.gitlab-ci.yml

image: ${CI_DEPENDENCY_PROXY_DIRECT_GROUP_IMAGE_PREFIX}/docker:git

variables:
  RASPIOS_VERSION: '2023-05-03'
  DOCKER_REPOSITORY: 'mendersoftware/mender-test-containers'
  DOCKER_HUB_USERNAME: 'menderbuildsystem'
  DOCKER_BUILDKIT: 1

.mender-dist-packages-image-matrix:
  parallel:
    matrix:
      - BUILD: simulated
        DISTRO: raspberrypios
        RELEASE: [bullseye, bookworm]
        ARCH: [armhf]
      - BUILD: crosscompile
        DISTRO: debian
        RELEASE: [bullseye, bookworm]
        ARCH: [amd64, armhf, arm64]
      - BUILD: crosscompile
        DISTRO: ubuntu
        RELEASE: [focal, jammy, noble]
        ARCH: [amd64, armhf, arm64]

.tag_n_push_to_gitlab_registry: &tag_n_push_to_gitlab_registry
  - docker pull ${CI_REGISTRY_IMAGE}:${CONTAINER_TAG}-${CI_PIPELINE_ID}
  - docker tag ${CI_REGISTRY_IMAGE}:${CONTAINER_TAG}-${CI_PIPELINE_ID} ${CI_REGISTRY_IMAGE}:${CONTAINER_TAG}-${CI_COMMIT_BRANCH}
  - docker push ${CI_REGISTRY_IMAGE}:${CONTAINER_TAG}-${CI_COMMIT_BRANCH}

include:
  - project: 'Northern.tech/Mender/mendertesting'
    file: '.gitlab-ci-check-commits-signoffs.yml'
  - project: 'Northern.tech/Mender/mendertesting'
    file: '.gitlab-ci-github-status-updates.yml'
  - project: 'Northern.tech/Mender/mendertesting'
    file: '.gitlab-ci-check-python3-format.yml'

.dind-login: &dind-login
  - mkdir -p $HOME/.docker && echo $DOCKER_AUTH_CONFIG > $HOME/.docker/config.json

stages:
  - build
  - test
  - publish

build:prepare:raspios:
  tags:
    - mender-qa-worker-generic-light
  stage: build
  needs: []
  image: ${CI_DEPENDENCY_PROXY_DIRECT_GROUP_IMAGE_PREFIX}/buildpack-deps:scm
  script:
    - cd docker/docker-files-raspbian
    - apt-get update && apt-get install -yyq sudo unzip xz-utils fdisk
    - ./prepare-raspbian-img.sh ${RASPIOS_VERSION}
    - cd .. && tar -cvf $CI_PROJECT_DIR/docker-files-raspbian.tar docker-files-raspbian
  artifacts:
    expire_in: 2w
    paths:
      - docker-files-raspbian.tar

build:raspios:
  tags:
    - hetzner-amd-beefy
  stage: build
  needs:
    - job: build:prepare:raspios
      artifacts: true
  services:
    - name: ${CI_DEPENDENCY_PROXY_DIRECT_GROUP_IMAGE_PREFIX}/docker:dind
      alias: docker
  variables:
    CONTAINER_TAG: "raspios-bullseye"
  before_script:
    - *dind-login
  script:
    - echo "INFO - Building and Pushing ${CONTAINER_TAG}-${CI_PIPELINE_ID} to the registry ${CI_REGISTRY_IMAGE}"
    - echo $CI_REGISTRY_PASSWORD | docker login -u $CI_REGISTRY_USER $CI_REGISTRY --password-stdin
    - tar -xvf docker-files-raspbian.tar
    - docker build
        --cache-from ${CI_REGISTRY_IMAGE}:${CONTAINER_TAG}-master
        -t ${CI_REGISTRY_IMAGE}:${CONTAINER_TAG}-${CI_PIPELINE_ID}
        --build-arg raspios_version=${RASPIOS_VERSION}
        --push
        docker-files-raspbian
    # Upload to artifact storage left for backwards compatibility
    - docker save ${CI_REGISTRY_IMAGE}:${CONTAINER_TAG}-${CI_PIPELINE_ID} > raspbianImage.tar
  artifacts:
    expire_in: 2w
    paths:
      - raspbianImage.tar

