.gitlab-ci.yml

workflow:
  rules:
    - if: $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH

include:
  - file: /Scan/trivy.yml
    project: jitesoft/gitlab-ci-lib
  - file: /OCI/push-readme.yml
    project: jitesoft/gitlab-ci-lib

stages:
  - readme
  - pre
  - download
  - build
  - containerize
  - scan
  - notify

update-readme:
  stage: readme
  extends: .readme-check.v2
  parallel:
    matrix:
      - { REGISTRIES: "quay.io/jitesoft/node-base,docker.io/jitesoft/node-base", PUSHRM_FILE: "$CI_PROJECT_DIR/README.md" }
      - { REGISTRIES: "quay.io/jitesoft/node,docker.io/jitesoft/node", PUSHRM_FILE: "$CI_PROJECT_DIR/README-2.md" }
  variables:
    GIT_DEPTH: "3"
  tags: [ protected ]

check:
  parallel:
    matrix:
      - { VERSION: "18", TYPE: "hydrogen", EXTRA: "security-lts" }
      - { VERSION: "20", TYPE: "iron", EXTRA: "maintenance-lts" }
      - { VERSION: "22", TYPE: "jod", EXTRA: "lts" }
      - { VERSION: "23", TYPE: "latest", EXTRA: "current" }
  stage: pre
  variables:
    GIT_STRATEGY: none
  image: registry.gitlab.com/jitesoft/dockerfiles/misc:latest
  rules:
    - if: '$CI_PIPELINE_SOURCE == "schedule"'
      when: always
    - if: '$CI_PIPELINE_SOURCE == "web"'
      when: always
    - when: never
  script:
    - FULL_VERSION=$(wget -qO- https://nodejs.org/dist/latest-v${VERSION}.x/ | grep -oP "(?<=>node-v)(([0-9]{0,3}(\.?)){3})" | awk 'NR==1{print $1}')
    - NPM_VERSION=$(wget -qO- https://api.github.com/repos/npm/cli/releases | jq -r ".[0].tag_name" | awk 'NR==1{print $1}')
    - touch npm-version.txt
    - touch ${VERSION}.txt
    - |
      if [ ! -z "${FORCE_BUILD+x}" ] || [ "${FULL_VERSION}" != "$(cat ${VERSION}.txt)" ] || [ "${NPM_VERSION}" != "$(cat npm-version.txt)" ]; then
        echo "Full version ${FULL_VERSION} is not same as current. Will build."
        curl -F token=${CI_JOB_TOKEN} -F ref=master -F "variables[VERSION]=${VERSION}" -F "variables[EXTRA]=${EXTRA}" -F "variables[FULL_VERSION]=${FULL_VERSION}" -F "variables[TYPE]=${TYPE}" -F "variables[BUILD]=true" https://gitlab.com/api/v4/projects/${CI_PROJECT_ID}/trigger/pipeline
      else
        echo "Only scan ${FULL_VERSION}."
        curl -F token=${CI_JOB_TOKEN} -F ref=master -F "variables[FULL_VERSION]=${FULL_VERSION}" -F "variables[SCAN]=true" https://gitlab.com/api/v4/projects/${CI_PROJECT_ID}/trigger/pipeline
      fi
  cache:
    policy: pull
    key: nodejs-major-${VERSION}
    paths:
      - ${VERSION}.txt
      - npm-version.txt

download:pgp:
  rules:
    - if: "$BUILD"
      when: always
    - when: never
  stage: pre
  image: registry.gitlab.com/jitesoft/dockerfiles/misc:latest
  script:
    - "[ -f checksum.txt ] || touch checksum.txt"
    - SHA=$(sha256sum keys.out)
    - |
      if [ "$(cat checksum.txt)" != "${SHA}" ]; then
        for key in `cat gpgkeys.txt`; do
          gpg --list-keys ${key} || (gpg --keyserver hkps://keys.openpgp.org --recv-keys "$key" || gpg --keyserver keyserver.ubuntu.com --recv-keys "$key" || gpg --keyserver pgp.mit.edu --recv-keys "$key" || gpg --keyserver keyserver.pgp.com --recv-keys "$key" || gpg --keyserver ha.pool.sks-keyservers.net --recv-keys "$key")
        done
        gpg --export > keys.out
      fi
    - SHA=$(sha256sum keys.out)
    - echo $SHA > checksum.txt
  cache:
    key: nodejs.gpg.keyring
    paths:
      - checksum.txt
      - keys.out
    when: on_success
  artifacts:
    when: on_success
    paths:
      - keys.out
    expire_in: 1 day

download:tars:
  stage: download
  rules:
    - if: "$BUILD"
      when: on_success
    - when: never
  needs:
    - job: download:pgp
      artifacts: true
  variables:
    GIT_STRATEGY: none
  image: registry.gitlab.com/jitesoft/dockerfiles/misc:latest
  script:
    - gpg --import keys.out
    - curl -OsS https://nodejs.org/dist/v${FULL_VERSION}/node-v${FULL_VERSION}.tar.xz
    - curl -OsS https://nodejs.org/dist/v${FULL_VERSION}/SHASUMS256.txt
    - curl -OsS https://nodejs.org/dist/v${FULL_VERSION}/SHASUMS256.txt.sig
    - gpg --verify SHASUMS256.txt.sig SHASUMS256.txt
    - grep " node-v${FULL_VERSION}.tar.xz\$" SHASUMS256.txt | sha256sum -c -
    - mv node-v${FULL_VERSION}.tar.xz node-v${VERSION}.tar.xz
  artifacts:
    paths:
      - node-v${VERSION}.tar.xz
    expire_in: 1 day

