.gitlab-ci.yml

include:
  - project: jitesoft/gitlab-ci-lib
    file: Scan/trivy.yml
  - project: jitesoft/gitlab-ci-lib
    file: OCI/sign.yml

stages:
  - pre
  - download
  - build
  - containerize
  - sign
  - scan

gpg:import:
  stage: pre
  rules:
    - if: "$REKEY"
      when: always
    - changes:
        - gpg.txt
    - when: never
  image: registry.gitlab.com/jitesoft/dockerfiles/misc:latest
  script:
    - |
      if [ "$(cat gpg-old.txt)" != "$(cat gpg.txt)" ]; then
        for key in `cat gpg.txt`; do
          gpg --list-keys ${key} || (
            gpg --keyserver pgp.mit.edu --recv-keys "${key}" ||
            gpg --keyserver keyserver.pgp.com --recv-keys "${key}" ||
            gpg --keyserver keyserver.ubuntu.com --recv-keys "${key}" ||
            gpg --keyserver ha.pool.sks-keyservers.net --recv-keys "${key}"
          ) || echo "Failed to find key for id ${key}"
        done
        gpg --export > keys.out
      fi
    - cp gpg.txt gpg-old.txt
  cache:
    policy: pull-push
    when: on_success
    key: httpd.gpg.keyring
    paths:
      - keys.out
      - gpg-old.txt

check:
  stage: pre
  variables:
    GIT_STRATEGY: none
  image: registry.gitlab.com/jitesoft/dockerfiles/misc:latest
  rules:
    - if: '$CI_PIPELINE_SOURCE == "schedule"'
      when: always
    - if: '$CI_PIPELINE_SOURCE == "web"'
      when: always
    - when: never
  script:
    - LATEST=$(wget -qO - https://apache.org/dist/httpd/ | grep -oP '(?<=\<a href=\"httpd-)([0-9]{0,2}(\.?){2}){2}([0-9]{0,2})' | awk '{print $1}' | uniq | sort -V -r | awk 'NR==1{print $1}')
    - echo "Latest ${LATEST}"
    - touch version.txt
    - |
      if [ "${LATEST}" != "$(cat version.txt)" ] || [ -n "${FORCE_BUILD}" ] ; then
        curl -F token=${CI_JOB_TOKEN} -F ref=master -F "variables[VERSION]=${LATEST}" -F "variables[BUILD]=true" https://gitlab.com/api/v4/projects/${CI_PROJECT_ID}/trigger/pipeline
      else
        curl -F token=${CI_JOB_TOKEN} -F ref=master -F "variables[VERSION]=${LATEST}" -F "variables[SCAN]=true" https://gitlab.com/api/v4/projects/${CI_PROJECT_ID}/trigger/pipeline
      fi
  cache:
    policy: pull
    key: httpd.version
    paths:
      - version.txt

scan:
  extends: .container_scanning
  stage: scan
  rules:
    - if: "$SCAN"
      when: always
    - if: "$VERSION"
      when: always
    - when: never
  variables:
    GIT_STRATEGY: none
  before_script:
    - |
      if [ -n "${VERSION}" ]; then
        SCANNING_IMAGE_NAME="${CI_REGISTRY_IMAGE}:${VERSION}"
      else
        SCANNING_IMAGE_NAME="${CI_REGISTRY_IMAGE}:$(cat version.txt)"
      fi
  cache:
    policy: pull
    key: httpd.version
    paths:
      - version.txt

download:
  rules:
    - if: "$BUILD && $VERSION"
      when: always
    - when: never
  variables:
    GIT_STRATEGY: none
  image: registry.gitlab.com/jitesoft/dockerfiles/misc:latest
  stage: download
  script:
    - echo "Building apache httpd version ${VERSION}"
    - wget https://apache.org/dist/httpd/httpd-${VERSION}.tar.gz -O httpd-${VERSION}.tar.gz
    - wget https://apache.org/dist/httpd/httpd-${VERSION}.tar.gz.sha256 -O httpd-${VERSION}.tar.gz.sha256
    - wget https://apache.org/dist/httpd/httpd-${VERSION}.tar.gz.asc -O httpd-${VERSION}.tar.gz.asc
    - gpg --import keys.out
    - gpg --verify httpd-${VERSION}.tar.gz.asc httpd-${VERSION}.tar.gz
    - mv httpd-${VERSION}.tar.gz httpd.tar.gz
  artifacts:
    paths:
      - httpd.tar.gz
    expire_in: 1 day
  cache:
    policy: pull
    key: httpd.gpg.keyring
    paths:
      - keys.out

