.gitlab-ci.yml

image: docker.slock.it/build-images/node:10-alpine

stages:
  - build
  - package
  - analysis
  - deploy
  - mirror

# Job templates
ui-build: 
  stage: build
  tags:
    - short-jobs
  script:
    - sh /prepare.sh
    - npm install
    - CI="" npm run build
  artifacts:
    name: build-ui
    paths:
      - build/

docker-package:
  stage: package
  tags:
    - short-jobs
  image: docker
  only:
    - master
    - develop
    - tags
  services:
    - docker:dind
  script:
    - docker login -u gitlab-ci-token -p $CI_JOB_TOKEN $CI_REGISTRY
    - docker build -t $CI_REGISTRY_IMAGE:$CI_COMMIT_REF_NAME .
    - docker push $CI_REGISTRY_IMAGE:$CI_COMMIT_REF_NAME

vulnerabilities:
  stage: analysis
  tags:
    - short-jobs
  dependencies:
    - docker-package
  allow_failure: true
  image: docker.slock.it/build-images/vulnerability-testing-tools
  script:
    - export TRIVY_AUTH_URL=$CI_REGISTRY
    - export TRIVY_USERNAME=gitlab-ci-token
    - export TRIVY_PASSWORD=$CI_JOB_TOKEN
    - trivy -f json -o vulnerability_analysis.json --exit-code 1 $CI_REGISTRY_IMAGE:$CI_COMMIT_REF_NAME
  artifacts:
    paths:
      - vulnerability_analysis.json

.deploy-tmpl:
  stage: deploy
  except:
    - branches
  tags:
    - deployment
  image: docker.slock.it/build-images/deployment
  services:
    - docker:dind
  script:
    - rancher -w up -d --prune -p -s piet-${TARGET} -c --force-upgrade
    - sentry-cli releases new -p piet piet@${CI_COMMIT_REF_NAME}
    - sentry-cli releases deploys piet@${CI_COMMIT_REF_NAME} new -e ${TARGET}
    - sentry-cli releases set-commits --auto piet@${CI_COMMIT_REF_NAME}

deploy-to-stage:
    extends: .deploy-tmpl
    dependencies:
      - docker-package
    only:
      - /^v[0-9]+.[0-9]+.[0-9]+-(alpha|beta|rc)\.[0-9]+$/
    variables:
      TARGET: stage

deploy-to-production:
    extends: .deploy-tmpl
    dependencies:
      - docker-package
    only:
      - /^v[0-9]+.[0-9]+.[0-9]+$/
    variables:
      TARGET: production

mirror-to-github:
    stage: mirror
    when: manual
    tags:
      - short-jobs
    only: 
      - master
      - /^v[0-9]+.[0-9]+.[0-9]+$/
    script:
      - echo -e "$GITHUB_PUSH_KEY" > /gitkey
      - chmod 0400 /gitkey
      - export GIT_SSH_COMMAND="/usr/bin/ssh -o StrictHostKeyChecking=no -i /gitkey"
      - git branch -D ext-master || true
      - git checkout -b ext-master
      - git remote rm external || true
      - git remote add external git@github.com:slockit/piet.git
      - git status
      - git push -u --force external ext-master:master
      - git push --force external --tags