.gitlab-ci.yml

# .gitlab-ci.yml

stages:
  - security-gates
  - build
  - shiftleft-scan
  - azure-push
  - acr-shiftleft-scan
  - deploy

variables:
  IMAGE_NAME: cloudsecurity-workshop
  IMAGE_TAG: "$CI_REGISTRY_IMAGE/$IMAGE_NAME:$CI_PIPELINE_IID"
  AZURE_IMAGE_TAG: "$AZURE_ACR_NAME/$IMAGE_NAME:$CI_PIPELINE_IID"

spectral-secret-gate:
  stage: security-gates
  script:
    - curl -L "https://get.spectralops.io/latest/x/sh?key=${SPECTRALOPS_KEY}" | sh
    - $HOME/.spectral/spectral scan --ok  --include-tags base,audit

spectral-iac-gate:
  stage: security-gates
  script:
    - curl -L "https://get.spectralops.io/latest/x/sh?key=${SPECTRALOPS_KEY}" | sh
    - $HOME/.spectral/spectral scan --ok --engines iac


build_image:
  stage: build
  image: docker:19.03.12
  services:
    - docker:19.03.12-dind
  script:
    - docker build -t "${IMAGE_NAME}" .
    - docker tag "${IMAGE_NAME}" "${IMAGE_TAG}"
    - echo "$CI_JOB_TOKEN" | docker login -u "$CI_REGISTRY_USER" --password-stdin "$CI_REGISTRY"
    - docker push "${IMAGE_TAG}"
  only:
    - main

shiftleft_scan:
  stage: shiftleft-scan
  image: docker:19.03.12
  services:
    - docker:19.03.12-dind
  script:
    - echo "$CI_JOB_TOKEN" | docker login -u "$CI_REGISTRY_USER" --password-stdin "$CI_REGISTRY"
    - docker pull "$IMAGE_TAG"
    - docker save "$IMAGE_TAG" -o image.tar
    - chmod +x ./shiftleft
    - ./shiftleft image-scan -e d29d3391-5284-4a70-9d9b-1a5daf401b5d -i image.tar || true
  artifacts:
    paths:
      - image.tar
  only:
    - main


push_to_acr:
  stage: azure-push
  image: docker:19.03.12
  services:
    - docker:19.03.12-dind
  script:
    - echo "$CI_JOB_TOKEN" | docker login -u "$CI_REGISTRY_USER" --password-stdin "$CI_REGISTRY"
    - docker pull "${IMAGE_TAG}"
    - echo "$AZURE_PASSWORD" | docker login "$AZURE_ACR_NAME" -u "$AZURE_APP_ID" --password-stdin
    - docker tag "${IMAGE_TAG}" "${AZURE_IMAGE_TAG}"
    - docker push "${AZURE_IMAGE_TAG}"

  only:
    - main

acr_shiftleft_scan:
  stage: acr-shiftleft-scan
  image: docker:19.03.12
  services:
    - docker:19.03.12-dind
  script:
    - echo "$AZURE_PASSWORD" | docker login "$AZURE_ACR_NAME" -u "$AZURE_APP_ID" --password-stdin
    - docker pull "${AZURE_IMAGE_TAG}"
    - docker save "${AZURE_IMAGE_TAG}" -o azureimage.tar
    - chmod +x ./shiftleft

    - ./shiftleft image-scan -e d29d3391-5284-4a70-9d9b-1a5daf401b5d -i azureimage.tar || true
  artifacts:
    paths:
      - azureimage.tar
  when: always
  only:
    - main


deploy_to_aks:
  stage: deploy
  image: dtzar/helm-kubectl
  script:
    # Decode the KUBECONFIG file
    - echo "$KUBECONFIG" | base64 -d > decoded_kubeconfig
    - export KUBECONFIG=decoded_kubeconfig

    # Replace the placeholder with the actual IMAGE_TAG environment variable
    - export IMAGE_TAG="$AZURE_IMAGE_TAG"
    - envsubst '$IMAGE_TAG' < k8s/deployment.yaml | kubectl apply -f -

    # Apply the service configuration
    - kubectl apply -f k8s/service.yaml
  only:
    - main
  environment:
    name: production
  before_script:
    - export DISABLE_SECURITY_SCAN=true