.gitlab-ci.yml

image: cincproject/omnibus-debian
stages:
 - patch
 - package
 - test
 - cleanup
 - deploy
 - publish

variables:
  ORIGIN: https://github.com/inspec/inspec.git
  REF: main
  CHANNEL: unstable
  CINC_PRODUCT: cinc-auditor
  GIT_CACHE: "false"
  OMNIBUS_FIPS_MODE: "true"

workflow:
  rules:
    # Run if we trigger a pipeline from the web
    - if: $CI_PIPELINE_SOURCE == "web"
    # Run if we trigger a pipeline from another project (i.e. upstream/inspec)
    - if: $CI_PIPELINE_SOURCE == "pipeline"
    # Run if this is a merge request
    - if: $CI_MERGE_REQUEST_ID

include:
  - local: .gitlab/package.yml
  - local: .gitlab/test.yml

patch:
  stage: patch
  tags:
    - docker-x86_64
  script:
    - echo "Cloning from $ORIGIN"
    - ./patch.sh
  artifacts:
    expire_in: 1mo
    paths:
      - inspec/

.bio_setup:
  before_script:
    - scripts/install-biome.sh
  variables:
    HAB_ORIGIN: cinc
    HAB_NONINTERACTIVE: "true"

# Package stage

package:amazonlinux-2023:x86_64:
  extends: .package:amazonlinux
  image: cincproject/omnibus-amazonlinux:2023
  cache:
    key: amazonlinux:2023:x86_64
  tags:
    - docker-x86_64
  needs:
    - patch
  variables:
    PLATFORM_VER: "2023"

package:amazonlinux-2023:aarch64:
  extends: .package:amazonlinux
  image: cincproject/omnibus-amazonlinux:2023
  cache:
    key: amazonlinux:2023:aarch64
  tags:
    - docker-aarch64-v8.2-a
  needs:
    - patch
  variables:
    PLATFORM_VER: "2023"
    OMNIBUS_FIPS_MODE: "false"

# Needs HAB_AUTH_TOKEN and HAB_ORIGIN environment variables set.
package:bio:linux:
  stage: package
  extends:
    - .bio_setup
  allow_failure: true
  tags:
    - docker-x86_64
  needs:
    - patch
  script:
    - bio pkg build ./inspec
  artifacts:
    paths:
      - results/*.hart

package:centos-8:x86_64:
  extends: .package:centos
  image: cincproject/omnibus-almalinux:8
  cache:
    key: centos:8:x86_64
  tags:
    - docker-x86_64
  needs:
    - patch
  variables:
    PLATFORM_VER: "8"

package:centos-8:aarch64:
  extends: .package:centos
  image: cincproject/omnibus-almalinux:8
  cache:
    key: centos:8:aarch64
  tags:
    - docker-aarch64
  needs:
    - patch
  variables:
    PLATFORM_VER: "8"
    OMNIBUS_FIPS_MODE: "false"

package:centos-8:s390x:
  extends: .package:centos
  image: cincproject/omnibus-almalinux:8
  cache:
    key: centos:8:s390x
  tags:
    - docker-s390x
  needs:
    - patch
  variables:
    PLATFORM_VER: "8"

package:centos-9:s390x:
  extends: .package:centos
  image: cincproject/omnibus-almalinux:9
  cache:
    key: centos:9:s390x
  tags:
    - docker-s390x
  needs:
    - patch
  variables:
    PLATFORM_VER: "9"

package:centos-9:x86_64:
  extends: .package:centos
  image: cincproject/omnibus-almalinux:9
  cache:
    key: centos:9:x86_64
  tags:
    - docker-x86_64
  needs:
    - patch
  variables:
    PLATFORM_VER: "9"

package:centos-9:aarch64:
  extends: .package:centos
  image: cincproject/omnibus-almalinux:9
  cache:
    key: centos:9:aarch64
  tags:
    - docker-aarch64
  needs:
    - patch
  variables:
    PLATFORM_VER: "9"
    OMNIBUS_FIPS_MODE: "false"

package:debian-11:x86_64:
  extends: .package:debian
  image: cincproject/omnibus-debian:11
  cache:
    key: debian:11:x86_64
  tags:
    - docker-x86_64
  needs:
    - patch
  variables:
    PLATFORM_VER: "11"