build:gui-e2e-testing:
  tags:
    - hetzner-amd-beefy
  stage: build
  needs: []
  variables:
    CONTAINER_TAG: "gui-e2e-testing"
  services:
    - name: ${CI_DEPENDENCY_PROXY_DIRECT_GROUP_IMAGE_PREFIX}/docker:dind
      alias: docker
  before_script:
    - apk add --no-cache aws-cli curl
    - eval "$(curl https://raw.githubusercontent.com/mendersoftware/mendertesting/master/mender-ci-common.sh)"
    - *dind-login
  script:
    - echo "INFO - Building and Pushing ${CONTAINER_TAG} to the registry ${CI_REGISTRY_IMAGE}"
    - echo $CI_REGISTRY_PASSWORD | docker login -u $CI_REGISTRY_USER $CI_REGISTRY --password-stdin
    - docker build
        --cache-from ${CI_REGISTRY_IMAGE}:${CONTAINER_TAG}-master
        -t ${CI_REGISTRY_IMAGE}:${CONTAINER_TAG}-${CI_PIPELINE_ID}
        -f gui-e2e-testing/Dockerfile
        --push
        gui-e2e-testing
    - docker save ${CI_REGISTRY_IMAGE}:${CONTAINER_TAG}-${CI_PIPELINE_ID} > guiE2eTestingImage.tar
    # Upload to temporary S3 bucket left for backwards compatibility
    - mender_ci_save_tmp_artifact guiE2eTestingImage.tar
  artifacts:
    paths:
      - checksums

build:mender-client-acceptance-testing:
  tags:
    # KVM support requires the same type of GCP machine as the tests will use
    - mender-qa-worker-client-acceptance-tests
  stage: build
  needs: []
  variables:
    CONTAINER_TAG: "mender-client-acceptance-testing"
  services:
    - name: ${CI_DEPENDENCY_PROXY_DIRECT_GROUP_IMAGE_PREFIX}/docker:dind
      alias: docker
  before_script:
    - apk add --no-cache aws-cli curl
    - eval "$(curl https://raw.githubusercontent.com/mendersoftware/mendertesting/master/mender-ci-common.sh)"
  script:
    - echo "INFO - Building and Pushing ${CONTAINER_TAG} to the registry ${CI_REGISTRY_IMAGE}"
    - echo $CI_REGISTRY_PASSWORD | docker login -u $CI_REGISTRY_USER $CI_REGISTRY --password-stdin
    - docker build
        --cache-from ${CI_REGISTRY_IMAGE}:${CONTAINER_TAG}-master
        -t ${CI_REGISTRY_IMAGE}:${CONTAINER_TAG}-${CI_PIPELINE_ID}
        -f mender-client-acceptance-testing/Dockerfile
        --push
        mender-client-acceptance-testing
    - docker save ${CI_REGISTRY_IMAGE}:${CONTAINER_TAG}-${CI_PIPELINE_ID} > qaTestingImage.tar
    # Upload to temporary S3 bucket
    - mender_ci_save_tmp_artifact qaTestingImage.tar
  artifacts:
    paths:
      - checksums

build:aws-k8s-pipeline-toolbox:
  tags:
    - hetzner-amd-beefy
  stage: build
  image: ${CI_DEPENDENCY_PROXY_DIRECT_GROUP_IMAGE_PREFIX}/docker
  needs: []
  variables:
    CONTAINER_TAG: "aws-k8s-v1"
    CI_KUBECTL_VERSION: "1.24.0"
    CI_HELM_VERSION: "v3.12.0"
    CI_KUBECONFORM_VERSION: "0.6.3"
  services:
    - name: ${CI_DEPENDENCY_PROXY_DIRECT_GROUP_IMAGE_PREFIX}/docker:dind
      alias: docker
  before_script:
    - *dind-login
  script:
    - echo "INFO - Building and Pushing ${CONTAINER_TAG}-${CI_PIPELINE_ID} to the registry ${CI_REGISTRY_IMAGE}"
    - echo $CI_REGISTRY_PASSWORD | docker login -u $CI_REGISTRY_USER $CI_REGISTRY --password-stdin
    - docker build
        --cache-from ${CI_REGISTRY_IMAGE}:${CONTAINER_TAG}-master
        -t ${CI_REGISTRY_IMAGE}:${CONTAINER_TAG}-${CI_PIPELINE_ID}
        --build-arg KUBECTL_VERSION=${CI_KUBECTL_VERSION}
        --build-arg HELM_VERSION=${CI_HELM_VERSION}
        --build-arg KUBECONFORM_VERSION=${CI_KUBECONFORM_VERSION}
        -f aws-k8s-toolbox/Dockerfile
        --push
        aws-k8s-toolbox

