.gitlab-ci.yml

---
image: docker:latest
services:
  - docker:dind

stages:
  - build
  - publish

variables:
  CINC_BUILD: "false"
  DOCKER_DRIVER: overlay2
  DOCKER_TLS_CERTDIR: "/certs"
  DOCKER_TLS_VERIFY: 1
  DOCKER_CERT_PATH: "/certs/client"
  BUILDER_NAME: "${CI_PROJECT_NAMESPACE}-${CI_PROJECT_NAME}-${CI_PIPELINE_ID}-${CI_JOB_NAME_SLUG}"

workflow:
  rules:
    # Run if we trigger a pipeline from the web
    - if: $CI_PIPELINE_SOURCE == "web" && $CINC_BUILD != "false"
    # Run if this is a merge request
    - if: $CI_MERGE_REQUEST_ID

.build_setup: &build_setup
  - eval $(ssh-agent -s)
  - echo "${BUILDX_SSH_PRIVATE_KEY}" | tr -d '\r' | ssh-add -q - > /dev/null
  - mkdir -p ~/.ssh
  - chmod 700 ~/.ssh
  - echo "${BUILDX_SSH_KNOWN_HOSTS}" > ~/.ssh/known_hosts
  - chmod 644 ~/.ssh/known_hosts
  - docker context create amd64
  - docker context use amd64
  - docker buildx create --name $BUILDER_NAME --use amd64 --platform linux/amd64 --config buildkitd.toml

.build_teardown: &build_teardown
  - docker buildx ls --no-trunc
  - docker buildx stop $BUILDER_NAME
  - docker buildx rm -f $BUILDER_NAME

.build:
  stage: build
  tags:
    - docker-x86_64

.build_arm64: &build_arm64
  - docker context create arm64 --docker "host=ssh://${BUILDX_ARM64}"
  - docker buildx create --name $BUILDER_NAME --append arm64 --platform linux/arm64 --config buildkitd.toml

.build_arm64_82a: &build_arm64_82a
  - docker context create arm64-82a --docker "host=ssh://${BUILDX_ARM64_v8_2A}"
  - docker buildx create --name $BUILDER_NAME --append arm64-82a --platform linux/arm64/v8 --config buildkitd.toml

.build_ppc64le: &build_ppc64le
  - docker context create ppc64le --docker "host=ssh://${BUILDX_PPC64LE}"
  - docker buildx create --name $BUILDER_NAME --append ppc64le --platform linux/ppc64le --config buildkitd.toml

.build_ppc64le_p9: &build_ppc64le_p9
  - docker context create ppc64le --docker "host=ssh://${BUILDX_PPC64LE_P9}"
  - docker buildx create --name $BUILDER_NAME --append ppc64le --platform linux/ppc64le --config buildkitd.toml

.build_riscv64: &build_riscv64
  - docker context create riscv64 --docker "host=ssh://${BUILDX_RISCV64}"
  - docker buildx create --name $BUILDER_NAME --append riscv64 --platform linux/riscv64 --config buildkitd.toml

.build_riscv64: &build_riscv64_2
  - docker context create riscv64 --docker "host=ssh://${BUILDX_RISCV64_2}"
  - docker buildx create --name $BUILDER_NAME --append riscv64 --platform linux/riscv64 --config buildkitd.toml

.build_s390x: &build_s390x
  - docker context create s390x --docker "host=ssh://${BUILDX_S390X}"
  - docker buildx create --name $BUILDER_NAME --append s390x --platform linux/s390x --config buildkitd.toml

.omnibus-almalinux_rules:
  rules:
    - if: $CI_PIPELINE_SOURCE == "merge_request_event"
      changes:
        - omnibus-almalinux/*
    - if: $CINC_BUILD =~ /omnibus-almalinux|^omnibus$|all/

.omnibus-amazonlinux_rules:
  rules:
    - if: $CI_PIPELINE_SOURCE == "merge_request_event"
      changes:
        - omnibus-amazonlinux/*
    - if: $CINC_BUILD =~ /omnibus-amazonlinux|^omnibus$|all/

