.gitlab-ci.yml

image: cincproject/omnibus-debian
stages:
 - patch
 - package
 - test
 - cleanup
 - deploy
 - publish

variables:
  ORIGIN: https://github.com/inspec/inspec.git
  REF: main
  CHANNEL: unstable
  CINC_PRODUCT: cinc-auditor
  OMNIBUS_FIPS_MODE: "true"

workflow:
  rules:
    # Run if we trigger a pipeline from the web
    - if: $CI_PIPELINE_SOURCE == "web"
    # Run if we trigger a pipeline from another project (i.e. upstream/inspec)
    - if: $CI_PIPELINE_SOURCE == "pipeline"
    # Run if this is a merge request
    - if: $CI_MERGE_REQUEST_ID

include:
  - local: .gitlab/package.yml
  - local: .gitlab/test.yml

patch:
  stage: patch
  tags:
    - docker-x86_64
  script:
    - echo "Cloning from $ORIGIN"
    - ./patch.sh
  artifacts:
    expire_in: 1mo
    paths:
      - inspec/

# Package stage

package:source:
  stage: package
  needs:
    - patch
  tags:
    - docker-x86_64
  script:
    - ./build-source.sh cinc-auditor inspec
  artifacts:
    expire_in: 1mo
    paths:
      - source/*

package:amazonlinux-2023:x86_64:
  extends: .package:amazonlinux
  image: cincproject/omnibus-amazonlinux:2023
  cache:
    key: amazonlinux-2023-x86_64
  tags:
    - docker-x86_64
  needs:
    - patch
  variables:
    PLATFORM_VER: "2023"

package:amazonlinux-2023:aarch64:
  extends: .package:amazonlinux
  image: cincproject/omnibus-amazonlinux:2023
  cache:
    key: amazonlinux-2023-aarch64
  tags:
    - docker-aarch64-v8.2-a
  needs:
    - patch
  variables:
    PLATFORM_VER: "2023"
    OMNIBUS_FIPS_MODE: "false"

package:centos-8:x86_64:
  extends: .package:centos
  image: cincproject/omnibus-almalinux:8
  cache:
    key: centos-8-x86_64
  tags:
    - docker-x86_64
  needs:
    - patch
  variables:
    PLATFORM_VER: "8"

package:centos-8:aarch64:
  extends: .package:centos
  image: cincproject/omnibus-almalinux:8
  cache:
    key: centos-8-aarch64
  tags:
    - docker-aarch64
  needs:
    - patch
  variables:
    PLATFORM_VER: "8"
    OMNIBUS_FIPS_MODE: "false"

package:centos-8:s390x:
  extends: .package:centos
  image: cincproject/omnibus-almalinux:8
  cache:
    key: centos-8-s390x
  tags:
    - docker-s390x
  needs:
    - patch
  variables:
    PLATFORM_VER: "8"

package:centos-9:s390x:
  extends: .package:centos
  image: cincproject/omnibus-almalinux:9
  cache:
    key: centos-9-s390x
  tags:
    - docker-s390x
  needs:
    - patch
  variables:
    PLATFORM_VER: "9"

package:centos-9:x86_64:
  extends: .package:centos
  image: cincproject/omnibus-almalinux:9
  cache:
    key: centos-9-x86_64
  tags:
    - docker-x86_64
  needs:
    - patch
  variables:
    PLATFORM_VER: "9"

package:centos-9:aarch64:
  extends: .package:centos
  image: cincproject/omnibus-almalinux:9
  cache:
    key: centos-9-aarch64
  tags:
    - docker-aarch64
  needs:
    - patch
  variables:
    PLATFORM_VER: "9"
    OMNIBUS_FIPS_MODE: "false"

package:debian-11:x86_64:
  extends: .package:debian
  image: cincproject/omnibus-debian:11
  cache:
    key: debian-11-x86_64
  tags:
    - docker-x86_64
  needs:
    - patch
  variables:
    PLATFORM_VER: "11"

package:debian-11:aarch64:
  extends: .package:debian
  image: cincproject/omnibus-debian:11
  cache:
    key: debian-11-aarch64
  tags:
    - docker-aarch64
  needs:
    - patch
  variables:
    PLATFORM_VER: "11"
    OMNIBUS_FIPS_MODE: "false"

