.gitlab-ci.yml

---
workflow:
  rules:
    - if: $CI_MERGE_REQUEST_ID
      when: never
    - if: '$CI_PIPELINE_SOURCE == "merge_request_event"'
      when: always
    - if: '$CI_PIPELINE_SOURCE == "push"'
      when: always
    - if: '$CI_PIPELINE_SOURCE =~ /^trigger|pipeline|web|api$/'
      when: always
    - if: $CI_COMMIT_TAG
      when: never
    - when: always


include:
  - template: Security/SAST.gitlab-ci.yml
  - template: Dependency-Scanning.gitlab-ci.yml
  - template: Security/License-Scanning.gitlab-ci.yml
  - template: Security/Secret-Detection.gitlab-ci.yml
  # - template: Security/Container-Scanning.gitlab-ci.yml

  - local: 'ci/semantic-release.yml'
  - local: 'ci/check.yml'
  - local: 'ci/docker.yml'
  - local: 'ci/pages.yml'

# Global SAST Variables

variables:
  SAST_EXCLUDED_PATHS: "spec,test,tests,tmp,node_modules,target,venv"
  SAST_BANDIT_EXCLUDED_PATHS: "*/test/**,*/tests/**,*/node_modules/**,*/target/**,*/venv/**"
  SECRET_DETECTION_EXCLUDED_PATHS: "docs"
  PYTHON_IMAGE: "python"
  PYTHON_TAG: "3.10"

  DOCKER_DRIVER: overlay2
  DOCKER_BUILDKIT: 1
  DOCKER_IMAGE: docker.io/library/docker
  DOCKER_TAG: "20.10.16"


  ## Semantic Release
  ENABLE_SEMANTIC_RELEASE: "true"
  ENABLE_SEMANTIC_RELEASE_DRY_RUN: "true"

stages:
  - test
  - build
  - docs
  - deploy
  - publish

.base-python:
  image: $PYTHON_IMAGE:$PYTHON_TAG
  before_script:
    - pip install poetry
    - poetry lock
    - poetry install




sbom: 
  stage: docs 
  image: $PYTHON_IMAGE:$PYTHON_TAG
  script:
    - pip install cyclonedx-bom
    - rm sbom.json
    - cyclonedx-py --poetry -o sbom.json --format json
  artifacts:
    paths:
      - sbom.json


###########
# build
###########

build-dist:
  extends: .base-python
  needs: [ "semantic-release:dry-run" ]
  script:
    - sed -i -e "s/^__version__ = \".*\"/__version__ = \"$RELEASE_VERSION\"/" hopprcop/__init__.py
    - poetry version $RELEASE_VERSION
    - poetry build
  artifacts:
    paths:
      - "dist/"
      - hopprcop/__init__.py
      - pyproject.toml
      - poetry.lock



validate-renovate-config:
  image: renovate/renovate:36.64.1
  needs: []
  variables:
    RENOVATE_CONFIG_FILE: "renovate.json"
  script:
    - renovate-config-validator