.omnibus-debian_rules:
  rules:
    - if: $CI_PIPELINE_SOURCE == "merge_request_event"
      changes:
        - omnibus-debian/*
    - if: $CINC_BUILD =~ /omnibus-debian|^omnibus$|all/

.omnibus-opensuse_rules:
  rules:
    - if: $CI_PIPELINE_SOURCE == "merge_request_event"
      changes:
        - omnibus-opensuse/*
    - if: $CINC_BUILD =~ /omnibus-opensuse|^omnibus$|all/

.omnibus-rockylinux_rules:
  rules:
    - if: $CI_PIPELINE_SOURCE == "merge_request_event"
      changes:
        - omnibus-rockylinux/*
    - if: $CINC_BUILD =~ /omnibus-rockylinux|^omnibus$|all/

.omnibus-ubuntu_rules:
  rules:
    - if: $CI_PIPELINE_SOURCE == "merge_request_event"
      changes:
        - omnibus-ubuntu/*
    - if: $CINC_BUILD =~ /omnibus-ubuntu|^omnibus$|all/

.docker-auditor_rules:
  rules:
    - if: $CI_PIPELINE_SOURCE == "merge_request_event"
      changes:
        - docker-auditor/*
    - if: $CINC_BUILD =~ /docker-auditor|all/

.vagrant-virtualbox_rules:
  rules:
    - if: $CI_PIPELINE_SOURCE == "merge_request_event"
      changes:
        - vagrant-virtualbox/*
    - if: $CINC_BUILD =~ /vagrant-virtualbox|all/

.build_rules:
  rules:
    - if: $CI_COMMIT_REF_NAME == "master"
      when: never

build:omnibus-almalinux:
  extends:
    - .build
  tags:
    - docker-x86_64-v3
  rules:
    - !reference [.build_rules, rules]
    - !reference [.omnibus-almalinux_rules, rules]
  before_script:
    - *build_setup
    - *build_arm64
    - *build_ppc64le_p9
    - *build_s390x
  script:
    - cd omnibus-almalinux
    - docker buildx bake --set="*.output=type=cacheonly"
    - *build_teardown

build:omnibus-amazonlinux:
  extends:
    - .build
  rules:
    - !reference [.build_rules, rules]
    - !reference [.omnibus-amazonlinux_rules, rules]
  before_script:
    - *build_setup
    - *build_arm64_82a
  script:
    - cd omnibus-amazonlinux
    - docker buildx bake --set="*.output=type=cacheonly"
    - *build_teardown

build:omnibus-debian:
  extends:
    - .build
  rules:
    - !reference [.build_rules, rules]
    - !reference [.omnibus-debian_rules, rules]
  before_script:
    - *build_setup
    - *build_arm64
    - *build_riscv64
  script:
    - cd omnibus-debian
    - docker buildx bake --set="*.output=type=cacheonly"
    - *build_teardown

build:omnibus-opensuse:
  extends:
    - .build
  rules:
    - !reference [.build_rules, rules]
    - !reference [.omnibus-opensuse_rules, rules]
  before_script:
    - *build_setup
    - *build_arm64
  script:
    - cd omnibus-opensuse
    - docker buildx bake --set="*.output=type=cacheonly"
    - *build_teardown

build:omnibus-rockylinux:
  extends:
    - .build
  rules:
    - !reference [.build_rules, rules]
    - !reference [.omnibus-rockylinux_rules, rules]
  before_script:
    - *build_setup
    - *build_arm64
  script:
    - cd omnibus-rockylinux
    - docker buildx bake --set="*.output=type=cacheonly"
    - *build_teardown

build:omnibus-ubuntu:
  extends:
    - .build
  rules:
    - !reference [.build_rules, rules]
    - !reference [.omnibus-ubuntu_rules, rules]
  before_script:
    - *build_setup
    - *build_arm64
    - *build_riscv64_2
  script:
    - cd omnibus-ubuntu
    - docker buildx bake --set="*.output=type=cacheonly"
    - *build_teardown