.build:mender-dist-packages-image:
  tags:
    - hetzner-amd-beefy-privileged
  stage: build
  needs: []
  image: ${CI_DEPENDENCY_PROXY_DIRECT_GROUP_IMAGE_PREFIX}/docker:git
  services:
    - name: ${CI_DEPENDENCY_PROXY_DIRECT_GROUP_IMAGE_PREFIX}/docker:dind
      alias: docker
  before_script:
    - *dind-login
  script:
    - apk add bash
    - CONTAINER_TAG=mender-dist-packages-builder-${BUILD}-${DISTRO}-${RELEASE}-${ARCH}
    - echo "INFO - Building and Pushing ${CONTAINER_TAG}-${CI_PIPELINE_ID} to the registry ${CI_REGISTRY_IMAGE}"
    - echo $CI_REGISTRY_PASSWORD | docker login -u $CI_REGISTRY_USER $CI_REGISTRY --password-stdin
    - cd mender-dist-packages-building
    - ./build.sh
         --container-tag ${CI_REGISTRY_IMAGE}:${CONTAINER_TAG}
         --distro ${DISTRO}
         --release ${RELEASE}
         --arch ${ARCH}
         --ci-pipeline-id ${CI_PIPELINE_ID}
  parallel: !reference [.mender-dist-packages-image-matrix, parallel]

build:mender-dist-packages-image:
  rules:
    - if: $CI_COMMIT_BRANCH == "master"
  extends: .build:mender-dist-packages-image

build:mender-dist-packages-image:manual:
  when: manual
  extends: .build:mender-dist-packages-image

build:docker-multiplatform-buildx:
  tags:
    - hetzner-amd-beefy
  stage: build
  image: ${CI_DEPENDENCY_PROXY_DIRECT_GROUP_IMAGE_PREFIX}/docker
  needs: []
  variables:
    CONTAINER_TAG: "docker-multiplatform-buildx-v1"
  services:
    - name: ${CI_DEPENDENCY_PROXY_DIRECT_GROUP_IMAGE_PREFIX}/docker:dind
      alias: docker
  before_script:
    - *dind-login
  script:
    - echo "INFO - Building and Pushing ${CONTAINER_TAG}-${CI_PIPELINE_ID} to the registry ${CI_REGISTRY_IMAGE}"
    - echo $CI_REGISTRY_PASSWORD | docker login -u $CI_REGISTRY_USER $CI_REGISTRY --password-stdin
    - docker build
        --cache-from ${CI_REGISTRY_IMAGE}:${CONTAINER_TAG}-master
        -t ${CI_REGISTRY_IMAGE}:${CONTAINER_TAG}-${CI_PIPELINE_ID}
        -f docker-multiplatform-buildx/Dockerfile
        --push
        docker-multiplatform-buildx

build:goveralls:
  tags:
    - hetzner-amd-beefy
  stage: build
  image: ${CI_DEPENDENCY_PROXY_DIRECT_GROUP_IMAGE_PREFIX}/docker
  needs: []
  variables:
    CONTAINER_TAG: "goveralls"
  services:
    - name: ${CI_DEPENDENCY_PROXY_DIRECT_GROUP_IMAGE_PREFIX}/docker:dind
      alias: docker
  before_script:
    - *dind-login
  script:
    - echo "INFO - Building and Pushing ${CONTAINER_TAG}-${CI_PIPELINE_ID} to the registry ${CI_REGISTRY_IMAGE}"
    - echo $CI_REGISTRY_PASSWORD | docker login -u $CI_REGISTRY_USER $CI_REGISTRY --password-stdin
    - docker build
        --cache-from ${CI_REGISTRY_IMAGE}:${CONTAINER_TAG}-master
        -t ${CI_REGISTRY_IMAGE}:${CONTAINER_TAG}-${CI_PIPELINE_ID}
        -f goveralls/Dockerfile
        --push
        goveralls

build:mongodb-backup-runner:
  tags:
    - hetzner-amd-beefy
  stage: build
  image: ${CI_DEPENDENCY_PROXY_DIRECT_GROUP_IMAGE_PREFIX}/docker
  needs: []
  variables:
    CONTAINER_TAG: "mongodb-backup-runner"
  services:
    - name: ${CI_DEPENDENCY_PROXY_DIRECT_GROUP_IMAGE_PREFIX}/docker:dind
      alias: docker
  before_script:
    - *dind-login
  script:
    - echo "INFO - Building and Pushing ${CONTAINER_TAG}-${CI_PIPELINE_ID} to the registry ${CI_REGISTRY_IMAGE}"
    - echo $CI_REGISTRY_PASSWORD | docker login -u $CI_REGISTRY_USER $CI_REGISTRY --password-stdin
    - docker build
        --cache-from ${CI_REGISTRY_IMAGE}:${CONTAINER_TAG}-master
        -t ${CI_REGISTRY_IMAGE}:${CONTAINER_TAG}-${CI_PIPELINE_ID}
        -f mongodb-backup-runner/Dockerfile
        --push
        mongodb-backup-runner

