.gitlab-ci.yml

default:
  image: '${DOCKER_CICD_REPO}/ci-container:python-3.9'

stages:
  - update-stage-cache
  - sast-oss-scan
  - build
  - sign-packages
  - release
  - sign-metadata
  - github-release

include:
  - project: 'core-ee/signing/api-integration'
    ref: develop
    file: '/templates/.sign-client.yml'
  - project: 'ci-cd/templates'
    ref: master
    file: '/prodsec/.oss-scan.yml'

.get-artifactory-stage: &get-artifactory-stage
  - |
    set -ex
    export STAGE="test"
    if [[ "${CI_COMMIT_TAG:-}" =~ beta ]]; then
      export STAGE="beta"
    elif [[ "${CI_COMMIT_TAG:-}" =~ ^v[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
      export STAGE="release"
    fi

.trigger-filter:
  only:
    variables:
      - $CI_COMMIT_TAG =~ /^v[0-9]+\.[0-9]+\.[0-9]+$/
  except:
    - schedules

.sign-release-cache:
  retry: 2
  variables:
    PIP_CACHE_DIR: "$CI_PROJECT_DIR/.cache/pip"
  cache:
    key:
      files:
        - scripts/signing/requirements.txt
    paths:
      - .cache/pip
  before_script:
    - pip3 install -r scripts/signing/requirements.txt
    - *get-artifactory-stage

.aws-releaser-role: &aws-releaser-role |
  creds-helper init
  eval $(creds-helper aws --eval "aws:v1/o11y-infra/role/o11y_gdi_otel_releaser_role")

update-stage-cache:
  stage: update-stage-cache
  needs: []
  only:
    - schedules
  variables:
    PULL_CACHE: "yes"
  retry: 2
  before_script:
    - docker login -u $CIRCLECI_QUAY_USERNAME -p $CIRCLECI_QUAY_PASSWORD quay.io
  script:
    - ./scripts/docker-cache-from  # pre-pull stage cache images
    - make stage-cache

fossa:
  extends: .oss-scan
  stage: sast-oss-scan
  needs: []
  only:
    - main
    - schedules
  # allow_failure: false

win-bundle-build:
  extends: .trigger-filter
  stage: build
  needs: []
  tags:
    - windows
  variables:
    GOPATH: "C:\\Go"
    GOOS: "windows"
    GO111MODULE: "on"
  before_script:
    - choco upgrade -y golang --version 1.18.5
    - choco upgrade -y git --version 2.33.0.2
    - refreshenv
  script:
    - $env:PATH = "${env:GOPATH}\bin;C:\Program Files\Git\bin;${env:PATH}"
    - .\scripts\windows\make.ps1 bundle
  artifacts:
    paths:
      - build/SignalFxAgent-*.zip

linux-build:
  extends: .trigger-filter
  stage: build
  needs: []
  before_script:
    - *get-artifactory-stage
  script:
    - docker login -u $CIRCLECI_QUAY_USERNAME -p $CIRCLECI_QUAY_PASSWORD quay.io
    - mkdir -p dist
    - |
      set -exo pipefail
      AGENT_IMAGE_NAME="quay.io/signalfx/signalfx-agent"
      AGENT_VERSION="${CI_COMMIT_TAG#v}"
      if [[ "$STAGE" = "test" ]]; then
        AGENT_IMAGE_NAME="quay.io/signalfx/signalfx-agent-dev"
        AGENT_VERSION=$( ./scripts/current-version )
      fi
      IMAGE="${AGENT_IMAGE_NAME}:${AGENT_VERSION}"
      ./scripts/docker-cache-from  # pre-pull stage cache images
      ./scripts/release --stage $STAGE --component docker --component deb --component rpm --component bundle
      digest=$( docker inspect --format='{{.RepoDigests}}' $IMAGE | sed "s|\[.*@\(sha256:.*\)\]|\1|" )
      if [[ ! "$digest" =~ ^sha256:[A-Fa-f0-9]{64}$ ]]; then
        echo "Failed to get repo digest for $IMAGE!"
        exit 1
      fi
      echo -n "$digest" > dist/digest.txt
      docker save -o dist/image.tar $IMAGE
      mv signalfx-agent-*.tar.gz dist/
      mv packaging/deb/output/signalfx-agent_*.deb dist/
      mv packaging/rpm/output/x86_64/signalfx-agent-*.rpm dist/
  artifacts:
    paths:
      - dist

sign-deb:
  extends:
    - .trigger-filter
    - .submit-signing-request
  stage: sign-packages
  needs:
    - linux-build
  variables:
    ARTIFACT: dist/packages.tar.gz
    SIGN_TYPE: DEB
    OPTIONS: archive
    DOWNLOAD_DIR: dist/signed
  before_script:
    - pushd dist && tar -czvf packages.tar.gz *.deb && popd
  after_script:
    - tar -xzvf dist/signed/packages.tar.gz -C dist/signed/
    - rm dist/signed/packages.tar.gz
  artifacts:
    paths:
      - dist/signed/*.deb

