config.yml

version: 2.1

parameters:
  trigger_nightly_workflow:
    description: "Whether to trigger the `nightly` workflow."
    type: boolean
    default: false
  triggered_by_webhook:
    description: "Whether this pipeline was triggered by an incoming Docker Hub webhook"
    type: boolean
    default: false

orbs:
  slack: circleci/slack@5.1.1
  vuln-scanner: cci-internal/vuln-scanner@0.11.3

x-data:
  go_image: &goimage cimg/go:1.24.1

executors:
  go-medium:
    docker:
      - image: *goimage
    resource_class: circleci-runner/rum
  go:
    docker:
      - image: *goimage
    resource_class: circleci-runner/rum-large
  ccc:
    docker:
      - image: circleci/command-convenience:0.1
        auth:
          username: ${DOCKER_HUB_USER}
          password: ${DOCKER_HUB_PASSWORD}
  linux_machine:
    machine:
      image: ubuntu-2204:2024.02.7
      resource_class: large

workflows:
  main-workflow:
    when:
      and:
        - not:
            equal: [ nightly, << pipeline.schedule.name >> ]
        - equal: [ false, << pipeline.parameters.trigger_nightly_workflow >> ]
    jobs:
      - lint
      - test
      - build
      - scan:
          context: [ org-global ]
          requires: [ build ]
      - vuln-scanner/vuln_scan:
          context: [ security-scanning, dockerhub-readonly, github-readonly ]
          upload_on_merge: true
      - check-license-attributions:
          context: [ org-global ]
      - images:
          context: [ org-global, runner-image-signing ]
          requires: [ lint, test, build, scan, vuln-scanner/vuln_scan ]
      - smoke-tests:
          context: [ org-global, runner-smoke-tests ]
          requires: [ images ]
  nightly:
    when:
      or:
        - equal: [ nightly, << pipeline.schedule.name >> ]
        - equal: [ true, << pipeline.parameters.trigger_nightly_workflow >> ]
    jobs:
      - test
      - build
      - scan:
          context: [ org-global ]
          requires: [ build ]
      - smoke-tests:
          context: [ org-global, runner-smoke-tests ]

jobs:
  lint:
    executor: go
    steps:
      - setup
      - with-go-cache:
          golangci-lint: true
          steps:
            - run:
                name: Lint report
                command: ./do lint-report
      - run:
          name: Check `go mod tidy`
          command: |
            ./do go-mod-tidy
            git --no-pager diff --exit-code go.mod go.sum
      - run:
          name: Check the CHANGELOG.md has been updated
          command: |
            if [[ -z "${CIRCLE_PULL_REQUEST}" ]] && [[ "${CIRCLE_BRANCH}" != 'main' ]]; then
              echo 'Only check on a PR or main' && exit 0
            fi

            if git --no-pager diff main --exit-code CHANGELOG.md; then
              # Only check actual customer-facing changes have been made
              git --no-pager diff main --exit-code -- \
                ':*.go' \
                ':*Dockerfile' \
                ':!*_test.go' \
                ':!*internal/*' \
                ':!.circleci/*.go'
            fi
      - run:
          name: Try running `./do lint --fix` if this fails
          command: ./do lint
          when: on_fail
      - store_results
      - notify_failing_main

  test:
    executor: go
    steps:
      - setup
      - with-go-cache:
          steps:
            - run: ./do test ./... -count 3
      - notify_failing_main

  build:
    executor: go
    steps:
      - setup
      - with-go-cache:
          steps:
            - run:
                name: Build binaries
                command: |
                  BUILD_VERSION="$(<version.txt)-<< pipeline.number >>-$(git rev-parse --short HEAD 2>/dev/null || echo latest)" \
                    ./do build
      - persist_to_workspace:
          root: .
          paths: [ target ]
      - notify_failing_main

  images:
    executor: linux_machine
    steps:
      - attach_workspace:
          at: /tmp/workspace
      - setup
      - docker_login
      - with-go-cache:
          steps:
            - when:
                condition:
                  not:
                    equal: [ << pipeline.parameters.triggered_by_webhook >>, true ]
                steps:
                  - notify_slack:
                      header: ":goat: Release triggered"
                      version: "$(<version.txt)"
            - when:
                condition:
                  equal: [ << pipeline.parameters.triggered_by_webhook >>, true ]
                steps:
                  - notify_slack:
                      header: ":goat: :webhooks: Webhook trigger: Images rebuilt and published"
                      version: "$(<version.txt)"
            - run:
                name: Create cosign.key
                command: echo -e ${COSIGN_KEY} >cosign.key
            - run:
                name: Build and push dev images for use in the smoke tests
                command: |
                  echo "export IMAGE_TAG_SUFFIX=\"-${CIRCLE_BUILD_NUM}-$(git rev-parse --short HEAD)\"" >>/tmp/workspace/environment
                  source /tmp/workspace/environment