package:debian-12:x86_64:
  extends: .package:debian
  image: cincproject/omnibus-debian:12
  cache:
    key: debian-12-x86_64
  tags:
    - docker-x86_64
  needs:
    - patch
  variables:
    PLATFORM_VER: "12"

package:debian-12:aarch64:
  extends: .package:debian
  image: cincproject/omnibus-debian:12
  cache:
    key: debian-12-aarch64
  tags:
    - docker-aarch64
  needs:
    - patch
  variables:
    PLATFORM_VER: "12"
    OMNIBUS_FIPS_MODE: "false"

package:macos-11:
  extends: .package:macos
  cache:
    key: macos-11
  tags:
    - macos-11
  needs:
    - patch
  variables:
    PLATFORM_VER: "11"

package:macos-12:
  extends: .package:macos
  cache:
    key: macos-12
  tags:
    - macos-12
  needs:
    - patch
  variables:
    PLATFORM_VER: "12"

package:macos-12:aarch64:
  extends: .package:macos
  cache:
    key: macos-12-aarch64
  tags:
    - macos-12-aarch64
  needs:
    - patch
  variables:
    PLATFORM_VER: "12"

package:macos-13:
  extends: .package:macos
  cache:
    key: macos-13
  tags:
    - macos-13
  needs:
    - patch
  variables:
    PLATFORM_VER: "13"

package:macos-13:aarch64:
  extends: .package:macos
  cache:
    key: macos-13-aarch64
  tags:
    - macos-13-aarch64
  needs:
    - patch
  variables:
    PLATFORM_VER: "13"

package:opensuse-15:x86_64:
  extends: .package:opensuse
  image: cincproject/omnibus-opensuse:15
  cache:
    key: opensuse-15-x86_64
  tags:
    - docker-x86_64
  needs:
    - patch
  variables:
    PLATFORM_VER: "15"

package:opensuse-15:aarch64:
  extends: .package:opensuse
  image: cincproject/omnibus-opensuse:15
  cache:
    key: opensuse-15-aarch64
  tags:
    - docker-aarch64
  needs:
    - patch
  variables:
    PLATFORM_VER: "15"
    OMNIBUS_FIPS_MODE: "false"

package:windows-2016:
  extends: .package:windows
  cache:
    key: windows-2016
  tags:
    - windows-2016
  needs:
    - patch
  variables:
    PLATFORM_VER: "2016"

package:ubuntu-20.04:x86_64:
  extends: .package:ubuntu
  image: cincproject/omnibus-ubuntu:20.04
  cache:
    key: ubuntu-20.04-x86_64
  tags:
    - docker-x86_64
  needs:
    - patch
  variables:
    PLATFORM_VER: "20.04"

package:ubuntu-20.04:aarch64:
  extends: .package:ubuntu
  image: cincproject/omnibus-ubuntu:20.04
  cache:
    key: ubuntu-20.04-aarch64
  tags:
    - docker-aarch64
  needs:
    - patch
  variables:
    PLATFORM_VER: "20.04"
    OMNIBUS_FIPS_MODE: "false"

package:ubuntu-22.04:x86_64:
  extends: .package:ubuntu
  image: cincproject/omnibus-ubuntu:22.04
  cache:
    key: ubuntu-22.04-x86_64
  tags:
    - docker-x86_64
  needs:
    - patch
  variables:
    PLATFORM_VER: "22.04"

package:ubuntu-22.04:aarch64:
  extends: .package:ubuntu
  image: cincproject/omnibus-ubuntu:22.04
  cache:
    key: ubuntu-22.04-aarch64
  tags:
    - docker-aarch64
  needs:
    - patch
  variables:
    PLATFORM_VER: "22.04"
    OMNIBUS_FIPS_MODE: "false"

package:ubuntu-24.04:x86_64:
  extends: .package:ubuntu
  image: cincproject/omnibus-ubuntu:24.04
  cache:
    key: ubuntu-24.04-x86_64
  tags:
    - docker-x86_64
  needs:
    - patch
  variables:
    PLATFORM_VER: "24.04"

package:ubuntu-24.04:aarch64:
  extends: .package:ubuntu
  image: cincproject/omnibus-ubuntu:24.04
  cache:
    key: ubuntu-24.04-aarch64
  tags:
    - docker-aarch64
  needs:
    - patch
  variables:
    PLATFORM_VER: "24.04"
    OMNIBUS_FIPS_MODE: "false"

