.gitlab-ci.yml

include:
  - ".gitlab/docker/.build_docker_image.yml"
  - ".gitlab/docker/.push_docker_image.yml"
  - ".gitlab/docker/.remove_docker_image.yml"
  - ".gitlab/docker/.remove_docker_image_from_registry.yml"
  - ".gitlab/sast/.shiftleft_container_scanning.yml"
  - ".gitlab/sast/.trivy_container_scanning.yml"

stages:
  - build_and_push:tmp_base_image
  - build_and_push:tmp_prod_image
  - sast:prod
  - remove:tmp_images_from_registry
  - push:final_images
  - remove:tmp_images_from_host

# -- Start - Build and push base image
build_base_image:
  stage: build_and_push:tmp_base_image
  extends:
    - .build_docker_image
  variables:
    DOCKER_TARGET: "base"
    CI_IMAGE_NAME: ${CI_COMMIT_SHORT_SHA}-${CI_PIPELINE_ID}
  tags:
    - build

push_tmp_base_image_to_registry:
  stage: build_and_push:tmp_base_image
  extends:
    - .push_docker_image
  needs:
    - build_base_image
  variables:
    CI_IMAGE_NAME: ${CI_COMMIT_SHORT_SHA}-${CI_PIPELINE_ID}
    DOCKER_TARGET: "base"
    IMAGE_TAGS: ${CI_COMMIT_SHORT_SHA}-${CI_PIPELINE_ID}
  tags:
    - build
# -- End - Build and push base image

# -- Start - build, push temp prod image, and test prod image
build_prod_image:
  stage: build_and_push:tmp_prod_image
  extends:
    - .build_docker_image
  variables:
    BASE_IMAGE_CACHE_TAG: ${CI_COMMIT_SHORT_SHA}-${CI_PIPELINE_ID}-base
    CI_IMAGE_NAME: ${CI_COMMIT_SHORT_SHA}-${CI_PIPELINE_ID}
    DOCKER_BUILD_ARGS: "--build-arg RAILS_ENV=production"
    DOCKER_TARGET: "production"
  needs:
    - push_tmp_base_image_to_registry
  tags:
    - build

push_tmp_prod_image_to_registry:
  stage: build_and_push:tmp_prod_image
  extends:
    - .push_docker_image
  needs:
    - build_prod_image
  variables:
    DOCKER_TARGET: "production"
    CI_IMAGE_NAME: ${CI_COMMIT_SHORT_SHA}-${CI_PIPELINE_ID}
    IMAGE_TAGS: ${CI_COMMIT_SHORT_SHA}-${CI_PIPELINE_ID}
  tags:
    - build

shiftleft_container_scanning:
  stage: sast:prod
  extends:
    - .shiftleft_container_scanning
  needs:
    - push_tmp_prod_image_to_registry
  tags:
    - build

trivy_container_scanning:
  stage: sast:prod
  extends:
    - .trivy_container_scanning
  before_script:
    - apk add --no-cache docker
    - docker login -u ${CI_REGISTRY_USER} -p ${CI_REGISTRY_PASSWORD} ${CI_REGISTRY}
  after_script:
    - docker logout ${CI_REGISTRY}
  needs:
    - push_tmp_prod_image_to_registry
  variables:
    CI_IMAGE_NAME: ${CI_REGISTRY_IMAGE}:${CI_COMMIT_SHORT_SHA}-${CI_PIPELINE_ID}-production
  tags:
    - build
  allow_failure: true
# -- End - build, push temp prod image, and test prod image

# -- Start - Remove temp images from registry
remove_tmp_prod_image_from_registry:
  stage: remove:tmp_images_from_registry
  extends:
    - .remove_docker_image_from_registry
  variables:
    IMAGE_TAG: ${CI_PROJECT_PATH}:${CI_COMMIT_SHORT_SHA}-${CI_PIPELINE_ID}-production
  rules:
    - when: always
  needs:
    - shiftleft_container_scanning
    - trivy_container_scanning
  tags:
    - build
  allow_failure: true

remove_tmp_base_image_from_registry:
  stage: remove:tmp_images_from_registry
  extends:
    - .remove_docker_image_from_registry
  variables:
    IMAGE_TAG: ${CI_PROJECT_PATH}:${CI_COMMIT_SHORT_SHA}-${CI_PIPELINE_ID}-base
  rules:
    - when: always
  needs:
    - build_prod_image
  tags:
    - build
  allow_failure: true
# -- End - Remove temp images from registry

# -- Start - push final images to registry
push_base_image_to_registry:
  stage: push:final_images
  extends:
    - .push_docker_image
  needs:
    - remove_tmp_base_image_from_registry
  variables:
    CI_IMAGE_NAME: ${CI_COMMIT_SHORT_SHA}-${CI_PIPELINE_ID}
    DOCKER_TARGET: "base"
  tags:
    - build

push_prod_image_to_registry:
  stage: push:final_images
  extends:
    - .push_docker_image
  needs:
    - remove_tmp_prod_image_from_registry
    - shiftleft_container_scanning
    - trivy_container_scanning
  variables:
    CI_IMAGE_NAME: ${CI_COMMIT_SHORT_SHA}-${CI_PIPELINE_ID}
    DOCKER_TARGET: "production"
    TAG_IMAGE_WITH_TARGET: "false"
  tags:
    - build
# -- End - push final images to registry

# -- Start - remove images passed through pipeline
remove_base_image:
  stage: remove:tmp_images_from_host
  extends:
    - .remove_docker_image
  needs:
    - push_base_image_to_registry
  variables:
    CI_IMAGE_NAME: ${CI_COMMIT_SHORT_SHA}-${CI_PIPELINE_ID}-base
  rules:
    - when: always
  tags:
    - build

remove_prod_image:
  stage: remove:tmp_images_from_host
  extends:
    - .remove_docker_image
  needs:
    - push_prod_image_to_registry
  variables:
    CI_IMAGE_NAME: ${CI_COMMIT_SHORT_SHA}-${CI_PIPELINE_ID}-production
  rules:
    - when: always
  tags:
    - build
# -- End - remove images passed through pipeline