sign-rpm:
  extends:
    - .trigger-filter
    - .submit-signing-request
  stage: sign-packages
  needs:
    - linux-build
  variables:
    ARTIFACT: dist/packages.tar.gz
    SIGN_TYPE: RPM
    OPTIONS: archive
    DOWNLOAD_DIR: dist/signed
  before_script:
    - pushd dist && tar -czvf packages.tar.gz *.rpm && popd
  after_script:
    - tar -xzvf dist/signed/packages.tar.gz -C dist/signed/
    - rm dist/signed/packages.tar.gz
  artifacts:
    paths:
      - dist/signed/*.rpm

win-bundle-sign:
  extends:
    - .trigger-filter
    - .submit-signing-request
  stage: sign-packages
  needs:
    - win-bundle-build
  variables:
    ARTIFACT: build/packages.tar.gz
    SIGN_TYPE: WIN
    OPTIONS: archive
    DOWNLOAD_DIR: build/signed
  before_script:
    - apt-get update && apt-get install -y unzip zip
    - unzip -q build/SignalFxAgent-*.zip -d build/ || true
    - pushd build/SignalFxAgent/bin && tar -czvf packages.tar.gz signalfx-agent.exe && mv packages.tar.gz ../../ && popd
  after_script:
    - tar -xzvf build/signed/packages.tar.gz -C build/signed/
    - rm build/signed/packages.tar.gz
    - mv build/signed/signalfx-agent.exe build/SignalFxAgent/bin/signalfx-agent.exe
    - pushd build && ZIPFILE=$(ls SignalFxAgent-*.zip) && rm $ZIPFILE && zip -q -r $ZIPFILE SignalFxAgent && mv $ZIPFILE signed/ && popd
    - rm -Rf build/SignalFxAgent
  artifacts:
    paths:
      - build/signed/SignalFxAgent-*.zip

win-msi-build:
  extends: .trigger-filter
  stage: sign-packages
  needs:
    - win-bundle-sign
  tags:
    - windows
  before_script:
    - choco upgrade -y wixtoolset --version 3.11.2
    - refreshenv
  script:
    - $env:PATH = "C:\Program Files (x86)\WiX Toolset v3.11\bin;${env:PATH}"
    - .\scripts\windows\make.ps1 build_msi -zipfile $( Resolve-Path .\build\signed\SignalFxAgent-*.zip )
  artifacts:
    paths:
      - build/SignalFxAgent-*.msi

win-msi-sign:
  extends:
    - .trigger-filter
    - .submit-signing-request
  stage: sign-packages
  needs:
    - win-msi-build
  variables:
    ARTIFACT: build/packages.tar.gz
    SIGN_TYPE: WIN
    OPTIONS: archive
    DOWNLOAD_DIR: build/signed
  before_script:
    - pushd build && tar -czvf packages.tar.gz *.msi && popd
  after_script:
    - tar -xzvf build/signed/packages.tar.gz -C build/signed/
    - rm build/signed/packages.tar.gz
  artifacts:
    paths:
      - build/signed/SignalFxAgent-*.msi

verify-signed-packages:
  extends: .trigger-filter
  stage: sign-packages
  needs:
    - linux-build
    - sign-deb
    - sign-rpm
    - win-bundle-build
    - win-bundle-sign
    - win-msi-build
    - win-msi-sign
  script:
    - |
      set -ex
      for pkg in build/*.zip build/*.msi dist/*.deb dist/*.rpm; do
        if [[ ! -f $(dirname $pkg)/signed/$(basename $pkg) ]]; then
          echo "$pkg was not signed!" >&2
          exit 1
        fi
      done

release-deb:
  extends:
    - .trigger-filter
    - .sign-release-cache
  stage: release
  dependencies:
    - sign-deb
  script:
    - ./scripts/signing/add_output_to_repo.py dist/signed deb $STAGE --force
  artifacts:
    paths:
      - Release

release-rpm:
  extends:
    - .trigger-filter
    - .sign-release-cache
  stage: release
  dependencies:
    - sign-rpm
  script:
    - ./scripts/signing/add_output_to_repo.py dist/signed rpm $STAGE --force
  artifacts:
    paths:
      - repomd.xml

s3-release:
  extends: .trigger-filter
  stage: release
  dependencies:
    - win-bundle-sign
    - win-msi-sign
  before_script:
    - pip install -r scripts/awscli-requirements.txt
    - *get-artifactory-stage
    - *aws-releaser-role
  script:
    - scripts/release --stage $STAGE --push --component windows --force
    - |
      # release the installer scripts
      if [[ "$STAGE" = "release" ]]; then
        aws s3 cp deployments/installer/install.sh s3://public-downloads--signalfuse-com/signalfx-agent.sh
        ./scripts/invalidate-cloudfront "/signalfx-agent.sh"
        aws s3 cp deployments/installer/install.ps1 s3://public-downloads--signalfuse-com/signalfx-agent.ps1
        ./scripts/invalidate-cloudfront "/signalfx-agent.ps1"
      fi