build:terragrunt-trivy-toolbox:
  tags:
    - hetzner-amd-beefy
  stage: build
  image: ${CI_DEPENDENCY_PROXY_DIRECT_GROUP_IMAGE_PREFIX}/docker
  needs: []
  variables:
    CONTAINER_TAG: "terragrunt-trivy-v1"
  services:
    - name: ${CI_DEPENDENCY_PROXY_DIRECT_GROUP_IMAGE_PREFIX}/docker:dind
      alias: docker
  before_script:
    - *dind-login
  script:
    - echo "INFO - Building and Pushing ${CONTAINER_TAG}-${CI_PIPELINE_ID} to the registry ${CI_REGISTRY_IMAGE}"
    - echo $CI_REGISTRY_PASSWORD | docker login -u $CI_REGISTRY_USER $CI_REGISTRY --password-stdin
    - docker build
        --cache-from ${CI_REGISTRY_IMAGE}:${CONTAINER_TAG}-master
        -t ${CI_REGISTRY_IMAGE}:${CONTAINER_TAG}-${CI_PIPELINE_ID}
        -f terragrunt-trivy-toolbox/Dockerfile
        --push
        terragrunt-trivy-toolbox

build:release-please:
  tags:
    - hetzner-amd-beefy
  stage: build
  image: ${CI_DEPENDENCY_PROXY_DIRECT_GROUP_IMAGE_PREFIX}/docker
  needs: []
  variables:
    CONTAINER_TAG: "release-please-v1"
  services:
    - name: ${CI_DEPENDENCY_PROXY_DIRECT_GROUP_IMAGE_PREFIX}/docker:dind
      alias: docker
  before_script:
    - *dind-login
    - echo $CI_REGISTRY_PASSWORD | docker login -u $CI_REGISTRY_USER $CI_REGISTRY --password-stdin
    - docker context create builder
    - docker buildx create builder --use --driver-opt network=host --buildkitd-flags '--debug --allow-insecure-entitlement network.host'
  script:
    - echo "INFO - Building and Pushing ${CONTAINER_TAG}-${CI_PIPELINE_ID} to the registry ${CI_REGISTRY_IMAGE}"
    - apk add --no-cache git
    - cd release-please
    - docker buildx build
        --cache-to type=registry,ref=${CI_REGISTRY_IMAGE}:${CONTAINER_TAG}_ci_cache,mode=max
        --cache-from type=registry,ref=${CI_REGISTRY_IMAGE}:${CONTAINER_TAG}_ci_cache
        --tag ${CI_REGISTRY_IMAGE}:${CONTAINER_TAG}-${CI_PIPELINE_ID}
        --file ${DOCKER_DIR:-.}/${DOCKERFILE:-Dockerfile}
        --provenance false
        --push
        ${DOCKER_DIR:-.}


.template:publish:
  tags:
    - hetzner-amd-beefy
  stage: publish
  services:
    - name: ${CI_DEPENDENCY_PROXY_DIRECT_GROUP_IMAGE_PREFIX}/docker:dind
      alias: docker
  rules:
    - if: $CI_COMMIT_BRANCH == "master"
  before_script:
    - echo -n $DOCKER_HUB_PASSWORD | docker login -u $DOCKER_HUB_USERNAME --password-stdin
    - echo $CI_REGISTRY_PASSWORD | docker login -u $CI_REGISTRY_USER $CI_REGISTRY --password-stdin

publish:raspios-bullseye:
  extends: .template:publish
  needs:
    - job: build:raspios
      artifacts: true
  variables:
    CONTAINER_TAG: "raspios-bullseye"
  script:
    # backward compatibility: pushing to the Docker Hub
    - echo "publishing image to Docker Hub"
    - docker load -i raspbianImage.tar
    - docker tag ${CI_REGISTRY_IMAGE}:${CONTAINER_TAG}-${CI_PIPELINE_ID} $DOCKER_REPOSITORY:$CONTAINER_TAG
    - docker push $DOCKER_REPOSITORY:$CONTAINER_TAG
    # Gitlab registry
    - *tag_n_push_to_gitlab_registry