package:debian-11:aarch64:
  extends: .package:debian
  image: cincproject/omnibus-debian:11
  cache:
    key: debian:11:aarch64
  tags:
    - docker-aarch64
  needs:
    - patch
  variables:
    PLATFORM_VER: "11"
    OMNIBUS_FIPS_MODE: "false"

package:debian-12:x86_64:
  extends: .package:debian
  image: cincproject/omnibus-debian:12
  cache:
    key: debian:12:x86_64
  tags:
    - docker-x86_64
  needs:
    - patch
  variables:
    PLATFORM_VER: "12"

package:debian-12:aarch64:
  extends: .package:debian
  image: cincproject/omnibus-debian:12
  cache:
    key: debian:12:aarch64
  tags:
    - docker-aarch64
  needs:
    - patch
  variables:
    PLATFORM_VER: "12"
    OMNIBUS_FIPS_MODE: "false"

package:macos-11:
  extends: .package:macos
  cache:
    key: macos:11
  tags:
    - macos-11
  needs:
    - patch
  variables:
    PLATFORM_VER: "11"

package:macos-12:
  extends: .package:macos
  cache:
    key: macos:12
  tags:
    - macos-12
  needs:
    - patch
  variables:
    PLATFORM_VER: "12"

package:macos-12:aarch64:
  extends: .package:macos
  cache:
    key: macos:12:aarch64
  tags:
    - macos-12-aarch64
  needs:
    - patch
  variables:
    PLATFORM_VER: "12"

package:macos-13:
  extends: .package:macos
  cache:
    key: macos:13
  tags:
    - macos-13
  needs:
    - patch
  variables:
    PLATFORM_VER: "13"

package:macos-13:aarch64:
  extends: .package:macos
  cache:
    key: macos:13:aarch64
  tags:
    - macos-13-aarch64
  needs:
    - patch
  variables:
    PLATFORM_VER: "13"

package:opensuse-15:x86_64:
  extends: .package:opensuse
  image: cincproject/omnibus-opensuse:15
  cache:
    key: opensuse:15:x86_64
  tags:
    - docker-x86_64
  needs:
    - patch
  variables:
    PLATFORM_VER: "15"

package:opensuse-15:aarch64:
  extends: .package:opensuse
  image: cincproject/omnibus-opensuse:15
  cache:
    key: opensuse:15:aarch64
  tags:
    - docker-aarch64
  needs:
    - patch
  variables:
    PLATFORM_VER: "15"
    OMNIBUS_FIPS_MODE: "false"

package:windows-2012r2:
  extends: .package:windows
  cache:
    key: windows-2012r2
  tags:
    - windows-x64-ucrt64
  needs:
    - patch
  variables:
    PLATFORM_VER: "2012r2"

package:ubuntu-20.04:x86_64:
  extends: .package:ubuntu
  image: cincproject/omnibus-ubuntu:20.04
  cache:
    key: ubuntu:20.04:x86_64
  tags:
    - docker-x86_64
  needs:
    - patch
  variables:
    PLATFORM_VER: "20.04"

package:ubuntu-20.04:aarch64:
  extends: .package:ubuntu
  image: cincproject/omnibus-ubuntu:20.04
  cache:
    key: ubuntu:20.04:aarch64
  tags:
    - docker-aarch64
  needs:
    - patch
  variables:
    PLATFORM_VER: "20.04"
    OMNIBUS_FIPS_MODE: "false"

package:ubuntu-22.04:x86_64:
  extends: .package:ubuntu
  image: cincproject/omnibus-ubuntu:22.04
  cache:
    key: ubuntu:22.04:x86_64
  tags:
    - docker-x86_64
  needs:
    - patch
  variables:
    PLATFORM_VER: "22.04"

package:ubuntu-22.04:aarch64:
  extends: .package:ubuntu
  image: cincproject/omnibus-ubuntu:22.04
  cache:
    key: ubuntu:22.04:aarch64
  tags:
    - docker-aarch64
  needs:
    - patch
  variables:
    PLATFORM_VER: "22.04"
    OMNIBUS_FIPS_MODE: "false"

package:ubuntu-24.04:x86_64:
  extends: .package:ubuntu
  image: cincproject/omnibus-ubuntu:24.04
  cache:
    key: ubuntu:24.04:x86_64
  tags:
    - docker-x86_64
  needs:
    - patch
  variables:
    PLATFORM_VER: "24.04"

package:ubuntu-24.04:aarch64:
  extends: .package:ubuntu
  image: cincproject/omnibus-ubuntu:24.04
  cache:
    key: ubuntu:24.04:aarch64
  tags:
    - docker-aarch64
  needs:
    - patch
  variables:
    PLATFORM_VER: "24.04"
    OMNIBUS_FIPS_MODE: "false"