build:
  parallel:
    matrix:
      - { ARCH: "arm64", GIT_STRATEGY: none }
      - { ARCH: "amd64", GIT_STRATEGY: none }
  rules:
    - if: "$BUILD && $VERSION"
      when: on_success
    - when: never
  stage: build
  needs:
    - download
  image: registry.gitlab.com/jitesoft/dockerfiles/misc/buildbase:latest
  before_script:
    - export CCACHE_DIR="${CI_PROJECT_DIR}/ccache"
    - apk add --no-cache ccache perl apr-util-ldap libxml2-dev tar apr-dev pcre-dev build-base gcc apr-util-dev lua-dev nghttp2-dev curl-dev openssl-dev jansson-dev brotli-dev zlib-dev libc-dev dpkg-dev
    - mkdir out src
    - export PATH="/usr/lib/ccache/bin:$PATH"
    - if [ ! -d "ccache" ]; then mkdir ccache; fi
  script:
    - tar -xzhf httpd.tar.gz -C src --strip-components=1
    - cd src
    - ./configure --prefix=/usr/local/apache2 --build=$(cat /etc/apk/arch)-linux-musl --enable-mods-shared=reallyall --enable-mpms-shared=all
    - make -j4
    - make install
    - rm -r /usr/local/apache2/man /usr/local/apache2/manual
    - cd ..
    - ccache -s
    - $(cd /usr/local/apache2 && tar -czf /tmp/httpd.tar.gz *)
    - mv /tmp/httpd.tar.gz out/httpd-${ARCH}.tar.gz
  artifacts:
    paths:
      - out
    expire_in: 1 day
  cache:
    paths:
      - ccache
    key: apache-httpd.build.ccache-${ARCH}
  tags: [ "native-${ARCH}" ]

containerize:
  rules:
    - if: "$BUILD && $VERSION"
      when: on_success
    - when: never
  stage: containerize
  image: registry.gitlab.com/jitesoft/dockerfiles/misc:latest
  needs:
    - job: build
      artifacts: true
  script:
    - cp entrypoint out/
    - cp healthcheck out/
    - TAGS=$(helper "ghcr.io/jitesoft/httpd,${CI_REGISTRY_IMAGE},jitesoft/httpd,quay.io/jitesoft/httpd" "${VERSION},latest,$(echo ${VERSION} | cut -d'.' -f1,2)")
    - docker buildx build --platform linux/arm64,linux/amd64 --progress plain --push ${TAGS} --build-arg BUILD_TIME="$(date -Iseconds)" --build-arg VERSION=${VERSION} .
    - echo "SIGN_TAGS=${VERSION},latest,$(echo ${VERSION})" > sign.env
  tags: [ buildx, protected ]
  artifacts:
    reports:
      dotenv: sign.env

sign:
  needs:
    - job: containerize
      artifacts: true
  extends: .sign
  tags: [ jitesoft, protected, buildx ]
  stage: sign
  variables:
    COSIGN_ANNOTATIONS: "-a sig=jitesoft-bot"
    SIGN_IMAGES: "jitesoft/httpd,${CI_REGISTRY_IMAGE},ghcr.io/jitesoft/httpd"
  rules:
    - if: "$BUILD"
      when: on_success
    - when: never

create:cache:
  rules:
    - if: "$BUILD && $VERSION"
      when: on_success
    - when: never
  needs:
    - job: containerize
      artifacts: false
  stage: .post
  image: registry.gitlab.com/jitesoft/dockerfiles/misc:latest
  script:
    - echo "${VERSION}" > version.txt
  cache:
    key: httpd.version
    policy: pull-push
    paths:
      - version.txt