stages:
  - test
  - build
  - push

.docker_login: &docker_login
  - echo -n $CI_JOB_TOKEN | docker login -u gitlab-ci-token --password-stdin $CI_REGISTRY


variables:
  DOCKER_BUILDKIT: 1
  DOCKER_TLS_CERTDIR: "/certs"

include:
  - template: Security/SAST.gitlab-ci.yml
  - template: Security/Container-Scanning.gitlab-ci.yml
  - template: Security/Secret-Detection.gitlab-ci.yml
  #  - template: Code-Quality.gitlab-ci.yml

unit-test:
  variables:
    NODE_ENV: test
  image: node:18-alpine3.18
  ####
  stage: test
  retry: 1
  timeout: 5m
  coverage: /All files[^|]*\|[^|]*\s+([\d\.]+)/
  before_script:
    - npm ci
  script:
    - npm test
  artifacts:
    reports:
      coverage_report:
        path: coverage/cobertura-coverage.xml
        coverage_format: cobertura
      junit:
        - test-results.xml


Build:
  image: docker:20
  services:
    - name: docker:20-dind
  stage: build
  retry: 2
  needs:
    - unit-test
  before_script:
    - *docker_login
  script:
    - "docker -v"
    #builder
    - docker build --build-arg BUILDKIT_INLINE_CACHE=1 --cache-from $CI_REGISTRY_IMAGE/builder:latest --target builder -t $CI_REGISTRY_IMAGE/builder:latest .
    #final image
    - docker build --build-arg APP_VERSION=$CI_COMMIT_SHORT_SHA --build-arg BUILDKIT_INLINE_CACHE=1 --cache-from $CI_REGISTRY_IMAGE/builder:latest --cache-from $CI_REGISTRY_IMAGE:latest -t $CI_REGISTRY_IMAGE:$CI_COMMIT_SHA .
    # push both
    - docker push $CI_REGISTRY_IMAGE/builder:latest
    - docker push $CI_REGISTRY_IMAGE:$CI_COMMIT_SHA

container_scanning:
  stage: push
  needs:
    - Build


Push latest:
  image: docker:20
  services:
    - name: docker:20-dind
  variables:
    GIT_STRATEGY: none
  stage: push
  needs:
    - Build
  rules:
    - if: $CI_COMMIT_REF_NAME == $CI_DEFAULT_BRANCH
  before_script:
    - *docker_login
  script:
    - docker pull $CI_REGISTRY_IMAGE:$CI_COMMIT_SHA
    - docker tag $CI_REGISTRY_IMAGE:$CI_COMMIT_SHA $CI_REGISTRY_IMAGE:latest
    - docker push $CI_REGISTRY_IMAGE:latest

Push tag:
  image: docker:20
  services:
    - name: docker:20-dind
  variables:
    GIT_STRATEGY: none
  stage: push
  needs:
    - Build
  only:
    - tags
  before_script:
    - *docker_login
  script:
    - docker pull $CI_REGISTRY_IMAGE:$CI_COMMIT_SHA
    - docker tag $CI_REGISTRY_IMAGE:$CI_COMMIT_SHA $CI_REGISTRY_IMAGE:$CI_COMMIT_REF_NAME
    - docker push $CI_REGISTRY_IMAGE:$CI_COMMIT_REF_NAME