                  SKIP_PUSH='false' \
                    SKIP_PUSH_TEST_AGENT='true' \
                    ./do images
            - run:
                name: Set SKIP_PUSH variable
                command: |
                  echo 'export SKIP_PUSH=$(if [ "$CIRCLE_BRANCH" == "main" ]; then echo "false"; else echo "true"; fi)' >> $BASH_ENV
            - run:
                name: Build and maybe push images for cloud
                command: ./do images
            - when:
                # N.b., GoReleaser/Cosign will only sign during the publishing phase, which is only on main
                condition:
                  equal: [ << pipeline.git.branch >>, main ]
                steps:
                  - run:
                      name: Verify the manifest signature
                      command: go tool cosign verify --key cosign.pub circleci/runner-init:agent
            - run:
                name: Clone the server repo
                command: |
                  git clone "https://scotty-approver:${SCOTTY_APPROVER_TOKEN}@github.com/circleci/server.git"
                  echo 'export SERVER_REPO_PATH="$PWD/server"' >> $BASH_ENV
            - run:
                name: Build and maybe push images for server
                command: ./do images-for-server
            - notify_failing_main
            - persist_to_workspace:
                root: /tmp/workspace
                paths:
                  - environment

  check-license-attributions:
    executor: go-medium
    steps:
      - checkout
      - with-go-cache:
          steps:
            - run: ./do license-attributions
            - run:
                name: "Check all third-party Go licenses are attributed"
                command: |
                  diff_output=$(git diff HEAD -- ./go-project-licenses.csv)
                  if [[ -n "$diff_output" ]]; then
                    echo "Changes detected in 'go-project-licenses.csv':"
                    echo
                    echo "${diff_output}"
                    echo
                    echo "1) Run './do license-attributions' locally and commit the results."
                    echo "2) Update the Open Source Acknowledgments in 'runner-init.csv':"
                    echo "   https://github.com/circleci/circleci-docs/blob/master/jekyll/_cci2/runner-init.csv"
                    echo "   Unknown licenses may require manual intervention."
                    exit 1
                  else
                    echo "No changes detected in 'go-project-licenses.csv'."
                  fi

  scan:
    executor: ccc
    parallelism: 4
    environment:
      SYNK_DO_UPLOAD: true
    steps:
      - checkout
      - setup_remote_docker
      - attach_workspace:
          at: .
      - run:
          name: Select Docker image combinations for scanning
          command: |
            archs='amd64 arm64'
            for path in $(find docker/*Dockerfile); do
              for arch in ${archs}; do
                printf "${path} ${arch}\n" >>images.txt
              done
            done
            cat images.txt
            echo "Selecting '$(circleci-agent tests split images.txt)' for scanning"
      - run:
          name: Scan selected Docker images
          command: |
            while IFS= ' ' read -r path arch; do
              echo "Scanning ${path} ${arch}"
              name=${path//\//_}-${arch}
              NAME=${name,,} \
                DOCKERFILE_PATH=${path} \
                EXTRA_DOCKER_BUILD_ARGS="--build-arg ARCH=${arch}" \
                scan
            done \<<<$(circleci-agent tests split images.txt)
      - run:
          name: Check artifacts for scan results
          command: ls ccc-image-scan-results && false
          when: on_fail
      - store_artifacts:
          path: ccc-image-scan-results
      - notify_failing_main
      

  smoke-tests:
    executor: go
    steps:
      - checkout
      - attach_workspace:
          at: /tmp/workspace
      - with-go-cache:
          steps:
            - run:
                name: "Run the runner smoke tests in the `circleci/runner-smoke-tests` repo"
                command: |
                  source /tmp/workspace/environment || true

