.nvidia-ci.yml

---
##
## Variables that control where build artifacts are places for scanning and testing:
## CI_REGISTRY
## CI_REGISTRY_IMAGE
## CI_REGISTRY_USER
## CI_REGISTRY_PASSWORD
##
## Variables that control where release artifacts go:
## NGC_REGISTRY
## NGC_REGISTRY_IMAGE
## NGC_REGISTRY_USER
## NGC_REGISTRY_TOKEN
## REGISTRY_TOKEN
## REGISTRY_USER
## REGISTRY_IMAGE
## DOCKERHUB_REGISTRY

# We include the public gitlab CI definition to reuse the steps defined there
include:
  - local: '.common-ci.yml'

default:
  tags:
    - type/docker
    - docker/privileged
    - cnt
    - container-dev
    - os/linux

variables:
  DOCKER_DRIVER: overlay2
  DOCKER_TLS_CERTDIR: "/certs"
  # Release "devel"-tagged images off the master branch
  RELEASE_DEVEL_BRANCH: "master"
  RELEASE_DEVEL_TAG: "devel"

stages:
  - build
  - test
  - scan
  - deploy
  - release

# Note: The integration tests are disabled for this repository.
# Here we fail them, but allow the pipeline to continue.
skipped_integration:
  stage: test
  script:
    - echo "Tests are not enabled"
    - exit 0

# The .scan step forms the base of the image scan operation performed before releasing
# images.
.scan:
  stage: scan
  image: "${PULSE_IMAGE}"
  variables:
    IMAGE: "${CI_REGISTRY_IMAGE}/${IMAGE_NAME}:${CI_COMMIT_SHA}-${DIST}"
    IMAGE_ARCHIVE: "toolkit-container.tar"
  except:
    variables:
    - $CI_COMMIT_MESSAGE =~ /\[skip[ _-]scans?\]/i
    - $SKIP_SCANS
  before_script:
    - docker login -u "${CI_REGISTRY_USER}" -p "${CI_REGISTRY_PASSWORD}" "${CI_REGISTRY}"
    - docker pull "${IMAGE}"
    - docker save "${IMAGE}" -o "${IMAGE_ARCHIVE}"
  script:
    - AuthHeader=$(echo -n $SSA_CLIENT_ID:$SSA_CLIENT_SECRET | base64 -w0)
    - >
      export SSA_TOKEN=$(curl --request POST --header "Authorization: Basic $AuthHeader" --header "Content-Type: application/x-www-form-urlencoded" ${SSA_ISSUER_URL} | jq ".access_token" |  tr -d '"')
    - if [ -z "$SSA_TOKEN" ]; then exit 1; else echo "SSA_TOKEN set!"; fi
    - pulse-cli -n $NSPECT_ID --ssa $SSA_TOKEN scan -i $IMAGE_ARCHIVE -p $CONTAINER_POLICY -o
  artifacts:
    when: always
    expire_in: 1 week
    paths:
      - pulse-cli.log
      - licenses.json
      - sbom.json
      - vulns.json
      - policy_evaluation.json

scan-centos7:
  extends:
    - .scan
    - .target-centos7

scan-centos8:
  extends:
    - .scan
    - .target-centos8

scan-ubuntu18:
  extends:
    - .scan
    - .target-ubuntu18

scan-ubi8:
  extends:
    - .scan
    - .target-ubi8

# Define the external release steps for NGC and Dockerhub
.release:ngc:
  extends: .release:external
  variables:
    OUT_REGISTRY_USER: "${NGC_REGISTRY_USER}"
    OUT_REGISTRY_TOKEN: "${NGC_REGISTRY_TOKEN}"
    OUT_REGISTRY: "${NGC_REGISTRY}"
    OUT_IMAGE: "${NGC_REGISTRY_IMAGE}"

.release:dockerhub:
  extends: .release:external
  variables:
    OUT_REGISTRY_USER: "${REGISTRY_USER}"
    OUT_REGISTRY_TOKEN: "${REGISTRY_TOKEN}"
    OUT_REGISTRY: "${DOCKERHUB_REGISTRY}"
    OUT_IMAGE: "${REGISTRY_IMAGE}"

release:ngc-centos7:
  extends:
    - .release:ngc
    - .target-centos7
  dependencies:
    - deploy:sha-ci-centos7
    - scan-centos7

release:ngc-centos8:
  extends:
    - .release:ngc
    - .target-centos8
  dependencies:
    - deploy:sha-ci-centos8
    - scan-centos8

release:ngc-ubuntu18:
  extends:
    - .release:ngc
    - .target-ubuntu18
  dependencies:
    - deploy:sha-ci-ubuntu18
    - scan-ubuntu18

release:ngc-ubi8:
  extends:
    - .release:ngc
    - .target-ubi8
  dependencies:
    - deploy:sha-ci-ubi8
    - scan-ubi8

release:dockerhub-centos7:
  extends:
    - .release:dockerhub
    - .target-centos7
  dependencies:
    - deploy:sha-ci-centos7
    - scan-centos7

release:dockerhub-centos8:
  extends:
    - .release:dockerhub
    - .target-centos8
  dependencies:
    - deploy:sha-ci-centos8
    - scan-centos8

release:dockerhub-ubuntu18:
  extends:
    - .release:dockerhub
    - .target-ubuntu18
  dependencies:
    - deploy:sha-ci-ubuntu18
    - scan-ubuntu18

release:dockerhub-ubi8:
  extends:
    - .release:dockerhub
    - .target-ubi8
  dependencies:
    - deploy:sha-ci-ubi8
    - scan-ubi8