# Test stage

test:amazonlinux-2023:x86_64:
  extends: .test:amazonlinux
  image: cincproject/omnibus-amazonlinux:2023
  needs:
    - package:amazonlinux-2023:x86_64
  tags:
    - docker-x86_64
  variables:
    PLATFORM_VER: "2023"

test:amazonlinux-2023:aarch64:
  extends: .test:amazonlinux
  image: cincproject/omnibus-amazonlinux:2023
  needs:
    - package:amazonlinux-2023:aarch64
  tags:
    - docker-aarch64-v8.2-a
  variables:
    PLATFORM_VER: "2023"
    OMNIBUS_FIPS_MODE: "false"

test:centos-8:x86_64:
  extends: .test:centos
  image: cincproject/omnibus-almalinux:8
  needs:
    - package:centos-8:x86_64
  tags:
    - docker-x86_64
  variables:
    PLATFORM_VER: "8"

test:centos-8:aarch64:
  extends: .test:centos
  image: cincproject/omnibus-almalinux:8
  needs:
    - package:centos-8:aarch64
  tags:
    - docker-aarch64
  variables:
    PLATFORM_VER: "8"

test:centos-8:s390x:
  extends: .test:centos
  image: cincproject/omnibus-almalinux:8
  needs:
    - package:centos-8:s390x
  tags:
    - docker-s390x
  variables:
    PLATFORM_VER: "8"

test:centos-9:s390x:
  extends: .test:centos
  image: cincproject/omnibus-almalinux:9
  needs:
    - package:centos-9:s390x
  tags:
    - docker-s390x
  variables:
    PLATFORM_VER: "9"

test:centos-9:x86_64:
  extends: .test:centos
  image: cincproject/omnibus-almalinux:9
  needs:
    - package:centos-9:x86_64
  tags:
    - docker-x86_64
  variables:
    PLATFORM_VER: "9"

test:centos-9:aarch64:
  extends: .test:centos
  image: cincproject/omnibus-almalinux:9
  needs:
    - package:centos-9:aarch64
  tags:
    - docker-aarch64
  variables:
    PLATFORM_VER: "9"

test:debian-11:x86_64:
  extends: .test:debian
  image: cincproject/omnibus-debian:11
  needs:
    - package:debian-11:x86_64
  tags:
    - docker-x86_64
  variables:
    PLATFORM_VER: "11"

test:debian-11:aarch64:
  extends: .test:debian
  image: cincproject/omnibus-debian:11
  needs:
    - package:debian-11:aarch64
  tags:
    - docker-aarch64
  variables:
    PLATFORM_VER: "11"

test:debian-12:x86_64:
  extends: .test:debian
  image: cincproject/omnibus-debian:12
  needs:
    - package:debian-12:x86_64
  tags:
    - docker-x86_64
  variables:
    PLATFORM_VER: "12"

test:debian-12:aarch64:
  extends: .test:debian
  image: cincproject/omnibus-debian:12
  needs:
    - package:debian-12:aarch64
  tags:
    - docker-aarch64
  variables:
    PLATFORM_VER: "12"

test:macos-11:
  extends: .test:macos
  tags:
    - macos-11
  needs:
    - package:macos-11
  variables:
    PLATFORM_VER: "11"

test:macos-12:
  extends: .test:macos
  tags:
    - macos-12
  needs:
    - package:macos-12
  variables:
    PLATFORM_VER: "12"

test:macos-12:aarch64:
  extends: .test:macos
  tags:
    - macos-12-aarch64
  needs:
    - package:macos-12:aarch64
  variables:
    PLATFORM_VER: "12"

test:macos-13:
  extends: .test:macos
  tags:
    - macos-13
  needs:
    - package:macos-13
  variables:
    PLATFORM_VER: "13"

