pipeline.yml

---
groups:
- name: main
  jobs:
  - build
  - test-cf-cli-v6
  - test-cf-cli-v7
  - test-cf-cli-v8
  - scan-image
  - shipit
  - bump-patch
- name: manage
  jobs:
  - bump-*
  - setup
  - cleanup-failed-tests
- name: all
  jobs:
  - build
  - test-*
  - scan-image
  - shipit
  - bump-*
  - setup
  - cleanup-failed-tests

jobs:
- name: build
  serial: true
  public: true
  plan:
  - in_parallel:
    - get: cf-cli-resource
      trigger: true
    - get: os-image
      trigger: true
  - task: build
    privileged: true
    file: cf-cli-resource/ci/tasks/build-image.yml
    input_mapping:
      project: cf-cli-resource
  - put: resource-image-dev
    params:
      image: image/image.tar
    get_params: {skip_download: true}

- name: test-cf-cli-v6
  serial: true
  public: true
  plan:
  - in_parallel:
    - get: cf-cli-resource
      passed: [build]
      trigger: true
    - get: resource-image-dev
      passed: [build]
      trigger: true
  - task: test
    image: resource-image-dev
    file: cf-cli-resource/ci/tasks/run-shellspec.yml
    vars:
      ccr-test-jobs: 5
      ccr-cf-cli-version: 6

- name: test-cf-cli-v7
  serial: true
  public: true
  plan:
  - in_parallel:
    - get: cf-cli-resource
      passed: [build]
      trigger: true
    - get: resource-image-dev
      passed: [build]
      trigger: true
  - task: test
    image: resource-image-dev
    file: cf-cli-resource/ci/tasks/run-shellspec.yml
    vars:
      ccr-test-jobs: 5
      ccr-cf-cli-version: 7

- name: test-cf-cli-v8
  serial: true
  public: true
  plan:
  - in_parallel:
    - get: cf-cli-resource
      passed: [build]
      trigger: true
    - get: resource-image-dev
      passed: [build]
      trigger: true
  - task: test
    image: resource-image-dev
    file: cf-cli-resource/ci/tasks/run-shellspec.yml
    vars:
      ccr-test-jobs: 5
      ccr-cf-cli-version: 8

- name: scan-image
  plan:
  - in_parallel:
    - get: cf-cli-resource
      passed: [test-cf-cli-v6, test-cf-cli-v7, test-cf-cli-v8]
    - get: resource-image-dev
      resource: resource-image-dev
      passed: [test-cf-cli-v6, test-cf-cli-v7, test-cf-cli-v8]
      params: {format: oci}
      trigger: true
    - get: trivy
      trigger: true
    - get: trivy-db
      trigger: true
      params:
        globs:
        - trivy-offline.db.tgz
  - task: scan
    image: trivy
    config:
      platform: linux
      inputs:
      - name: cf-cli-resource
      - name: resource-image-dev
        path: image
      - name: trivy-db
      run:
        path: sh
        args:
        - -c
        - |
          mkdir db
          tar -xzf trivy-db/trivy-offline.db.tgz -C ./db

          trivy \
            --cache-dir $(pwd) \
            image \
            --severity "HIGH,CRITICAL" \
            --ignore-unfixed \
            --exit-code 1 \
            --input image/image.tar \
            --skip-files opt/cf-cli-7.5.0/cf7 \
            --skip-files opt/cf-cli-8.4.0/cf8 \
            --skip-files /usr/local/bin/yq

- name: shipit
  public: true
  serial_groups: [version]
  plan:
  - in_parallel:
    - get: cf-cli-resource
      passed: [scan-image]
    - get: resource-image-dev
      passed: [scan-image]
      params: {format: oci}
    - get: version
      params: {bump: final}
  - load_var: version-number
    file: version/version
  - task: prepare-github-release
    file: cf-cli-resource/ci/tasks/prepare-github-release.yml
  - put: github-release
    params:
      name: release-output/release-name
      tag: release-output/release-tag
      commitish: release-output/commitish
      body: release-output/RELEASE_NOTES.md
  - put: version
    params: {file: version/version}
  - put: resource-image-final
    inputs: [resource-image-dev, version]
    params:
      image: resource-image-dev/image.tar
      version: ((.:version-number))
      bump_aliases: true
  - put: notify
    params:
      message: |
        New release announcement!
        https://github.com/nulldriver/cf-cli-resource/releases/tag/v((.:version-number))
      mode: concise
      alert_type: success

- name: bump-major
  public: true
  serial_groups: [version]
  plan:
  - get: version
    params: {bump: major, pre: rc}
  - put: version
    params: {file: version/version}

- name: bump-minor
  public: true
  serial_groups: [version]
  plan:
  - get: version
    params: {bump: minor, pre: rc}
  - put: version
    params: {file: version/version}

