.codefresh-example-workflow

# More examples of Codefresh YAML can be found at
# https://codefresh.io/docs/docs/yaml-examples/examples/
version: "1.0"

### you will need these variables:
### ANCHORECTL_URL
### ANCHORECTL_USERNAME
### ANCHORECTL_PASSWORD
### 
### see anchorectl docs for more info 
### https://docs.anchore.com/current/docs/using/anchorectl_usage/
### https://docs.anchore.com/current/docs/deployment/anchorectl/
###
### also if you want to break on policy violations, there is 
### ANCHORE_FAIL_ON_POLICY=true
### (there is a commented-out line in the test stage where you can
###  set this, or you could add it as a project variable)

stages:
  - "build"
  - "test"
  - "promote"

steps:

  prep:
    title: "Prepare Environment"
    image: alpine:latest
    commands:
      # cf_export is codefresh-specific to export variables across steps
      - export ANCHORE_REGISTRY="docker.io"
      - export ANCHORE_REPO=${{CF_REPO_OWNER}}/${{CF_REPO_NAME}}
      - export ANCHORE_IMAGE_REPO=${ANCHORE_REGISTRY}/${ANCHORE_REPO}
      - export ANCHORE_TEST_TAG=cf-dev
      - export ANCHORE_PROD_TAG=cf-${{CF_BRANCH}}
      - cf_export ANCHORE_REGISTRY ANCHORE_REPO ANCHORE_IMAGE_REPO ANCHORE_TEST_TAG ANCHORE_PROD_TAG
    stage: "build"

  clone:
    title: "Cloning Repository"
    type: "git-clone"
    repo: "${{ANCHORE_REPO}}"
    revision: "${{CF_BRANCH}}"
    git: "github"
    stage: "build"

  build:
    title: "Building Docker Image"
    type: "build"
    ### disable caches to make sure we get a clean build
    no_cache: true
    no_cf_cache: true
    ### codefresh's build step is weird, it absolutely assumes you are using 
    ### docker hub and adds "docker.io" to your image name even if you already
    ### included it, so I am using ANCHORE_REPO here 
    ### instead of ANCHORE_IMAGE_REPO
    ### I kind of think it would make more sense to just use a freestyle
    ### step here and just issue a "docker build" and "docker push" etc
    image_name: "${{ANCHORE_REPO}}"
    working_directory: "${{clone}}"
    tag: "${{ANCHORE_TEST_TAG}}"
    dockerfile: "Dockerfile"
    stage: "build"

  test:
    title: "Scan with Anchore Enterprise"
    ### this anchore-plugin image is pretty old and has anchore-cli only
    #image: quay.io/codefreshplugins/anchore-plugin:latest 
    image: docker.io/pvnovarese/anchore-tools:main
    environment:
      - ANCHORE_IMAGE=${{ANCHORE_IMAGE_REPO}}:${{ANCHORE_TEST_TAG}}
      ### uncomment the following line if you want to break the pipeline for policy violation (or set it as a project variable, whatever)
      #- ANCHORE_FAIL_ON_POLICY=true
    commands:
      #- /entrypoint.sh ### only use this with the anchore-plugin image
      - anchorectl image add --force --dockerfile ${CF_REPO_NAME}/Dockerfile --no-auto-subscribe --wait --annotation build_tool=codefresh --annotation build_id=${{CF_SHORT_REVISION}} ${ANCHORE_IMAGE}
      ### we'll check the evaluation and get the callouts either way,
      ### only break the pipeline if ANCHORE_FAIL_ON_POLICY=true
      - |
        if [ "$ANCHORE_FAIL_ON_POLICY" == "true" ] ; then 
          anchorectl image check --detail --fail-based-on-results ${ANCHORE_IMAGE} ; 
        else 
          anchorectl image check --detail ${ANCHORE_IMAGE} ; 
        fi
    stage: "test"

  promote:
    title: "Rebuild and Promote Docker Image"
    type: "build"
    # we want the cache from the first build since we're not changing anything
    no_cache: false
    no_cf_cache: false
    image_name: "${{ANCHORE_REPO}}"
    working_directory: "${{clone}}"
    tag: "${{ANCHORE_PROD_TAG}}"
    dockerfile: "Dockerfile"
    stage: "promote"
    
  queue:
    title: "Add Promoted Image to Anchore Queue"
    image: docker.io/pvnovarese/anchore-tools:main
    environment:
      - ANCHORE_IMAGE=${{ANCHORE_IMAGE_REPO}}:${{ANCHORE_PROD_TAG}}
    commands:
      ### don't need "--wait" this time unless you're going to subscribe to vuln/policy updates
      - anchorectl image add --force --dockerfile ${CF_REPO_NAME}/Dockerfile --no-auto-subscribe --annotation build_tool=codefresh --annotation build_id=${{CF_SHORT_REVISION}} ${ANCHORE_IMAGE}
      ### optional, if you want to activate subscriptions for this image
      ### make sure you add --wait to the "anchorectl image add" in this step
      ### if you want continuous updates if new vulns are found:
      #- anchorectl subscription activate ${ANCHORE_IMAGE} vuln_update
      ### if you want continuous updates if the policy evaluation changes:
      #- anchorectl subscription activate ${ANCHORE_IMAGE} policy_eval
    stage: "promote"