win-choco-release:
  extends: .trigger-filter
  stage: release
  dependencies:
    - win-msi-sign
  tags:
    - windows
  retry: 2
  before_script:
    - choco upgrade -y checksum --version 0.2.0
    - refreshenv
  script:
    - .\scripts\windows\make.ps1 build_choco -msifile $( Resolve-Path .\build\signed\SignalFxAgent-*.msi )
    - |
      # Only push the choco package for stable release tags
      if ($env:CI_COMMIT_TAG -match '^v\d+\.\d+\.\d+$') {
        choco push -k $env:CHOCO_TOKEN $( Resolve-Path .\build\signalfx-agent.*.nupkg )
      }
  artifacts:
    paths:
      - build/signalfx-agent.*.nupkg

win-docker-release:
  extends: .trigger-filter
  stage: release
  dependencies:
    - win-bundle-sign
  tags:
    - windows
  retry: 2
  before_script:
    - docker login -u $env:CIRCLECI_QUAY_USERNAME -p $env:CIRCLECI_QUAY_PASSWORD quay.io
    - Expand-Archive -Path build\signed\SignalFxAgent-*.zip -DestinationPath tmp
    - mkdir dist
    - mv tmp\SignalFxAgent\bin\signalfx-agent.exe dist\signalfx-agent.exe
    - rm -recurse -force tmp
  script:
    - |
      $ErrorActionPreference = 'Stop'
      if ($env:CI_COMMIT_TAG -match '^v\d+\.\d+\.\d+$') {
        $IMAGE_NAME = "quay.io/signalfx/signalfx-agent"
        $IMAGE_TAG = $env:CI_COMMIT_TAG.TrimStart("v") + "-windows"
      } else {
        $IMAGE_NAME = "quay.io/signalfx/signalfx-agent-dev"
        $IMAGE_TAG = $env:CI_COMMIT_SHA + "-windows"
      }
      echo "Building and pushing ${IMAGE_NAME}:${IMAGE_TAG}"
      docker build -t ${IMAGE_NAME}:${IMAGE_TAG} -f Dockerfile.windows .
      docker push ${IMAGE_NAME}:${IMAGE_TAG}
  after_script:
    - docker image prune --all --force

sign-apt-metadata:
  extends:
    - .trigger-filter
    - .submit-signing-request
  stage: sign-metadata
  needs:
    - release-deb
  variables:
    ARTIFACT: Release
    SIGN_TYPE: GPG
  after_script:
    - mv Release signed/Release
  artifacts:
    paths:
      - signed/Release
      - signed/Release.asc

sign-yum-metadata:
  extends:
    - .trigger-filter
    - .submit-signing-request
  stage: sign-metadata
  needs:
    - release-rpm
  variables:
    ARTIFACT: repomd.xml
    SIGN_TYPE: GPG
  after_script:
    - mv repomd.xml signed/repomd.xml
  artifacts:
    paths:
      - signed/repomd.xml
      - signed/repomd.xml.asc

upload-apt-signature:
  extends: .trigger-filter
  stage: sign-metadata
  needs:
    - sign-apt-metadata
  before_script:
    - *get-artifactory-stage
  script:
    - curl -u ${ARTIFACTORY_USERNAME}:${ARTIFACTORY_TOKEN} -X PUT "https://splunk.jfrog.io/artifactory/signalfx-agent-deb/dists/${STAGE}/Release.gpg" -T signed/Release.asc

upload-yum-signature:
  extends: .trigger-filter
  stage: sign-metadata
  needs:
    - sign-yum-metadata
  before_script:
    - *get-artifactory-stage
  script:
    - curl -u ${ARTIFACTORY_USERNAME}:${ARTIFACTORY_TOKEN} -X PUT "https://splunk.jfrog.io/artifactory/signalfx-agent-rpm-local/${STAGE}/repodata/repomd.xml.asc" -T signed/repomd.xml.asc

github-release:
  extends: .trigger-filter
  stage: github-release
  dependencies:
    - linux-build
    - win-bundle-sign
    - win-msi-sign
  before_script:
    # install gh cli
    - wget https://github.com/cli/cli/releases/download/v2.22.1/gh_2.22.1_linux_amd64.deb
    - dpkg -i gh_2.22.1_linux_amd64.deb
  script:
    - mkdir -p dist/assets/
    - mv dist/signalfx-agent-*.tar.gz dist/assets/
    - mv build/signed/SignalFxAgent-*.zip dist/assets/
    - mv build/signed/SignalFxAgent-*.msi dist/assets/
    - |
      # only create the github release for stable release tags
      if [[ "${CI_COMMIT_TAG:-}" =~ ^v[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
        ./scripts/create-github-release.sh "$CI_COMMIT_TAG" "$( cat dist/digest.txt )" ./dist/assets
      fi
  artifacts:
    when: always
    paths:
      - dist/assets