.build:binary:
  stage: build
  rules:
    - if: "$BUILD"
      when: on_success
    - when: never
  image: registry.gitlab.com/jitesoft/dockerfiles/misc/buildbase/3.20:latest
  needs:
    - job: download:tars
      artifacts: true
  before_script:
    - apk add --no-cache binutils-gold git python3 libstdc++ zlib-dev openssl-dev
    - if [ ! -d "ccache" ]; then mkdir ccache; fi
    - export PATH="/usr/lib/ccache/bin:$PATH"
    - export CCACHE_DIR="${CI_PROJECT_DIR}/ccache"
    - ccache -s
  script:
    - mkdir result src
    - tar -Jxf node-v${VERSION}.tar.xz -C src --strip-components=1
    - cd src
    - ./configure
    # Only print every 100th line, build.log is added to out directory, err is piped to stdout.
    - make -j4 binary V= DESTCPU="${BUILD_ARCH}" ARCH="${BUILD_ARCH}" VARIATION="musl" RELEASE_URLBASE="https://gitlab.com/jitesoft/dockerfiles/node-base" | tee ../result/build.log | awk 'NR%100==0 {print NR,$0}'
    - cd ..
    - ccache -s
    - mkdir binaries
    - mv src/node-v${FULL_VERSION}-linux-${BUILD_ARCH}-musl.tar.xz binaries/node-${ARCH}.tar.xz
  cache:
    paths:
      - ccache/
    key: ccache-${VERSION}-${ARCH}
  artifacts:
    when: on_success
    paths:
      - binaries/
    expire_in: 1 day

build:arm:
  timeout: 10 hours
  extends: .build:binary
  variables:
    ARCH: arm64
    BUILD_ARCH: arm64
  tags:
    - "native-aarch64"

build:amd:
  extends: .build:binary
  variables:
    ARCH: amd64
    BUILD_ARCH: x86_64
  tags:
    - "native-amd64"

containerize:slim:
  image: registry.gitlab.com/jitesoft/dockerfiles/misc:latest
  stage: containerize
  rules:
    - if: "$BUILD"
      when: on_success
    - when: never
  needs:
    - job: build:amd
      artifacts: true
    - job: build:arm
      artifacts: true
  script:
    - TAGS=$(helper "${CI_REGISTRY_IMAGE},jitesoft/node-base,ghcr.io/jitesoft/node-base,quay.io/jitesoft/node-base" "${VERSION},${FULL_VERSION},${TYPE},${EXTRA}")
    - docker buildx build --sbom=true --provenance=true --platform linux/amd64,linux/arm64 --push ${TAGS} --build-arg BUILD_TIME="$(date -Iseconds)" --build-arg NODE_VERSION=${VERSION} --progress plain -f slim/Dockerfile .
  tags:
    - protected
    - buildx

containerize:full:
  image: registry.gitlab.com/jitesoft/dockerfiles/misc:latest
  stage: containerize
  rules:
    - if: "$BUILD"
      when: on_success
    - when: never
  needs:
    - job: build:amd
      artifacts: true
    - job: build:arm
      artifacts: true
  script:
    - TAGS=$(helper "${CI_REGISTRY_IMAGE}/full,jitesoft/node,ghcr.io/jitesoft/node,quay.io/jitesoft/node,quay.io/jitesoft/node" "${VERSION},${FULL_VERSION},${TYPE},${EXTRA}")
    - docker buildx build --sbom=true --provenance=true --platform linux/amd64,linux/arm64 --push ${TAGS} --build-arg BUILD_TIME="$(date -Iseconds)" --build-arg NODE_VERSION=${VERSION} --progress plain -f full/Dockerfile .
  tags:
    - protected
    - buildx

notify:node-yarn:
  stage: .post
  image: registry.gitlab.com/jitesoft/dockerfiles/misc:latest
  rules:
    - if: "$BUILD"
      when: on_success
  script:
    - echo "Notifying Yarn job."
    - curl -F token=${NOTIFY_TOKEN} -F ref=master  -F "variables[NODE_MAJOR]=${VERSION}" -F "variables[FULL_VERSION]=${FULL_VERSION}" -F "variables[RELEASE_NAME]=${TYPE}" https://gitlab.com/api/v4/projects/4048627/trigger/pipeline

create:cache:
  stage: .post
  image: registry.gitlab.com/jitesoft/dockerfiles/alpine:latest
  rules:
    - if: "$BUILD"
      when: on_success
  script:
    - apk add --no-cache jq
    - echo "${FULL_VERSION}" > ${VERSION}.txt
    - wget -qO- https://api.github.com/repos/npm/cli/releases | jq -r ".[0].tag_name" | awk 'NR==1{print $1}' > npm-version.txt
  cache:
    policy: push
    key: nodejs-major-${VERSION}
    paths:
      - ${VERSION}.txt
      - npm-version.txt

notify:trivy:
  stage: .post
  image: registry.gitlab.com/jitesoft/dockerfiles/misc:latest
  rules:
    - if: "$BUILD"
      when: on_success
  script:
    - echo "Notifying scanner."
    - curl -F token=${CI_JOB_TOKEN} -F ref=master -F "variables[FULL_VERSION]=${FULL_VERSION}" -F "variables[SCAN]=true" https://gitlab.com/api/v4/projects/${CI_PROJECT_ID}/trigger/pipeline

scan:
  parallel:
    matrix:
      - { TYPE: "slim", SCAN_SUFFIX: "node-base" }
      - { TYPE: "full", SCAN_SUFFIX: "node-base/full" }
  rules:
    - if: "$SCAN"
      when: always
    - when: never
  extends: .container_scanning
  variables:
    SCANNING_IMAGE_NAME: registry.gitlab.com/jitesoft/dockerfiles/${SCAN_SUFFIX}:${FULL_VERSION}
    GIT_STRATEGY: none