# Test stage

test:amazonlinux-2023:x86_64:
  extends: .test:amazonlinux
  image: cincproject/omnibus-amazonlinux:2023
  needs:
    - package:amazonlinux-2023:x86_64
  tags:
    - docker-x86_64
  variables:
    PLATFORM_VER: "2023"

test:amazonlinux-2023:aarch64:
  extends: .test:amazonlinux
  image: cincproject/omnibus-amazonlinux:2023
  needs:
    - package:amazonlinux-2023:aarch64
  tags:
    - docker-aarch64-v8.2-a
  variables:
    PLATFORM_VER: "2023"
    OMNIBUS_FIPS_MODE: "false"

test:bio:linux:
  stage: test
  extends:
    - .bio_setup
  allow_failure: true
  tags:
    - docker-x86_64
  needs:
    - package:bio:linux
  variables:
    HAB_TEST: "true"
  script:
    - bio install results/*.hart  --binlink
    - export CINC_PATH=$(bio pkg path cincproject/cinc-auditor)
    - export GEM_PATH=${CINC_PATH}/vendor:$GEM_PATH
    - ln -s $CINC_PATH /opt/cinc-auditor
    - mkdir /opt/cinc-auditor/embedded
    - ln -s /opt/cinc-auditor/bin /opt/cinc-auditor/embedded/bin
    - ln -s $(bio pkg path core/ruby30)/bin/ruby /opt/cinc-auditor/embedded/bin/ruby
    - cinc-auditor version
    - cinc-auditor detect
    - cinc-auditor exec test-baseline --no-distinct-exit --reporter cli junit:junit.xml
  artifacts:
    reports:
      junit: junit.xml

test:centos-8:x86_64:
  extends: .test:centos
  image: cincproject/omnibus-almalinux:8
  needs:
    - package:centos-8:x86_64
  tags:
    - docker-x86_64
  variables:
    PLATFORM_VER: "8"

test:centos-8:aarch64:
  extends: .test:centos
  image: cincproject/omnibus-almalinux:8
  needs:
    - package:centos-8:aarch64
  tags:
    - docker-aarch64
  variables:
    PLATFORM_VER: "8"

test:centos-8:s390x:
  extends: .test:centos
  image: cincproject/omnibus-almalinux:8
  needs:
    - package:centos-8:s390x
  tags:
    - docker-s390x
  variables:
    PLATFORM_VER: "8"

test:centos-9:s390x:
  extends: .test:centos
  image: cincproject/omnibus-almalinux:9
  needs:
    - package:centos-9:s390x
  tags:
    - docker-s390x
  variables:
    PLATFORM_VER: "9"

test:centos-9:x86_64:
  extends: .test:centos
  image: cincproject/omnibus-almalinux:9
  needs:
    - package:centos-9:x86_64
  tags:
    - docker-x86_64
  variables:
    PLATFORM_VER: "9"

test:centos-9:aarch64:
  extends: .test:centos
  image: cincproject/omnibus-almalinux:9
  needs:
    - package:centos-9:aarch64
  tags:
    - docker-aarch64
  variables:
    PLATFORM_VER: "9"

test:debian-11:x86_64:
  extends: .test:debian
  image: cincproject/omnibus-debian:11
  needs:
    - package:debian-11:x86_64
  tags:
    - docker-x86_64
  variables:
    PLATFORM_VER: "11"

test:debian-11:aarch64:
  extends: .test:debian
  image: cincproject/omnibus-debian:11
  needs:
    - package:debian-11:aarch64
  tags:
    - docker-aarch64
  variables:
    PLATFORM_VER: "11"

test:debian-12:x86_64:
  extends: .test:debian
  image: cincproject/omnibus-debian:12
  needs:
    - package:debian-12:x86_64
  tags:
    - docker-x86_64
  variables:
    PLATFORM_VER: "12"

test:debian-12:aarch64:
  extends: .test:debian
  image: cincproject/omnibus-debian:12
  needs:
    - package:debian-12:aarch64
  tags:
    - docker-aarch64
  variables:
    PLATFORM_VER: "12"

