registry&scope=repository:${CI_PROJECT_PATH}/commit:pull" | sed -e 's/^{"token":"\(.*\)"}$/\1/g' )
    - >-
        wget -q -O - --header="Authorization: Bearer ${token}" "https://${CI_REGISTRY}/v2/${CI_PROJECT_PATH}/commit/tags/list" |
        sed -e 's/^.*"tags":\[\(.*\)\].*$/\1/g' |
        tr -d \" | tr , '\n' |
        grep -E -q -e "$CI_COMMIT_SHA" &&
        {
        echo "Image for commit $CI_COMMIT_SHA already exists. No need to build it again." ;
        exit 0 ;
        } || true
    - *registry_login
  script:
    - docker build --pull -t "$DOCKER_IMAGE" .
    - docker push "$DOCKER_IMAGE"

.test:
  stage: test
  before_script:
    - *registry_login
    - docker pull "$DOCKER_IMAGE"
  variables:
    GIT_STRATEGY: none

call version:
  extends:
    - .test
    - .latest
  script:
    - docker run --rm "$DOCKER_IMAGE" ktlint --version

compare version:
  extends:
    - .test
    - .tag
  script:
    - >-
        docker run --rm "$DOCKER_IMAGE" ktlint --version |
        grep -F "$CI_COMMIT_TAG"

container_scanning:
  stage: check
  inherit:
    default: false
  variables:
    CI_APPLICATION_REPOSITORY: $CI_REGISTRY_IMAGE/commit
  rules:
    - if: $CONTAINER_SCANNING_DISABLED
      when: never
    - if: $CI_COMMIT_BRANCH &&
          $GITLAB_FEATURES =~ /\bcontainer_scanning\b/
      changes:
        - Dockerfile
    - if: $CI_COMMIT_TAG
      when: never

secret_detection:
  stage: check
  inherit:
    default: false

.deploy:
  stage: deploy
  dependencies:
    - build
  variables:
    GIT_STRATEGY: none

.registry:
  extends: .deploy
  before_script:
    - *registry_login
    - docker pull "$DOCKER_IMAGE"

registry-latest:
  extends:
    - .registry
    - .latest
  environment:
    name: GitLab Registry
    url: $CI_PROJECT_URL/container_registry
  script:
    - docker tag "$DOCKER_IMAGE" "$CI_REGISTRY_IMAGE:latest"
    - docker push "$CI_REGISTRY_IMAGE:latest"

registry-tag:
  extends:
    - .registry
    - .tag
  script:
    - docker tag "$DOCKER_IMAGE" "$CI_REGISTRY_IMAGE:$CI_COMMIT_TAG"
    - docker push "$CI_REGISTRY_IMAGE:$CI_COMMIT_TAG"

.hub:
  extends: .deploy
  before_script:
    - *registry_login
    - echo "$HUB_PASSWORD" | docker login -u "$GITLAB_USER_LOGIN" --password-stdin
    - docker pull "$DOCKER_IMAGE"
  after_script:
    - docker logout
    - docker logout "$CI_REGISTRY"

hub-latest:
  extends:
    - .hub
    - .latest
  environment:
    name: Docker Hub
    url: https://hub.docker.com/r/$DOCKER_IMAGE_HUB
  script:
    - docker tag "$DOCKER_IMAGE" "$DOCKER_IMAGE_HUB:latest"
    - docker push "$DOCKER_IMAGE_HUB:latest"

hub-tag:
  extends:
    - .hub
    - .tag
  script:
    - docker tag "$DOCKER_IMAGE" "$DOCKER_IMAGE_HUB:$CI_COMMIT_TAG"
    - docker push "$DOCKER_IMAGE_HUB:$CI_COMMIT_TAG"