.gitlab-ci.yml

---
# This file is templated, please edit it in the templates folder

stages:
  - lint
  - contain
  - scan


.env_entrypoint:
  image:
    name: _ # Placeholder to keep YAML schemea happy
    entrypoint: &env_entrypoint
      - "/usr/bin/env"
      - "PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"


lint:templates:
  stage: lint
  image: alpine
  variables:
    faq_version: 0.0.6
    gomplate_version: 3.6.0
  before_script:
    - >
      wget
      "https://github.com/jzelinskie/faq/releases/download/${faq_version}/faq-linux-amd64"
      -O /bin/faq
    - >
      wget
      "https://github.com/hairyhenderson/gomplate/releases/download/v${gomplate_version}/gomplate_linux-amd64"
      -O /bin/gomplate
    - chmod +x /bin/faq /bin/gomplate
  script:
    - echo "Checking for differences in templates"
    - ./scripts/build_templates.sh --diff
    - echo "Checking for differences in Dockerfile templates"
    - ./scripts/build_dockerfile_templates.sh --diff

lint:shell:
  stage: lint
  image: docker
  services:
    - docker:dind
  before_script:
    - docker --version
  script:
    - LIST_OF_SHELL=$(find -path '.git' -prune -o -print | egrep "\.sh$")
    - docker run -v "$PWD:/mnt" koalaman/shellcheck $LIST_OF_SHELL

lint:yaml:
  stage: lint
  image: pipelinecomponents/yamllint
  before_script:
    - yamllint --version
  script:
    - yamllint --strict .

# Common markdown config
.markdown:
  stage: lint
  image:
    name: registry.gitlab.com/06kellyjac/docker_markdownlint-cli
    entrypoint: *env_entrypoint
  # Don't prevent fixing own image
  allow_failure: true
  before_script:
    - markdownlint --version
  script:
    - markdownlint .

lint:markdown:docker_hub:
  extends: .markdown
  image:
    name: 06kellyjac/markdownlint-cli

lint:markdown:gitlab:
  extends: .markdown

lint:docker:
  stage: lint
  image:
    name: hadolint/hadolint:latest-debian
    entrypoint: *env_entrypoint
  before_script:
    - hadolint --version
  script:
    - LIST_OF_DOCKERFILES="$(find -type f -name "Dockerfile*" ! -path "./.git/*" ! -path "./templates/*")"
    - hadolint $LIST_OF_DOCKERFILES


.contain:
  stage: contain
  only:
    - master
  image: docker
  services:
    - docker:dind
  before_script:
    - docker --version
  script:
    - ./scripts/ci_contain.sh

contain:docker:latest:
  extends: .contain

contain:docker:latest-slim:
  extends: .contain

contain:docker:0.29.0:
  extends: .contain

contain:docker:0.29.0-slim:
  extends: .contain

contain:docker:0.28.1:
  extends: .contain

contain:docker:0.28.1-slim:
  extends: .contain

contain:docker:0.28.0:
  extends: .contain

contain:docker:0.28.0-slim:
  extends: .contain

contain:docker:0.27.1:
  extends: .contain

contain:docker:0.27.1-slim:
  extends: .contain

contain:docker:0.27.0:
  extends: .contain

contain:docker:0.27.0-slim:
  extends: .contain

contain:docker:0.26.0:
  extends: .contain

contain:docker:0.26.0-slim:
  extends: .contain

contain:docker:0.25.0:
  extends: .contain

contain:docker:0.25.0-slim:
  extends: .contain

contain:docker:0.24.0:
  extends: .contain

contain:docker:0.24.0-slim:
  extends: .contain

contain:docker:0.23.2:
  extends: .contain

contain:docker:0.23.2-slim:
  extends: .contain

contain:docker:0.23.1:
  extends: .contain

contain:docker:0.23.1-slim:
  extends: .contain

contain:docker:0.23.0:
  extends: .contain

contain:docker:0.23.0-slim:
  extends: .contain

contain:docker:0.22.0:
  extends: .contain

contain:docker:0.22.0-slim:
  extends: .contain

contain:docker:0.21.0:
  extends: .contain

contain:docker:0.21.0-slim:
  extends: .contain

contain:docker:0.20.0:
  extends: .contain

contain:docker:0.20.0-slim:
  extends: .contain

contain:docker:0.19.0:
  extends: .contain

contain:docker:0.19.0-slim:
  extends: .contain

contain:docker:0.18.0:
  extends: .contain

contain:docker:0.18.0-slim:
  extends: .contain

contain:docker:0.17.0:
  extends: .contain

contain:docker:0.17.0-slim:
  extends: .contain

contain:docker:0.16.0:
  extends: .contain

contain:docker:0.16.0-slim:
  extends: .contain

contain:docker:0.15.0:
  extends: .contain

contain:docker:0.15.0-slim:
  extends: .contain

contain:docker:0.14.1:
  extends: .contain

contain:docker:0.14.1-slim:
  extends: .contain

contain:docker:0.14.0:
  extends: .contain

contain:docker:0.14.0-slim:
  extends: .contain

contain:docker:0.13.0:
  extends: .contain

contain:docker:0.13.0-slim:
  extends: .contain

contain:docker:0.12.0:
  extends: .contain

contain:docker:0.12.0-slim:
  extends: .contain

contain:docker:0.11.0:
  extends: .contain

contain:docker:0.11.0-slim:
  extends: .contain

contain:docker:0.10.0:
  extends: .contain

contain:docker:0.10.0-slim:
  extends: .contain


container_scanning:
  stage: scan
  only:
    - master
  image: docker:stable
  variables:
    DOCKER_DRIVER: overlay2
    DOCKER_IMAGE: $CI_REGISTRY_IMAGE
  allow_failure: true
  services:
    - docker:stable-dind
  artifacts:
    paths:
      - gl-container-scanning-report.json
  script:
    - docker run -d --name db arminc/clair-db:latest
    - >
      docker run -p 6060:6060 --link db:postgres -d --name clair --restart on-failure
      arminc/clair-local-scan:v2.1.0_8cb406fdb7ae7dc6fed05032b036a365391aaf42
    - apk add -U wget ca-certificates
    - docker pull ${DOCKER_IMAGE}
    - wget -O clair-scanner https://github.com/arminc/clair-scanner/releases/download/v12/clair-scanner_linux_amd64
    - chmod +x clair-scanner
    - touch clair-whitelist.yml
    - while( ! wget -q -O /dev/null http://docker:6060/v1/namespaces ) ; do sleep 1 ; done
    - retries=0
    - echo "Waiting for clair daemon to start"
    - |
      while( ! wget -timeout=10 -q -O /dev/null http://docker:6060/v1/namespaces ); do
        sleep 1
        echo -n "."
        if [ $retries -eq 10 ]; then
          echo " Timeout, aborting."
          exit 1
        fi
      retries=$(($retries+1))
      done
    - >
      ./clair-scanner -c http://docker:6060 --ip $(hostname -i) -r gl-container-scanning-report.json
      -l clair.log -w clair-whitelist.yml ${DOCKER_IMAGE} || true