test:macos-11:
  extends: .test:macos
  tags:
    - macos-11
  needs:
    - package:macos-11
  variables:
    PLATFORM_VER: "11"

test:macos-12:
  extends: .test:macos
  tags:
    - macos-12
  needs:
    - package:macos-12
  variables:
    PLATFORM_VER: "12"

test:macos-12:aarch64:
  extends: .test:macos
  tags:
    - macos-12-aarch64
  needs:
    - package:macos-12:aarch64
  variables:
    PLATFORM_VER: "12"

test:macos-13:
  extends: .test:macos
  tags:
    - macos-13
  needs:
    - package:macos-13
  variables:
    PLATFORM_VER: "13"

test:macos-13:aarch64:
  extends: .test:macos
  tags:
    - macos-13-aarch64
  needs:
    - package:macos-13:aarch64
  variables:
    PLATFORM_VER: "13"

test:opensuse-15:x86_64:
  extends: .test:opensuse
  image: cincproject/omnibus-opensuse:15
  needs:
    - package:opensuse-15:x86_64
  tags:
    - docker-x86_64
  variables:
    PLATFORM_VER: "15"

test:opensuse-15:aarch64:
  extends: .test:opensuse
  image: cincproject/omnibus-opensuse:15
  needs:
    - package:opensuse-15:aarch64
  tags:
    - docker-aarch64
  variables:
    PLATFORM_VER: "15"

test:ubuntu-20.04:x86_64:
  extends: .test:ubuntu
  image: cincproject/omnibus-ubuntu:20.04
  needs:
    - package:ubuntu-20.04:x86_64
  tags:
    - docker-x86_64
  variables:
    PLATFORM_VER: "20.04"

test:ubuntu-20.04:aarch64:
  extends: .test:ubuntu
  image: cincproject/omnibus-ubuntu:20.04
  needs:
    - package:ubuntu-20.04:aarch64
  tags:
    - docker-aarch64
  variables:
    PLATFORM_VER: "20.04"

test:ubuntu-22.04:x86_64:
  extends: .test:ubuntu
  image: cincproject/omnibus-ubuntu:22.04
  needs:
    - package:ubuntu-22.04:x86_64
  tags:
    - docker-x86_64
  variables:
    PLATFORM_VER: "22.04"

test:ubuntu-22.04:aarch64:
  extends: .test:ubuntu
  image: cincproject/omnibus-ubuntu:22.04
  needs:
    - package:ubuntu-22.04:aarch64
  tags:
    - docker-aarch64
  variables:
    PLATFORM_VER: "22.04"

test:ubuntu-24.04:x86_64:
  extends: .test:ubuntu
  image: cincproject/omnibus-ubuntu:24.04
  needs:
    - package:ubuntu-24.04:x86_64
  tags:
    - docker-x86_64
  variables:
    PLATFORM_VER: "24.04"

test:ubuntu-24.04:aarch64:
  extends: .test:ubuntu
  image: cincproject/omnibus-ubuntu:24.04
  needs:
    - package:ubuntu-24.04:aarch64
  tags:
    - docker-aarch64
  variables:
    PLATFORM_VER: "24.04"

test:windows-2012r2:
  extends: .test:windows
  needs:
    - package:windows-2012r2
  variables:
    PLATFORM_VER: "2012r2"

.ssh-setup:
  before_script:
    - eval $(ssh-agent -s)
    - echo "${SSH_PRIVATE_KEY}" | tr -d '\r' | ssh-add - > /dev/null
    - mkdir -p ~/.ssh
    - chmod 700 ~/.ssh
    - echo "${SSH_KNOWN_HOSTS}" > ~/.ssh/known_hosts
    - chmod 644 ~/.ssh/known_hosts

