.gitlab-ci.yml

stages:
  - build
  - scan
  - package

variables:
  ARTIFACT_COMPRESSION_LEVEL: "fast"
  CACHE_COMPRESSION_LEVEL: "fast"

set-vars:
  stage: .pre
  image: docker.io/alpine:3.15
  script:
    - cat .env >> build.env
    - source build.env
    - >
      echo "IMAGE_NAME=${INTERNAL_REG}/${APP_NAME}:${APP_VERSION}-${CI_COMMIT_REF_NAME}"
      >> build.env
  artifacts:
    reports:
      dotenv: build.env

image-build:
  stage: build
  image:
    name: gcr.io/kaniko-project/executor:v1.8.1-debug
    entrypoint: [""]
  before_script:
    - >
      echo "${IMAGE_REGISTRY_CA_CERT}"
      | base64 -d >> /kaniko/ssl/certs/ca-certificates.crt
    - mkdir -p /kaniko/.docker
    - >
      echo "{\"auths\":{\"${INTERNAL_REG}\":{\"auth\":\"$(printf
      "%s:%s" "${IMAGE_REGISTRY_USER}" "${IMAGE_REGISTRY_PASS}"
      | base64 | tr -d '\n')\"}}}" > /kaniko/.docker/config.json
  script:
    - >
      /kaniko/executor
      --force
      --context "${CI_PROJECT_DIR}"
      --dockerfile "${CI_PROJECT_DIR}/Dockerfile"
      --target=prod
      --cache=true
      --destination "${IMAGE_NAME}-unverified"
      --build-arg APP_VERSION="${APP_VERSION}"
      --build-arg PYTHON_IMG_TAG="${PYTHON_IMG_TAG}"
      --build-arg MAINTAINER="${MAINTAINER}"
      --build-arg EXTERNAL_REG="${EXTERNAL_REG}"
      --build-arg INTERNAL_REG="${INTERNAL_REG}"

image-scan:
  stage: scan
  image:
    name: docker.io/aquasec/trivy:0.23.0
    entrypoint: [""]
  variables:
    GIT_STRATEGY: none
  before_script:
    - >
      echo "${IMAGE_REGISTRY_CA_CERT}"
      | base64 -d >> /etc/ssl/certs/ca-certificates.crt
  script:
    - trivy --version
    - time trivy image --clear-cache
    - time trivy --cache-dir .trivycache/ image --download-db-only --no-progress
    # Create report artifact
    - >
      time trivy --cache-dir .trivycache/ image --exit-code 0 --ignore-unfixed
      --no-progress --format template --template "@/contrib/gitlab.tpl"
      --output "$CI_PROJECT_DIR/img-scan-report.json"
      "$IMAGE_NAME-unverified"
    # Print full report
    - >
      time trivy --cache-dir .trivycache/ image --exit-code 0 --ignore-unfixed
      --no-progress "$IMAGE_NAME"-unverified
    # Fail on critical vulnerabilities
    - >
      time trivy --cache-dir .trivycache/ image --exit-code 1 --ignore-unfixed
      --severity CRITICAL --no-progress "$IMAGE_NAME"-unverified
  cache:
    key: trivy-cache
    paths:
      - .trivycache/
    policy: pull-push
  artifacts:
    when: always
    reports:
      container_scanning: img-scan-report.json

image-retag:
  stage: package
  image: docker.io/regclient/regctl:v0.3-alpine
  variables:
    GIT_STRATEGY: none
  before_script:
    - export REG_HOST=${INTERNAL_REG%/*}
    - >
      echo "{\"hosts\":{\"${REG_HOST}\":{\"tls\":\"enabled\",\"regcert\":
      \"$(printf "%s" "${IMAGE_REGISTRY_CERT}" | base64 -d
      | awk 'NF {sub(/\r/, ""); printf "%s\\n",$0;}')\",\"hostname\":
      \"${REG_HOST}\",\"user\":\"${IMAGE_REGISTRY_USER}\",\"pass\":
      \"${IMAGE_REGISTRY_PASS}\"}}}" >> /home/appuser/.regctl/config.json
  script:
    - >
      regctl --verbosity debug image copy
      "${IMAGE_NAME}-unverified" "${IMAGE_NAME}"
    - >
      regctl --verbosity debug image copy
      "${IMAGE_NAME}" "${INTERNAL_REG}/${APP_NAME}:latest"
    - regctl --verbosity debug tag delete "${IMAGE_NAME}-unverified"