.gitlab-ci.yml

include:
  - project: 'prodsec/scp-scanning/gitlab-checkmarx'
    ref: latest
    file: '/templates/.sast_scan.yml'
  - project: 'ci-cd/templates'
    ref: master
    file: '/prodsec/.oss-scan.yml'

image:
  name: "docker.repo.splunkdev.net/ci-cd/ci-container/maven-3.8-jdk-17:1.15.0"

stages:
  - build
  - verify
  - release
  - post-release

build:
  stage: build
  script:
    - ./gradlew build -x :smoke-tests:test --scan --no-daemon --stacktrace

sast-scan:
  stage: verify
  rules:
    - if: '$CI_COMMIT_REF_NAME == "main"'
  extends: .sast_scan
  variables:
    SAST_SCANNER: "Semgrep"
    # Fail build on high severity security vulnerabilities
    alert_mode: "policy"

oss-scan:
  stage: verify
  rules:
    - if: '$CI_COMMIT_REF_NAME == "main"'
  extends: .oss-scan
  tags: []

snapshot:
  stage: release
  rules:
    - if: '$CI_COMMIT_REF_NAME == "main"'
  script:
    - ./gradlew assemble publishToSonatype --no-daemon --stacktrace

release:
  stage: release
  artifacts:
    when: always
    paths:
      - dist/
  rules:
    - if: '$CI_COMMIT_TAG =~ /^v[0-9]+\.[0-9]+\.[0-9]+(-alpha)?.*/'
  before_script:
    - ./scripts/install-gh-deps.sh
  script:
    - ./scripts/release.sh "$CI_COMMIT_TAG"

publish-docker-image:
  stage: post-release
  rules:
    - if: '$CI_COMMIT_TAG =~ /^v[0-9]+\.[0-9]+\.[0-9]+(-alpha)?.*/'
  before_script:
    - ./scripts/install-docker-deps.sh
    - ./scripts/install-gh-deps.sh
  script:
    - ./scripts/publish-docker-image.sh "$CI_COMMIT_TAG"

propagate-version:
  stage: post-release
  rules:
    - if: '$CI_COMMIT_TAG =~ /^v[0-9]+\.[0-9]+\.[0-9]+(-alpha)?.*/'
  before_script:
    - ./scripts/install-gh-deps.sh
  script:
    - ./scripts/propagate-version.sh "$CI_COMMIT_TAG"