.gitlab-ci.yml

.dagger:
  image: ghcr.io/purpleclay/dagger-cli:0.18.10
  variables:
    MINIO: s3.waw3-2.cloudferro.com
    BUCKET: registry-inference-server-controller
    GITLAB: git.apps.eo4eu.eu
    REPO_NAMESPACE: eo4eu/eo4eu-inference-server
    HELM_NAMESPACE: eo4eu/eo4eu-cicd/cicd-infra
    REGISTRY: registry.apps.eo4eu.eu
    REPO: controller
    SERVICE: eo4eu-inference-server
    HELM: helm-repo
    COOKIECUTTER_BRANCH: inference-server-controller
    YAML_RULES: rules/python_rules.yaml
    CONTEXT: build
  rules:
  - if: $CI_COMMIT_BRANCH == "main"
    variables: 
      REPO_BRANCH: main
      HELM_BRANCH: main
  - if: $CI_COMMIT_BRANCH == "dev"
    variables:
      REPO_BRANCH: dev
      HELM_BRANCH: dev
  before_script:
    - "apk update && apk --no-cache add wget"
    - "export VAULT_TOKEN=$(wget -qO- --method=PUT \
      --body-data='{\"role_id\":\"'\"$VAULT_ROLE_ID\"'\",\"secret_id\":\"'\"$VAULT_SECRET_ID\"'\"}' \
      \"$VAULT_SERVER_URL/v1/auth/approle/login\" | \
      jq -r '.auth.client_token')"
    - "export BEARER=\"X-Vault-Token: $VAULT_TOKEN\""
    - "export CI_REPO_USERNAME=$(wget -qO- --header=\"$BEARER\" \
      \"$VAULT_SERVER_URL/v1/kv/data/eo4eu-cicd/gitlab_credentials/$SERVICE/$REPO\" | \
      jq -r '.data.data.username')"
    - "export CI_REPO_PASSWORD=$(wget -qO- --header=\"$BEARER\" \
      \"$VAULT_SERVER_URL/v1/kv/data/eo4eu-cicd/gitlab_credentials/$SERVICE/$REPO\" | \
      jq -r '.data.data.password')"
    - "export CI_COOKIECUTTER_USERNAME=$(wget -qO- --header=\"$BEARER\" \
      \"$VAULT_SERVER_URL/v1/kv/data/gitlab_credentials/cookiecutter-repo\" | \
      jq -r '.data.data.username')"
    - "export CI_COOKIECUTTER_PASSWORD=$(wget -qO- --header=\"$BEARER\" \
      \"$VAULT_SERVER_URL/v1/kv/data/gitlab_credentials/cookiecutter-repo\" | \
      jq -r '.data.data.password')"
    - "export CI_HELM_USERNAME=$(wget -qO- --header=\"$BEARER\" \
      \"$VAULT_SERVER_URL/v1/kv/data/gitlab_credentials/$HELM\" | \
      jq -r '.data.data.username')"
    - "export CI_HELM_PASSWORD=$(wget -qO- --header=\"$BEARER\" \
      \"$VAULT_SERVER_URL/v1/kv/data/gitlab_credentials/$HELM\" | \
      jq -r '.data.data.password')"
    - "export S3_ACCESS_KEY=$(wget -qO- --header=\"$BEARER\" \
      \"$VAULT_SERVER_URL/v1/kv/data/s3_cloudferro_creds/gitlab\" | \
      jq -r '.data.data.s3_access_key')"
    - "export S3_SECRET_KEY=$(wget -qO- --header=\"$BEARER\" \
      \"$VAULT_SERVER_URL/v1/kv/data/s3_cloudferro_creds/gitlab\" | \
      jq -r '.data.data.s3_secret_key')"
    - "git clone -b $REPO_BRANCH \
      https://$CI_REPO_USERNAME:$CI_REPO_PASSWORD@$GITLAB/$REPO_NAMESPACE/$REPO.git"
    - "git clone -b $HELM_BRANCH \
      https://$CI_HELM_USERNAME:$CI_HELM_PASSWORD@$GITLAB/$HELM_NAMESPACE/$HELM.git"
    - "export TAG=$(git -C $REPO rev-parse HEAD)"
update_endpoint:
  extends: [.dagger]
  tags: [dagger]
  stage: .pre
  script:
    - cd $REPO
    - | 
      if git diff HEAD~1 | grep -Eq '^(-  kafka_source_endpoint:)'; then
        export KAFKA_ENDPOINT=$(grep 'kafka_source_endpoint:' \
          cookiecutter-config.yaml | \
          awk '{print $2}' | tr -d '"')
        find $CONTEXT -type f -exec sed -i \
          's/\(\s*"bootstrapServers": "\)\(.*\)/\1'"$KAFKA_ENDPOINT"'",/g' {} \;
        find $CONTEXT -type f -exec sed -i \
          's/\(\s*"bootstrapServers": \["\)\(.*\)/\1'"$KAFKA_ENDPOINT"'"\],/g' {} \;
        git config user.email "federico.fornari@ecmwf.int"
        git config user.name "Cookiecutter"
        git add --all
        git commit -m "Updated kafka endpoint by Cookiecutter" || true
        git push -o ci.skip
      fi
build_image:
  extends: [.dagger]
  tags: [dagger]
  stage: build
  needs: [update_endpoint]
  script:
    - cd $REPO
    - |
      if git diff --name-only HEAD~1 | grep -Eq '^('$CONTEXT'/)'; then
        dagger call build \
        --bucket $BUCKET \
        --endpoint https://$MINIO \
        --access env:S3_ACCESS_KEY \
        --secret env:S3_SECRET_KEY \
        --repo $REPO \
        --tag $TAG \
        --wkd $CONTEXT
      fi
scan_image:
  rules:
    - if: '$CI_COMMIT_BRANCH == "main" && $CI_COMMIT_MESSAGE =~ /trivy/'
      variables:
        REPO_BRANCH: main
        HELM_BRANCH: main
    - when: never
  extends: [.dagger]
  tags: [dagger]
  stage: test
  needs:
    - job: build_image
      optional: true