test:macos-13:aarch64:
  extends: .test:macos
  tags:
    - macos-13-aarch64
  needs:
    - package:macos-13:aarch64
  variables:
    PLATFORM_VER: "13"

test:opensuse-15:x86_64:
  extends: .test:opensuse
  image: cincproject/omnibus-opensuse:15
  needs:
    - package:opensuse-15:x86_64
  tags:
    - docker-x86_64
  variables:
    PLATFORM_VER: "15"

test:opensuse-15:aarch64:
  extends: .test:opensuse
  image: cincproject/omnibus-opensuse:15
  needs:
    - package:opensuse-15:aarch64
  tags:
    - docker-aarch64
  variables:
    PLATFORM_VER: "15"

test:ubuntu-20.04:x86_64:
  extends: .test:ubuntu
  image: cincproject/omnibus-ubuntu:20.04
  needs:
    - package:ubuntu-20.04:x86_64
  tags:
    - docker-x86_64
  variables:
    PLATFORM_VER: "20.04"

test:ubuntu-20.04:aarch64:
  extends: .test:ubuntu
  image: cincproject/omnibus-ubuntu:20.04
  needs:
    - package:ubuntu-20.04:aarch64
  tags:
    - docker-aarch64
  variables:
    PLATFORM_VER: "20.04"

test:ubuntu-22.04:x86_64:
  extends: .test:ubuntu
  image: cincproject/omnibus-ubuntu:22.04
  needs:
    - package:ubuntu-22.04:x86_64
  tags:
    - docker-x86_64
  variables:
    PLATFORM_VER: "22.04"

test:ubuntu-22.04:aarch64:
  extends: .test:ubuntu
  image: cincproject/omnibus-ubuntu:22.04
  needs:
    - package:ubuntu-22.04:aarch64
  tags:
    - docker-aarch64
  variables:
    PLATFORM_VER: "22.04"

test:ubuntu-24.04:x86_64:
  extends: .test:ubuntu
  image: cincproject/omnibus-ubuntu:24.04
  needs:
    - package:ubuntu-24.04:x86_64
  tags:
    - docker-x86_64
  variables:
    PLATFORM_VER: "24.04"

test:ubuntu-24.04:aarch64:
  extends: .test:ubuntu
  image: cincproject/omnibus-ubuntu:24.04
  needs:
    - package:ubuntu-24.04:aarch64
  tags:
    - docker-aarch64
  variables:
    PLATFORM_VER: "24.04"

test:windows-2016:
  extends: .test:windows
  needs:
    - package:windows-2016
  variables:
    PLATFORM_VER: "2016"

test:sources:
  image: cincproject/docker-auditor
  stage: test
  needs:
    - package:source
  tags:
    - docker-x86_64
  script:
    - apk add bash outils-sha256
    - cinc-auditor exec test/integration/cinc-sources --no-distinct-exit --reporter cli junit:junit.xml
  artifacts:
    reports:
      junit: junit.xml

.ssh-setup:
  before_script:
    - eval $(ssh-agent -s)
    - echo "${SSH_PRIVATE_KEY}" | tr -d '\r' | ssh-add - > /dev/null
    - mkdir -p ~/.ssh
    - chmod 700 ~/.ssh
    - echo "${SSH_KNOWN_HOSTS}" > ~/.ssh/known_hosts
    - chmod 644 ~/.ssh/known_hosts

deploy:
  allow_failure: false
  stage: deploy
  extends: .ssh-setup
  # Only run if this is triggered from the web
  rules:
    - if: $CI_PIPELINE_SOURCE == "web"
      when: manual
    - when: never
  tags:
    - docker-x86_64
  dependencies:
    - package:amazonlinux-2023:x86_64
    - package:amazonlinux-2023:aarch64
    - package:centos-8:aarch64
    - package:centos-8:s390x
    - package:centos-8:x86_64
    - package:centos-9:aarch64
    - package:centos-9:x86_64
    - package:centos-9:s390x
    - package:debian-11:x86_64
    - package:debian-11:aarch64
    - package:debian-12:x86_64
    - package:debian-12:aarch64
    - package:macos-11
    - package:macos-12
    - package:macos-12:aarch64
    - package:macos-13
    - package:macos-13:aarch64
    - package:opensuse-15:x86_64
    - package:opensuse-15:aarch64
    - package:source
    - package:ubuntu-20.04:x86_64
    - package:ubuntu-20.04:aarch64
    - package:ubuntu-22.04:x86_64
    - package:ubuntu-22.04:aarch64
    - package:ubuntu-24.04:x86_64
    - package:ubuntu-24.04:aarch64
    - package:windows-2016
  script:
    - bash deploy.sh

