.gitlab-ci.yml

image: registry.gitlab.com/testifysec/spire/builder:v0.0.2
stages:
  - clone
  - deps
  - build
  - verify
  - upload
  - release
variables:
  GIT_STRATEGY: none
clone:
  stage: clone
  script:
    - witness run -s clone -a gitlab -a gcp-iit --spiffe-socket=unix:///run/spire/sockets/agent.sock -r https://log.testifysec.io -o /dev/null -- bash -c \
      "git clone ${CI_REPOSITORY_URL} . && git reset --hard ${CI_COMMIT_SHA}"
    - git rev-parse --verify HEAD > commithash
    - witness -c ./witness/.witness-ci.yaml verify -p ./witness/ci-gate-policy.signed.json -f commithash
  artifacts:
    exclude:
      - commithash
    paths:
      - ./*

deps:
  stage: deps
  dependencies:
    - "clone"
  script: 
    - witness -c ./witness/.witness-ci.yaml run -s deps -- /bin/sh -c "go mod vendor"
  artifacts:
    exclude:
      - .git
    paths:
      - ./*
      - ./vendor/*

# Build the binaries
build-server:
  stage: build
  dependencies:
    - "deps"
  script:
    - witness run -s build -c witness/.witness-ci.yaml -o /dev/null -- bash -c "go build  -ldflags '-s -w -X github.com/spiffe/spire/pkg/common/version.githash='${CI_COMMIT_SHORT_SHA} -o bin/spire-server ./cmd/spire-server"
  artifacts:
    paths:
      - ./bin/*
      - ./witness/.witness-ci.yaml
      - ./witness/artifact-policy.signed.json
      - ./witness/testpub.pem

build-agent:
  stage: build
  dependencies:
    - "deps"
  script:
    - witness run -s build -c witness/.witness-ci.yaml -o /dev/null -- bash -c "go build  -ldflags '-s -w -X github.com/spiffe/spire/pkg/common/version.githash='${CI_COMMIT_SHORT_SHA} -o bin/spire-agent ./cmd/spire-agent"
  artifacts:
    paths:
      - ./bin/*

build-k8s-workload-registrar:
  stage: build
  dependencies:
    - "deps"
  script:
    - witness run -s build -c witness/.witness-ci.yaml -o /dev/null -- bash -c "go build  -ldflags '-s -w -X github.com/spiffe/spire/pkg/common/version.githash='${CI_COMMIT_SHORT_SHA} -o bin/k8s-workload-registrar ./support/k8s/k8s-workload-registrar"
  artifacts:
    paths:
      - ./bin/*

build-oidc-discovery-provider:
  stage: build
  dependencies:
    - "deps"
  script:
    - witness run -s build -c witness/.witness-ci.yaml -o /dev/null -- bash -c "go build  -ldflags '-s -w -X github.com/spiffe/spire/pkg/common/version.githash='${CI_COMMIT_SHORT_SHA} -o bin/oidc-discovery-provider ./support/oidc-discovery-provider"
  artifacts:
    paths:
      - ./bin/*

verify:
  dependencies:
    - "build-server"
    - "build-agent"
    - "build-k8s-workload-registrar"
    - "build-oidc-discovery-provider"
  stage: verify
  script:
    - for i in $(ls -1 ./bin/*); do witness -c ./witness/.witness-ci.yaml verify -p ./witness/artifact-policy.signed.json -f $i; done
  artifacts:
    paths:
      - ./bin/*
      - ./witness/artifact-policy.signed.json
      - ./witness/testpub.pem

upload:
  stage: upload
  image: curlimages/curl:latest
  rules:
    - if: $CI_COMMIT_TAG
  script:
    - |
      curl --header "JOB-TOKEN: ${CI_JOB_TOKEN}" --upload-file bin/spire-agent ${PACKAGE_REGISTRY_URL}/spire-agent/${CI_COMMIT_TAG}/bin/spire-agent

release:
  stage: release
  image: registry.gitlab.com/gitlab-org/release-cli:latest
  script:
      - |
        release-cli create --name "Release $CI_COMMIT_TAG" --tag-name $CI_COMMIT_TAG \
          --assets-link "{\"name\":\"spire-agent",\"url\":\"${PACKAGE_REGISTRY_URL}/spire-agent/${CI_COMMIT_TAG}/bin/spire-agent" \