- name: bump-patch
  public: true
  serial_groups: [version]
  plan:
  - get: version
    passed: [shipit]
    params: {bump: patch, pre: rc}
    trigger: true
  - put: version
    params: {file: version/version}

- name: setup
  serial: true
  public: true
  plan:
  - in_parallel:
    - get: cf-cli-resource
      passed: [build]
    - get: bookstore-service-broker
  - task: build-test-app-image
    privileged: true
    file: cf-cli-resource/ci/tasks/build-image.yml
    input_mapping:
      project: cf-cli-resource
    params:
      CONTEXT: spec/fixture/static-app
  - in_parallel:
    - put: test-app-image
      params:
        image: image/image.tar
      get_params: {skip_download: true}
    - put: prepare-cloud-foundry
      resource: cloud-foundry
      params:
        commands:
        - command: create-org
        - command: create-space
      get_params: {skip_download: true}
  - in_parallel:
    - put: sync-service-broker
      resource: cloud-foundry
      params:
        commands:
        - command: push
          app_name: bookstore-service-broker
          path: bookstore-service-broker/build/libs/bookstore-service-broker-0.0.1.BUILD-SNAPSHOT.jar
          manifest: bookstore-service-broker/deploy/cloudfoundry/manifest.yml
        - command: create-service-broker
          service_broker: bookstore
          username: admin
          password: supersecret
          url: https://bookstore-service-broker.((ccr-cf-apps-domain))
        - command: enable-service-access
          service_broker: bookstore
    - put: async-service-broker
      resource: cloud-foundry
      params:
        commands:
        - command: push
          app_name: bookstore-service-broker-async
          path: bookstore-service-broker/build/libs/bookstore-service-broker-0.0.1.BUILD-SNAPSHOT.jar
          manifest: bookstore-service-broker/deploy/cloudfoundry/manifest.yml
        - command: create-service-broker
          service_broker: bookstore-async
          username: admin
          password: supersecret
          url: https://bookstore-service-broker-async.((ccr-cf-apps-domain))
        - command: enable-service-access
          service_broker: bookstore-async

- name: cleanup-failed-tests
  serial: true
  public: true
  plan:
  - in_parallel:
    - get: cf-cli-resource
    - get: resource-image-dev
      passed: [build]
  - task: cleanup
    image: resource-image-dev
    file: cf-cli-resource/ci/tasks/cleanup-failed-tests.yml
    vars:
      ccr-cf-cli-version: 8

resources:
- name: cf-cli-resource
  type: git
  icon: github
  source:
    uri: git@github.com:nulldriver/cf-cli-resource.git
    private_key: ((git_key.private_key))
    ignore_paths:
    - .devcontainer
    - .gitignore
    - CHANGELOG.md
    - LICENSE
    - NOTICE.md
    - README.md
    - examples
    - pipeline.yml

- name: version
  type: semver
  icon: tag
  source:
    driver: git
    initial_version: 1.0.0-rc.0
    uri: git@github.com:nulldriver/cf-cli-resource.git
    branch: version
    file: version
    private_key: ((git_key.private_key))

- name: resource-image-dev
  type: registry-image
  icon: docker
  source:
    repository: nulldriver/cf-cli-resource-dev
    tag: dev
    username: ((docker.username))
    password: ((docker.password))

- name: resource-image-final
  type: registry-image
  icon: docker
  source:
    repository: nulldriver/cf-cli-resource
    username: ((docker.username))
    password: ((docker.password))

- name: trivy
  type: registry-image
  icon: docker
  source:
    repository: aquasec/trivy
    username: ((docker.username))
    password: ((docker.password))

- name: trivy-db
  type: github-release
  icon: database
  source:
    owner: aquasecurity
    repository: trivy-db
    access_token: ((github_access_token))

- name: github-release
  type: github-release
  icon: package-variant-closed
  source:
    owner: nulldriver
    repository: cf-cli-resource
    access_token: ((github_access_token))

- name: notify
  type: slack-notifier
  icon: slack
  source:
    url: ((slack-webhook-url))

- name: test-app-image
  type: registry-image
  icon: docker
  source:
    repository: docker.nulldriver.com/test-app
    tag: latest
    username: ((docker-private.username))
    password: ((docker-private.password))

- name: bookstore-service-broker
  type: git
  icon: github
  source:
    uri: git@github.com:nulldriver/bookstore-service-broker.git
    private_key: ((git_key.private_key))

- name: cloud-foundry
  type: cf-cli-resource
  icon: cloud
  source:
    api: ((ccr-cf-api))
    username: ((cf.username))
    password: ((cf.password))
    org: service-brokers
    space: bookstore

- name: os-image
  type: registry-image
  icon: docker
  source:
    repository: alpine
    tag: 3.16

resource_types:
- name: cf-cli-resource
  type: registry-image
  source:
    repository: nulldriver/cf-cli-resource

- name: slack-notifier
  type: registry-image
  source:
    repository: mockersf/concourse-slack-notifier