.nvidia-ci.yml

---
##
## Variables that control the CI artifacts (private registry, for scanning and testing):
## CI_REGISTRY
## CI_REGISTRY_IMAGE
## CI_REGISTRY_USER
## CI_REGISTRY_PASSWORD
##
## Variables that control where NGC release artifacts go:
## NGC_REGISTRY
## NGC_REGISTRY_IMAGE
## NGC_REGISTRY_USER
## NGC_REGISTRY_TOKEN
##
## Variables that control where Docker Hub release artifacts go:
## REGISTRY_TOKEN
## REGISTRY_USER
## DOCKERHUB_REGISTRY_IMAGE
##

include:
  - .common-ci.yml

default:
  tags:
    - cnt
    - container-dev
    - docker/multi-arch
    - docker/privileged
    - os/linux
    - type/docker

variables:
  DOCKER_DRIVER: overlay2
  DOCKER_TLS_CERTDIR: "/certs"
  # Release "devel"-tagged images off the master branch
  RELEASE_DEVEL_BRANCH: "master"
  DEVEL_RELEASE_IMAGE_VERSION: "devel"
  # On the multi-arch builder we don't need the qemu setup.
  SKIP_QEMU_SETUP: "1"

# The .scan step forms the base of the image scan operation performed before releasing
# images.
.scan:
  stage: scan
  image: "${PULSE_IMAGE}"
  variables:
    IMAGE: "${CI_REGISTRY_IMAGE}:${CI_COMMIT_SHORT_SHA}-${DIST}"
    IMAGE_ARCHIVE: "k8s-device-plugin.tar"
  except:
    variables:
    - $CI_COMMIT_MESSAGE =~ /\[skip[ _-]scans?\]/i
    - $SKIP_SCANS
  before_script:
    - docker login -u "${CI_REGISTRY_USER}" -p "${CI_REGISTRY_PASSWORD}" "${CI_REGISTRY}"
    # TODO: We should specify the architecture here and scan all architectures
    - docker pull "${IMAGE}"
    - docker save "${IMAGE}" -o "${IMAGE_ARCHIVE}"
    - AuthHeader=$(echo -n $SSA_CLIENT_ID:$SSA_CLIENT_SECRET | base64 -w0)
    - >
      export SSA_TOKEN=$(curl --request POST --header "Authorization: Basic $AuthHeader" --header "Content-Type: application/x-www-form-urlencoded" ${SSA_ISSUER_URL} | jq ".access_token" |  tr -d '"')
    - if [ -z "$SSA_TOKEN" ]; then exit 1; else echo "SSA_TOKEN set!"; fi
  script:
    - pulse-cli -n $NSPECT_ID --ssa $SSA_TOKEN scan -i $IMAGE_ARCHIVE -p $CONTAINER_POLICY -o
  artifacts:
    when: always
    expire_in: 1 week
    paths:
      - pulse-cli.log
      - licenses.json
      - sbom.json
      - vulns.json
      - policy_evaluation.json

scan:device-plugin:ubuntu20.04:
  extends:
    - .scan
    - .dist:ubuntu20.04

scan:device-plugin:ubi8:
  extends:
    - .scan
    - .dist:ubi8

# Define the external release steps for NGC and Dockerhub
.release:ngc:
  extends:
    - .release:external
  variables:
    OUT_REGISTRY_USER: "${NGC_REGISTRY_USER}"
    OUT_REGISTRY_TOKEN: "${NGC_REGISTRY_TOKEN}"
    OUT_REGISTRY: "${NGC_REGISTRY}"

    OUT_IMAGE_NAME: "${NGC_REGISTRY_IMAGE}"

.release:dockerhub:
  extends:
    - .release:external
  variables:
    OUT_REGISTRY_USER: "${REGISTRY_USER}"
    OUT_REGISTRY_TOKEN: "${REGISTRY_TOKEN}"
    OUT_REGISTRY: "${DOCKERHUB_REGISTRY}"

    OUT_IMAGE_NAME: "${DOCKERHUB_REGISTRY_IMAGE}"

release:ngc:device-plugin:ubuntu20.04:
  extends:
    - .release:ngc
    - .dist:ubuntu20.04

release:dockerhub:device-plugin:ubuntu20.04:
  extends:
    - .release:dockerhub
    - .dist:ubuntu20.04

release:ngc:device-plugin:ubi8:
  extends:
    - .release:ngc
    - .dist:ubi8

release:dockerhub:device-plugin:ubi8:
  extends:
    - .release:dockerhub
    - .dist:ubi8