publish:gui-e2e-testing:
  extends: .template:publish
  needs:
    - job: build:gui-e2e-testing
      artifacts: true
  variables:
    CONTAINER_TAG: "gui-e2e-testing"
  script:
    # backward compatibility: pushing to the Docker Hub
    - apk add --no-cache aws-cli curl
    - eval "$(curl https://raw.githubusercontent.com/mendersoftware/mendertesting/master/mender-ci-common.sh)"
    # Fetch from temporary S3 bucket
    - mender_ci_load_tmp_artifact guiE2eTestingImage.tar
    - echo "publishing image to Docker Hub"
    - docker load -i guiE2eTestingImage.tar
    - docker tag ${CI_REGISTRY_IMAGE}:${CONTAINER_TAG}-${CI_PIPELINE_ID} $DOCKER_REPOSITORY:$CONTAINER_TAG
    - docker push $DOCKER_REPOSITORY:$CONTAINER_TAG
    # Gitlab registry
    - *tag_n_push_to_gitlab_registry

publish:mender-client-acceptance-testing:
  extends: .template:publish
  needs:
    - job: build:mender-client-acceptance-testing
      artifacts: true
  variables:
    CONTAINER_TAG: "mender-client-acceptance-testing"
  script:
    # backward compatibility: pushing to the Docker Hub
    - apk add --no-cache aws-cli curl
    - eval "$(curl https://raw.githubusercontent.com/mendersoftware/mendertesting/master/mender-ci-common.sh)"
    # Fetch from temporary S3 bucket
    - mender_ci_load_tmp_artifact qaTestingImage.tar
    - echo "publishing image to Docker Hub"
    - docker load -i qaTestingImage.tar
    - docker tag ${CI_REGISTRY_IMAGE}:${CONTAINER_TAG}-${CI_PIPELINE_ID} $DOCKER_REPOSITORY:$CONTAINER_TAG
    - docker push $DOCKER_REPOSITORY:$CONTAINER_TAG
    # Gitlab registry
    - *tag_n_push_to_gitlab_registry

publish:aws-k8s-pipeline-toolbox:
  extends: .template:publish
  needs:
    - job: build:aws-k8s-pipeline-toolbox
      artifacts: true
  variables:
    CONTAINER_TAG: "aws-k8s-v1"
  script:
    - *tag_n_push_to_gitlab_registry

publish:docker-multiplatform-buildx:
  extends: .template:publish
  needs:
    - job: build:docker-multiplatform-buildx
      artifacts: true
  variables:
    CONTAINER_TAG: "docker-multiplatform-buildx-v1"
  script:
    - *tag_n_push_to_gitlab_registry

publish:mender-dist-packages-image:
  extends: .template:publish
  dependencies:
    # NOTE: We should depend on each of the jobs individually with:
    # - "build:mender-dist-packages-image: [${BUILD}, ${DISTRO}, ${RELEASE}, ${ARCH}]"
    # However GitLab does not seem to expand these variables on a dependencies
    # key. Use arbitrary one of them and assume that they all passed (using
    # depends instead of needs ensures that the whole previous build stage
    # needs to pass, so it should be safe).
    - "build:mender-dist-packages-image: [crosscompile, debian, bullseye, amd64]"
  rules:
    - if: $CI_COMMIT_BRANCH == "master"
  script:
    - CONTAINER_TAG=mender-dist-packages-builder-${BUILD}-${DISTRO}-${RELEASE}-${ARCH}
    - *tag_n_push_to_gitlab_registry
  parallel: !reference [.mender-dist-packages-image-matrix, parallel]

publish:goveralls:
  extends: .template:publish
  needs:
    - job: build:goveralls
      artifacts: true
  variables:
    CONTAINER_TAG: "goveralls"
  script:
    - *tag_n_push_to_gitlab_registry

publish:mongodb-backup-runner:
  extends: .template:publish
  needs:
    - job: build:mongodb-backup-runner
      artifacts: true
  variables:
    CONTAINER_TAG: "mongodb-backup-runner"
  script:
    - *tag_n_push_to_gitlab_registry

publish:terragrunt-trivy-toolbox:
  extends: .template:publish
  needs:
    - job: build:aws-k8s-pipeline-toolbox
      artifacts: true
  variables:
    CONTAINER_TAG: "terragrunt-trivy-v1"
  script:
    - *tag_n_push_to_gitlab_registry

publish:release-please:
  extends: .template:publish
  needs:
    - job: build:release-please
      artifacts: true
  variables:
    CONTAINER_TAG: "release-please-v1"
  script:
    - *tag_n_push_to_gitlab_registry