.gitlab-ci.yml

############################# Helper Anchors ##################################

.use_github_repo: &use_github_repo |
        eval $(ssh-agent -s)
        ssh-add ~/.ssh/${GITHUB_HOST}

        ORIGIN="git@${GITHUB_HOST}:${GITHUB_NAME}/${CI_PROJECT_NAME}.git"
        git config --global user.name  ${GITHUB_NAME}
        git config --global user.email ${GITHUB_EMAIL}
        git remote rm origin
        git remote add origin ${ORIGIN}

.use_gitlab_repo: &use_gitlab_repo |
        eval $(ssh-agent -s)
        ssh-add ~/.ssh/${GITLAB_HOST}

        ORIGIN="git@${GITLAB_HOST}:${GITLAB_NAME}/${CI_PROJECT_NAME}.git"
        git config --global user.name  ${GITLAB_NAME}
        git config --global user.email ${GITLAB_EMAIL}
        git remote rm origin
        git remote add origin ${ORIGIN}

################################# Set Up ######################################

variables:
    GIT_STRATEGY: clone

    GITLAB_NAME: "chuck"
    GITLAB_EMAIL: "chuck@gitlab.mothership"
    GITLAB_HOST: "gitlab.mothership"

    GITHUB_NAME: "chuckorde"
    GITHUB_EMAIL: "chuckorde@gmail.com"
    GITHUB_HOST: "github.com"

before_script:
    - apt-get update -yqq
    - apt-get -qy install ssh git curl zip > /dev/null
    - umask 077

    - mkdir -p ~/.ssh
    - echo "${GITLAB_SSH_PRIVATE_KEY}" > ~/.ssh/${GITLAB_HOST}
    - ssh-keyscan -H ${GITLAB_HOST}  > ~/.ssh/known_hosts
    - echo "${GITHUB_SSH_PRIVATE_KEY}" > ~/.ssh/${GITHUB_HOST}
    - ssh-keyscan -H ${GITHUB_HOST} >> ~/.ssh/known_hosts

stages:
    - test
    - package
    - publish

############################ Branchs Dev / Master  ############################

Unit Test:
    stage: test

    tags:
        - python

    script:
        - pip3 install -e .
        - python3 tests.py

    only:
        - dev
        - master

SCA Test: # run SCA on any branch
    stage: test

    tags:
        - python

    script:
        - curl -sSL https://download.sourceclear.com/ci.sh | bash

    only:
        - dev
        - master

# SAST Sandbox Test: # this only runs on the dev branch, so run a Sandbox scan
#     stage: test
#
#     tags:
#         - python
#
#     script:
#         - zip project.zip
#           setup.* LICENSE.txt -r $(echo ${CI_PROJECT_NAME} | cut -d'-' -f1)
#         - pip3 install veracode-python
#
#         - veracode app scan
#             --app="${CI_PROJECT_NAME}"
#             --name="$(date) - ${CI_COMMIT_SHORT_SHA}"
#             --sandbox='Development Build'
#             --files='project.zip'
#             --timeout=30
#
    only:
        - dev

############################## Master Only ####################################

# SAST Policy Test: # this is on master so run a SAST policy scan
#     stage: test
#
#     tags:
#         - python
#
#     script:
#         - zip project.zip
#           setup.* LICENSE.txt -r $(echo ${CI_PROJECT_NAME} | cut -d'-' -f1)
#         - pip3 install veracode-python
#
#         - veracode app scan
#             --app="${CI_PROJECT_NAME}"
#             --name="$(date) - ${CI_COMMIT_SHORT_SHA}"
#             --files='project.zip'
#             --timeout=30
#
#     only:
#         - master

Create Release: # increment version and create release tag
    stage: package
    tags:
        - python

    script:
        - *use_gitlab_repo
        - git pull origin master
        - git checkout master
        - export RELEASE=$(git log -1 --pretty='format:%B' | cut -d':' -f1)
        - export VERSION=$(python3 setup.py -q version --increment ${RELEASE})
        - echo "Creating ${RELEASE} ${VERSION}"

        - git add -u
        - git commit -m "Release v${VERSION} [skip ci]"
        - git push origin master
        - git tag -a v${VERSION} -m "Release ${VERSION}"
        - git push origin v${VERSION}

    only:
        - master

Mirror to Github: # mirror Github and use API to create release
    stage: publish
    tags:
        - python

    script:
        - *use_gitlab_repo
        - git pull origin master
        - git checkout master
        - echo "Packaging version $(python3 setup.py -q version)"

        - *use_github_repo
        - git push -u origin master --force
        - pip3 install requests # needed for github release
        - python3 setup.py github --create-release ${GITHUB_API_TOKEN}

    only:
        - master

Publish to PyPi: # publish on PyPi
    stage: publish
    tags:
        - python

    script:
        - *use_gitlab_repo
        - git pull origin master
        - git checkout master

        - rm -rf dist
        - pip3 install twine
        - python3 setup.py sdist
        - twine upload -u ${TWINE_USERNAME} -p ${TWINE_PASSWORD} dist/*

    only:
        - master