                  SMOKE_TESTS_KUBERNETES_RUNNER_INIT_TAG="agent${IMAGE_TAG_SUFFIX:-""}" \
                    SMOKE_TESTS_MACHINE_SKIP=true \
                    ./do smoke-tests
      - notify_failing_main

commands:
  setup:
    steps:
      - checkout
      - attach_workspace:
          at: .
      - run: go mod download

  store_results:
    steps:
      - run:
          name: Strip ANSI codes from xunit output
          when: always
          command: |
            # The test output produces ANSI codes, which the XML writer converts into annoying
            # \0xfffd characters - we'll strip these out to make the XML a bit more readable
            sed -i 's/�\[[0-9;]*[a-zA-Z]//g' test-reports/*.xml || true
      - store_artifacts:
          path: test-reports
      - store_test_results:
          path: test-reports

  docker_login:
    steps:
      - run:
          name: "Log into Docker Hub"
          command: |
            docker login -u "${DOCKER_HUB_USER}" -p "${DOCKER_HUB_PASSWORD}"

  notify_failing_main:
    steps:
      - slack/notify:
          channel: runner-alerts
          branch_pattern: main
          event: fail
          template: basic_fail_1

  notify_slack:
    parameters:
      header:
        type: string
      version:
        type: string
    steps:
      - when:
          condition:
            equal: [ main, << pipeline.git.branch >> ]
          steps:
            - run:
                name: Slack Notification
                command: |
                  # Provide error if no webhook is set and error. Otherwise continue
                  if [ -z "${SLACK_WEBHOOK}" ]; then
                    echo '$SLACK_WEBHOOK not set'
                    exit 1
                  fi

                  cat \<< EOF | tee /tmp/slack-webhook-body
                  {
                  	"blocks": [
                  		{
                  			"type": "header",
                  			"text": {
                  				"type": "plain_text",
                  				"text": "<< parameters.header >>",
                  				"emoji": true
                  			}
                  		},
                  		{
                  			"type": "section",
                  			"fields": [
                  				{
                  					"type": "mrkdwn",
                  					"text": "*Project:*\n$CIRCLE_PROJECT_REPONAME"
                  				},
                  				{
                  					"type": "mrkdwn",
                  					"text": "*Author:*\n$CIRCLE_USERNAME"
                  				}
                  			]
                  		},
                  		{
                  			"type": "section",
                  			"fields": [
                  				{
                  					"type": "mrkdwn",
                  					"text": "*Version:*\n<<parameters.version>>"
                  				},
                  				{
                  					"type": "mrkdwn",
                  					"text": "*CircleCI Build:*\n<$CIRCLE_BUILD_URL|$CIRCLE_BUILD_NUM>"
                  				}
                  			]
                  		},
                  		{
                  			"type": "section",
                  			"text": {
                  				"type": "mrkdwn",
                  				"text": "*Commit Message:*\n$(git show HEAD --no-patch --format=%s | jq -R '.' | sed -e 's/^"//' -e 's/"$//')"
                  			}
                  		}
                  	]
                  }
                  EOF

                  curl --fail -H 'Content-type: application/json' \
                      --data @/tmp/slack-webhook-body "${SLACK_WEBHOOK}"

  with-go-cache:
    parameters:
      steps:
        type: steps
      go-build:
        type: boolean
        default: true
      golangci-lint:
        type: boolean
        default: false
    steps:
      - when:
          condition: << parameters.golangci-lint >>
          steps:
            - restore_cache:
                keys:
                  - v1-golangci-lint-{{ .Environment.CIRCLE_JOB }}-{{ checksum "go.sum" }}-{{ epoch | round "72h" }}
      - when:
          condition: << parameters.go-build >>
          steps:
            - restore_cache:
                keys:
                  - v1-go-build-{{ .Environment.CIRCLE_JOB }}-{{ checksum "go.sum" }}-{{ epoch | round "72h" }}
      - steps: << parameters.steps >>
      - when:
          condition: << parameters.golangci-lint >>
          steps:
            - save_cache:
                key: v1-golangci-lint-{{ .Environment.CIRCLE_JOB }}-{{ checksum "go.sum" }}-{{ epoch | round "72h" }}
                paths:
                  - /home/circleci/.cache/golangci-lint
      - when:
          condition: << parameters.go-build >>
          steps:
            - save_cache:
                key: v1-go-build-{{ .Environment.CIRCLE_JOB }}-{{ checksum "go.sum" }}-{{ epoch | round "72h" }}
                paths:
                  - /home/circleci/.cache/go-build