  dependencies: [build_image]
  script:
    - cd $REPO
    - |
      if git diff --name-only HEAD~1 | grep -Eq '^('$CONTEXT'/)'; then
        dagger call scan \
        --bucket $BUCKET \
        --endpoint https://$MINIO \
        --access env:S3_ACCESS_KEY \
        --secret env:S3_SECRET_KEY \
        --severity UNKNOWN,LOW,MEDIUM,HIGH,CRITICAL \
        --exit 0 \
        --repo $REPO \
        --tag $TAG \
        --wkd /builds/$REPO_NAMESPACE/$REPO \
        export \
        --path \
        /builds/$REPO_NAMESPACE/$REPO/vulnerabilities.html
        dagger call sbom \
        --bucket $BUCKET \
        --endpoint https://$MINIO \
        --access env:S3_ACCESS_KEY \
        --secret env:S3_SECRET_KEY \
        --repo $REPO \
        --tag $TAG \
        --wkd /builds/$REPO_NAMESPACE/$REPO \
        export \
        --path \
        /builds/$REPO_NAMESPACE/$REPO
      dagger call analyze-with-sonarqube \
        --yaml-rules $YAML_RULES \
        --source-directory $CONTEXT \
        --sonar-host-url $SONAR_HOST_URL \
        --sonar-token $SONAR_TOKEN \
        --sonar-project-key $SONAR_PROJECT_KEY \
        --output-name sonar-report.sarif \
        export --path /builds/$REPO_NAMESPACE/$REPO/
      dagger call analyze-with-gitguardian \
        --gitguardian-api-key env:GITGUARDIAN_API_KEY \
        --source-directory $CONTEXT \
        --output-name gitguardian-report.sarif \
        export --path /builds/$REPO_NAMESPACE/$REPO/
      dagger call synthetic-report \
        --sonar-sarif /builds/$REPO_NAMESPACE/$REPO/sonar-report.sarif \
        --gg-sarif /builds/$REPO_NAMESPACE/$REPO/gitguardian-report.sarif \
        --sbom-file /builds/$REPO_NAMESPACE/$REPO/sbom-report.cdx.json \
        --severity-threshold HIGH \
        export --path /builds/$REPO_NAMESPACE/$REPO
      fi
  artifacts:
    when: always
    expire_in: 4 weeks
    paths:
      - vulnerabilities.html
      - sbom-report.html
      - sonar-report.html
      - synthetic-report.html
push_image:
  extends: [.dagger]
  tags: [dagger]
  stage: deploy
  needs:
    - job: build_image
      optional: true
    - job: scan_image
      optional: true
  script:
    - cd $REPO
    - |
      if git diff --name-only HEAD~1 | grep -Eq '^('$CONTEXT'/)'; then
        dagger call push \
          --bucket $BUCKET \
          --endpoint https://$MINIO \
          --access env:S3_ACCESS_KEY \
          --secret env:S3_SECRET_KEY \
          --registry $REGISTRY \
          --namespace $REPO_NAMESPACE \
          --repo $REPO \
          --srctag $TAG \
          --dsttag $TAG \
          --username $CI_REPO_USERNAME \
          --password env:CI_REPO_PASSWORD \
          --wkd $CONTEXT
      fi
update_helm:
  extends: [.dagger]
  tags: [dagger]
  stage: .post
  needs: [push_image]
  artifacts:
    untracked: true
  script:
    - cd $REPO
    - |
      if git diff --name-only HEAD~1 | grep -Eq '^('$CONTEXT'/)'; then
        sed -i 's/\(  service_image_tag: "\)\(.*\)/\1'"$TAG"'"/g' cookiecutter-config.yaml
        git config user.email "federico.fornari@ecmwf.int"
        git config user.name "Cookiecutter"
        git add --all
        git commit -m "Updated image tag by Cookiecutter" || true
        git push -o ci.skip
      fi
    - dagger call update
      --gitlab $GITLAB
      --repo $REPO
      --branch $COOKIECUTTER_BRANCH
      --username $CI_COOKIECUTTER_USERNAME
      --password env:CI_COOKIECUTTER_PASSWORD
      --wkd .
      export
      --path
      /builds/$REPO_NAMESPACE/$REPO/$SERVICE-helm
sync_helm:
  extends: [.dagger]
  tags: [dagger]
  stage: .post
  needs: [update_helm]
  dependencies: [update_helm]
  artifacts:
    untracked: true
  script:
    - rm -rf $HELM/$SERVICE-$REPO
    - cp -r /builds/$REPO_NAMESPACE/$REPO/$SERVICE-helm $HELM/$SERVICE-$REPO
    - cd $HELM
    - git config user.email "federico.fornari@ecmwf.int"
    - git config user.name "Cookiecutter"
    - git add --all
    - git commit -m "Updated helm chart by Cookiecutter" || true
    - git push
clean_registry:
  extends: [.dagger]
  tags: [dagger]
  stage: .post
  script:
    - cd $REPO
    - |
      if git diff --name-only HEAD~1 | grep -Eq '^('$CONTEXT'/)'; then
        dagger call clean \
        --bucket $BUCKET \
        --endpoint https://$MINIO \
        --access env:S3_ACCESS_KEY \
        --secret env:S3_SECRET_KEY
      fi