deploy-gems:
  stage: deploy
  # Only run if this is triggered from the web
  rules:
    - if: $CI_PIPELINE_SOURCE == "web"
      when: manual
    - when: never
  tags:
    - docker-x86_64
  dependencies:
    - patch
  script:
    - ./deploy-gems.sh

publish:
  stage: publish
  extends: .ssh-setup
  dependencies: []
  # Only run if this is triggered from the web
  rules:
    - if: $CI_PIPELINE_SOURCE == "web"
      when: on_success
    - when: never
  tags:
    - downloads
  script:
    - sudo mkdir -p /data/mirror/files/${CHANNEL}/cinc-auditor
    - sudo /usr/bin/rsync -avH /data/incoming/files/${CHANNEL}/cinc-auditor/ /data/mirror/files/${CHANNEL}/cinc-auditor/
    - sudo /usr/bin/rsync -avH /data/incoming/source/${CHANNEL}/cinc-auditor/ /data/mirror/source/${CHANNEL}/cinc-auditor/
    - sudo -E -u cinc /usr/local/bin/update-cinc-api
    - ssh -q cinc@${MIRROR_HOST} "~/sync-from-master"

publish-docker:
  image: docker:latest
  services:
  - docker:dind
  stage: publish
  # Only run if this is triggered from the web
  rules:
    - if: $CI_PIPELINE_SOURCE == "web"
      when: on_success
    - when: never
  tags:
    - docker-x86_64
  dependencies:
    - patch
    - deploy-gems
  before_script:
    - apk add curl bash
    - eval $(ssh-agent -s)
    - echo "${BUILDX_SSH_PRIVATE_KEY}" | tr -d '\r' | ssh-add -q - > /dev/null
    - mkdir -p ~/.ssh
    - chmod 700 ~/.ssh
    - echo "${BUILDX_SSH_KNOWN_HOSTS}" > ~/.ssh/known_hosts
    - chmod 644 ~/.ssh/known_hosts
    - docker context create amd64
    - docker context use amd64
    - docker buildx create --name $BUILDER_NAME --use amd64 --platform linux/amd64 --config buildkitd.toml
    - docker context create arm64 --docker "host=ssh://${BUILDX_ARM64}"
    - docker buildx create --name $BUILDER_NAME --append arm64 --platform linux/arm64 --config buildkitd.toml
  script:
    - bash docker.sh
    - docker buildx ls --no-trunc
    - docker buildx stop $BUILDER_NAME
    - docker buildx rm -f $BUILDER_NAME
  variables:
    DOCKER_DRIVER: overlay2
    DOCKER_TLS_VERIFY: 1
    DOCKER_CERT_PATH: "/certs/client"
    DOCKER_TLS_CERTDIR: "/certs"
    BUILDER_NAME: "${CI_PROJECT_PATH_SLUG}-${CI_PIPELINE_ID}-${CI_JOB_NAME_SLUG}"

.cleanup:
  stage: cleanup
  dependencies: []
  variables:
    GIT_CHECKOUT: "false"
  when: always
  script:
    - sudo rm -rf inspec/
    - sudo rm -rf ${CI_PROJECT_DIR}/cinc-project/distribution/auditor/

cleanup:macos-11:
  extends: .cleanup
  tags:
    - macos-11

cleanup:macos-12:
  extends: .cleanup
  tags:
    - macos-12

cleanup:macos-12-aarch64:
  extends: .cleanup
  tags:
    - macos-12-aarch64

cleanup:macos-13:
  extends: .cleanup
  tags:
    - macos-13

cleanup:macos-13-aarch64:
  extends: .cleanup
  tags:
    - macos-13-aarch64