build:docker-auditor:
  extends:
    - .build
  rules:
    - !reference [.build_rules, rules]
    - !reference [.docker-auditor_rules, rules]
  before_script:
    - *build_setup
    - *build_arm64
    - *build_ppc64le_p9
    - *build_s390x
  script:
    - cd docker-auditor
    - docker buildx bake --set="*.output=type=cacheonly"
    - *build_teardown

build:vagrant-virtualbox:
  extends:
    - .build
  tags:
    - docker-virtualbox
  rules:
    - !reference [.build_rules, rules]
    - !reference [.vagrant-virtualbox_rules, rules]
  before_script:
    - *build_setup
  script:
    - cd vagrant-virtualbox
    - docker buildx bake --set="*.output=type=cacheonly"
    - *build_teardown

.publish:
  stage: publish
  tags:
    - docker-x86_64

.publish_rules:
  rules:
    - if: $CI_COMMIT_REF_NAME != "master"
      when: never

publish:omnibus-almalinux:
  extends:
    - .publish
  tags:
    - docker-x86_64-v3
  rules:
    - !reference [.publish_rules, rules]
    - !reference [.omnibus-almalinux_rules, rules]
  before_script:
    - *build_setup
    - *build_arm64
    - *build_ppc64le_p9
    - *build_s390x
  script:
    - ./scripts/docker-login.sh
    - cd omnibus-almalinux
    - docker buildx bake --push
    - *build_teardown

publish:omnibus-amazonlinux:
  extends:
    - .publish
  rules:
    - !reference [.publish_rules, rules]
    - !reference [.omnibus-amazonlinux_rules, rules]
  before_script:
    - *build_setup
    - *build_arm64_82a
  script:
    - ./scripts/docker-login.sh
    - cd omnibus-amazonlinux
    - docker buildx bake --push
    - *build_teardown

publish:omnibus-debian:
  extends:
    - .publish
  rules:
    - !reference [.publish_rules, rules]
    - !reference [.omnibus-debian_rules, rules]
  before_script:
    - *build_setup
    - *build_arm64
    - *build_riscv64
  script:
    - ./scripts/docker-login.sh
    - cd omnibus-debian
    - docker buildx bake --push
    - *build_teardown

publish:omnibus-opensuse:
  extends:
    - .publish
  rules:
    - !reference [.publish_rules, rules]
    - !reference [.omnibus-opensuse_rules, rules]
  before_script:
    - *build_setup
    - *build_arm64
  script:
    - ./scripts/docker-login.sh
    - cd omnibus-opensuse
    - docker buildx bake --push
    - *build_teardown

publish:omnibus-rockylinux:
  extends:
    - .publish
  rules:
    - !reference [.publish_rules, rules]
    - !reference [.omnibus-rockylinux_rules, rules]
  before_script:
    - *build_setup
    - *build_arm64
  script:
    - ./scripts/docker-login.sh
    - cd omnibus-rockylinux
    - docker buildx bake --push
    - *build_teardown

publish:omnibus-ubuntu:
  extends:
    - .publish
  rules:
    - !reference [.publish_rules, rules]
    - !reference [.omnibus-ubuntu_rules, rules]
  before_script:
    - *build_setup
    - *build_arm64
    - *build_riscv64_2
  script:
    - ./scripts/docker-login.sh
    - cd omnibus-ubuntu
    - docker buildx bake --push
    - *build_teardown

publish:docker-auditor:
  extends:
    - .publish
  rules:
    - !reference [.publish_rules, rules]
    - !reference [.docker-auditor_rules, rules]
  before_script:
    - *build_setup
    - *build_arm64
    - *build_ppc64le_p9
    - *build_s390x
  script:
    - ./scripts/docker-login.sh
    - cd docker-auditor
    - docker buildx bake --push
    - *build_teardown

publish:vagrant-virtualbox:
  extends:
    - .publish
  rules:
    - !reference [.publish_rules, rules]
    - !reference [.vagrant-virtualbox_rules, rules]
  before_script:
    - *build_setup
  script:
    - ./scripts/docker-login.sh
    - cd vagrant-virtualbox
    - docker buildx bake --push
    - *build_teardown