deploy:
  allow_failure: false
  stage: deploy
  extends: .ssh-setup
  # Only run if this is triggered from the web
  rules:
    - if: $CI_PIPELINE_SOURCE == "web"
      when: manual
    - when: never
  tags:
    - docker-x86_64
  dependencies:
    - package:amazonlinux-2023:x86_64
    - package:amazonlinux-2023:aarch64
    - package:centos-8:aarch64
    - package:centos-8:s390x
    - package:centos-8:x86_64
    - package:centos-9:aarch64
    - package:centos-9:x86_64
    - package:centos-9:s390x
    - package:debian-11:x86_64
    - package:debian-11:aarch64
    - package:debian-12:x86_64
    - package:debian-12:aarch64
    - package:macos-11
    - package:macos-12
    - package:macos-12:aarch64
    - package:macos-13
    - package:macos-13:aarch64
    - package:opensuse-15:x86_64
    - package:opensuse-15:aarch64
    - package:ubuntu-20.04:x86_64
    - package:ubuntu-20.04:aarch64
    - package:ubuntu-22.04:x86_64
    - package:ubuntu-22.04:aarch64
    - package:ubuntu-24.04:x86_64
    - package:ubuntu-24.04:aarch64
    - package:windows-2012r2
  script:
    - ssh cinc@${DOWNLOADS_HOST} "mkdir -p /data/incoming/files/${CHANNEL}/cinc-auditor/$(cat VERSION)/"
    - rsync -avH --delete data/ cinc@${DOWNLOADS_HOST}:/data/incoming/files/${CHANNEL}/cinc-auditor/$(cat VERSION)/
    - ssh cinc@${DOWNLOADS_HOST} "chmod 755 /data/incoming/files/${CHANNEL}/cinc-auditor/$(cat VERSION)/"

deploy:bio:linux:
  stage: deploy
  allow_failure: true
  # Only run if this is triggered from the web
  rules:
    - if: $CI_PIPELINE_SOURCE == "web"
      when: manual
    - when: never
  extends:
    - .bio_setup
  tags:
    - docker-x86_64
  dependencies:
    - package:bio:linux
  script:
    - bio pkg upload results/*.hart

deploy-gems:
  stage: deploy
  # Only run if this is triggered from the web
  rules:
    - if: $CI_PIPELINE_SOURCE == "web"
      when: manual
    - when: never
  tags:
    - docker-x86_64
  dependencies:
    - patch
  script:
    - ./deploy-gems.sh

publish:
  stage: publish
  extends: .ssh-setup
  dependencies: []
  # Only run if this is triggered from the web
  rules:
    - if: $CI_PIPELINE_SOURCE == "web"
      when: on_success
    - when: never
  tags:
    - downloads
  script:
    - sudo mkdir -p /data/mirror/files/${CHANNEL}/cinc-auditor
    - sudo /usr/bin/rsync -avH /data/incoming/files/${CHANNEL}/cinc-auditor/ /data/mirror/files/${CHANNEL}/cinc-auditor/
    - sudo -E -u cinc /usr/local/bin/update-cinc-api
    - ssh -q cinc@${MIRROR_HOST} "~/sync-from-master"

publish-docker:
  image: docker:latest
  services:
  - docker:dind
  stage: publish
  # Only run if this is triggered from the web
  rules:
    - if: $CI_PIPELINE_SOURCE == "web"
      when: on_success
    - when: never
  tags:
    - docker-x86_64
  dependencies:
    - patch
    - deploy-gems
  before_script:
    - apk add curl bash
  script:
    - bash docker.sh
  variables:
    DOCKER_TLS_CERTDIR: "/certs"

publish:bio:linux:
  # Only run if this is triggered from the web
  rules:
    - if: $CI_PIPELINE_SOURCE == "web"
      when: on_success
    - when: never
  tags:
    - docker-x86_64
  dependencies:
    - package:bio:linux
    - deploy:bio:linux
  extends:
    - .bio_setup
  stage: publish
  script:
    - bio pkg install core/jq-static -b
    - export PKG=$(bio pkg info results/*.hart -j | jq  -r '[.origin,.name,.version,.release] | join("/")')
    - bio pkg promote $PKG $CHANNEL

.cleanup:
  stage: cleanup
  dependencies: []
  variables:
    GIT_CHECKOUT: "false"
  when: always
  script:
    - sudo rm -rf inspec/
    - sudo rm -rf ${CI_PROJECT_DIR}/cinc-project/distribution/auditor/

cleanup:macos-11:
  extends: .cleanup
  tags:
    - macos-11

cleanup:macos-12:
  extends: .cleanup
  tags:
    - macos-12

cleanup:macos-12-aarch64:
  extends: .cleanup
  tags:
    - macos-12-aarch64

cleanup:macos-13:
  extends: .cleanup
  tags:
    - macos-13

cleanup:macos-13-aarch64:
  extends: .cleanup
  tags:
    - macos-13-aarch64