stages:
  - test
  - build
  - deploy

test:
  stage: test
  image: python:3.6
  tags:
    - docker
  variables:
    FLASK_TESTING: "True"
  script:
    - pip install -e .
    - python test.py

build:
  stage: build
  image: docker:stable
  services:
    - docker:dind
  variables:
    DOCKER_HOST: tcp://docker:2375
    DOCKER_DRIVER: overlay2
  script:
    - docker login $CI_REGISTRY -u $CI_REGISTRY_USER -p $CI_REGISTRY_PASSWORD
    - docker build --build-arg VERSION=$CI_COMMIT_SHA . -t $CI_REGISTRY_IMAGE:$CI_PIPELINE_IID
    - docker tag $CI_REGISTRY_IMAGE:$CI_PIPELINE_IID $CI_REGISTRY_IMAGE:latest
    - docker push $CI_REGISTRY_IMAGE:latest
    - docker push $CI_REGISTRY_IMAGE:$CI_PIPELINE_IID
deploy:
  stage: deploy
  variables:
    KUBECONFIG: /kubeconfig.yml
  script:
    - curl -sLo /usr/local/bin/kubectl https://storage.googleapis.com/kubernetes-release/release/v1.12.2/bin/linux/amd64/kubectl
    - chmod +x /usr/local/bin/kubectl
    - mkdir ~/.kube/
    - echo $KUBE_CONFIG | base64 -d > $KUBECONFIG
    - kubectl config view
    - kubectl config set-credentials gitlab --token=$KUBE_TOKEN
    - kubectl -n builds set image deployment/builds builds=$CI_REGISTRY_IMAGE:$CI_PIPELINE_IID
    - kubectl -n builds rollout status --timeout 60s deploy/builds || (kubectl -n builds rollout undo deploy/builds && false)
  only:
    refs:
      - master

# EVERYTHING BELOW HERE CAN BE IGNORED
# DO NOT TOUCH ANYTHING BELOW THIS LINE
dependency_scanning:
  stage: test
  image: docker:stable
  variables:
    DOCKER_DRIVER: overlay2
  allow_failure: true
  services:
    - docker:stable-dind
  script:
    - export SP_VERSION=$(echo "$CI_SERVER_VERSION" | sed 's/^\([0-9]*\)\.\([0-9]*\).*/\1-\2-stable/')
    - docker run
        --env DEP_SCAN_DISABLE_REMOTE_CHECKS="${DEP_SCAN_DISABLE_REMOTE_CHECKS:-false}"
        --volume "$PWD:/code"
        --volume /var/run/docker.sock:/var/run/docker.sock
        "registry.gitlab.com/gitlab-org/security-products/dependency-scanning:$SP_VERSION" /code
  artifacts:
    reports:
      dependency_scanning: gl-dependency-scanning-report.json
sast:
  stage: test
  image: docker:stable
  variables:
    DOCKER_DRIVER: overlay2
  allow_failure: true
  services:
    - docker:stable-dind
  script:
    - export SP_VERSION=$(echo "$CI_SERVER_VERSION" | sed 's/^\([0-9]*\)\.\([0-9]*\).*/\1-\2-stable/')
    - docker run
        --env SAST_CONFIDENCE_LEVEL="${SAST_CONFIDENCE_LEVEL:-3}"
        --volume "$PWD:/code"
        --volume /var/run/docker.sock:/var/run/docker.sock
        "registry.gitlab.com/gitlab-org/security-products/sast:$SP_VERSION" /app/bin/run /code
  artifacts:
    reports:
      sast: gl-sast-report