.gitlab-ci.yml

default:
  tags:
    - gitlab-runner

stages: 
  - auth
  - build-and-push

gcp-auth: 
  image: "google/cloud-sdk:slim"

  variables:
    WORKLOAD_IDENTITY_PROVIDER: projects/907538893452/locations/global/workloadIdentityPools/gitlab/providers/gitlab-test
    SERVICE_ACCOUNT_EMAIL: gitlab-test@gcp-test.iam.gserviceaccount.com

  id_tokens:
    GITLAB_OIDC_TOKEN:
      aud: https://iam.googleapis.com/$WORKLOAD_IDENTITY_PROVIDER
  script: 
    - |
        echo "$GITLAB_OIDC_TOKEN" > gitlab-oidc-token.txt
        gcloud iam workload-identity-pools create-cred-config $WORKLOAD_IDENTITY_PROVIDER \
        --service-account=$SERVICE_ACCOUNT_EMAIL \
        --service-account-token-lifetime-seconds=600 \
        --output-file=credentials.json \
        --credential-source-file=gitlab-oidc-token.txt
    - export GOOGLE_APPLICATION_CREDENTIALS=credentials.json
    - gcloud auth login --cred-file=credentials.json
    - gcloud auth print-access-token > access-token.txt
  stage: auth
  artifacts:
    expire_in: 10 mins
    paths:
    - access-token.txt 

docker-build-and-push:
  stage: build-and-push
  image:
    name: docker:stable
  services:
    - name: docker:dind
      command: ["--tls=false"]

  variables:
    DOCKER_HOST: tcp://docker:2375/
    REGISTRY_HOST: europe-west3-docker.pkg.dev
    # Use the overlayfs driver for improved performance:
    DOCKER_DRIVER: overlay2
    DOCKER_TLS_CERTDIR: ""

  before_script:
    # Login to Google Cloud Registry
    - cat access-token.txt | docker login -u oauth2accesstoken --password-stdin https://$REGISTRY_HOST

  script:
    - docker build -t $REGISTRY_HOST/gcp-test/images/test-image:latest .
    - docker push $REGISTRY_HOST/gcp-test/images/test-image:latest