tools/.gitlab-ci.yml at main · uniget-org/tools · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
variables:
  METADATA_CHANGES_FROM_SHA:
    description: Force pipeline to collect changes relative to supplied commit SHA
  METADATA_ONLY:
    description: Build metadata only
    value: "false"
    options:
    - "false"
    - "true"
  BUILD_TOOL_NAME:
    description: Name of tool to build
  SKIP_BUILD:
    description: Skip build stage
    value: "true"
    options:
    - "true"
    - "false"

.docker:
  variables:
    DOCKER_CERT_DIR: ""
  services:
  - name: docker:29.7.2-dind@sha256:12e683a161823b2a839aeea999b9d960e6e1f9a97b1679ad6b441982e2d9cf07
  image: docker:29.7.2@sha256:12e683a161823b2a839aeea999b9d960e6e1f9a97b1679ad6b441982e2d9cf07
  before_script: |
    echo "${CI_REGISTRY_PASSWORD}" \
    | docker login "${CI_REGISTRY}" \
        --username="${CI_REGISTRY_USER}" \
        --password-stdin
  after_script: |
    docker logout "${CI_REGISTRY}"

build_single:
  rules:
  - if: $CI_PIPELINE_SOURCE == "web" && $BUILD_TOOL_NAME
  trigger:
    include:
    - local: pipeline/build.yaml
      inputs:
        name: $BUILD_TOOL_NAME
    strategy: mirror

dev_download:
  rules:
  - if: $CI_PIPELINE_SOURCE == "push" && $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH
  - if: $CI_PIPELINE_SOURCE == "web" && $BUILD_TOOL_NAME == ""
  - if: $METADATA_ONLY == "true"
  image: registry.gitlab.com/uniget-org/images/ubuntu:26.04@sha256:0e9f873df6c03f698322571475f367a694d7eff9077e5019ae764e5106a6da16
  script: |
    curl --silent --show-error --location --fail https://gitlab.com/uniget-org/dev/-/releases/permalink/latest/downloads/dev_Linux_$(uname -m).tar.gz \
    | tar --extract --gzip dev
    ./dev --version
  artifacts:
    paths:
    - dev

uniget_download:
  rules:
  - if: $CI_PIPELINE_SOURCE == "push" && $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH
  - if: $CI_PIPELINE_SOURCE == "web" && $BUILD_TOOL_NAME == ""
  - if: $METADATA_ONLY == "true"
  image: registry.gitlab.com/uniget-org/images/ubuntu:26.04@sha256:0e9f873df6c03f698322571475f367a694d7eff9077e5019ae764e5106a6da16
  script: |
    curl --silent --show-error --location --fail https://gitlab.com/uniget-org/cli/-/releases/permalink/latest/downloads/uniget_Linux_$(uname -m).tar.gz \
    | tar --extract --gzip uniget
    ./uniget --version
  artifacts:
    paths:
    - uniget

collect:
  rules:
  - if: $METADATA_ONLY == "true"
    when: never
  - if: $CI_PIPELINE_SOURCE == "push" && $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH
    needs:
    - dev_download
  - if: $CI_PIPELINE_SOURCE == "web" && $BUILD_TOOL_NAME == ""
    needs:
    - dev_download
  image: alpine:3.24.1@sha256:28bd5fe8b56d1bd048e5babf5b10710ebe0bae67db86916198a6eec434943f8b
  script: |
    ./dev metadata changes --from="$METADATA_CHANGES_FROM_SHA" | tee changes.txt
    TOOLS="$( cat changes.txt | xargs echo | tr ' ' , )"
    if test "${TOOLS}" == ""; then
        cat >build.yaml <<EOF
    build:
      script: echo "No tools to build"
    EOF

    else
        cat >build.yaml <<EOF
    build:
      parallel:
        matrix:
        - TOOL: [$TOOLS]
      trigger:
        include:
        - local: pipeline/build.yaml
          inputs:
            name: \${TOOL}
            arch: [amd64, arm64]
        strategy: mirror
    EOF
    fi
  artifacts:
    paths:
    - changes.txt
    - build.yaml
    expire_in: 4 days

build_trigger:
  rules:
  - if: $METADATA_ONLY == "true"
    when: never
  - if: $SKIP_BUILD == "true"
    when: never
  - if: $CI_PIPELINE_SOURCE == "push" && $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH
    needs:
    - collect
  - if: $CI_PIPELINE_SOURCE == "web" && $BUILD_TOOL_NAME == ""
    needs:
    - collect
  trigger:
    include:
    - artifact: build.yaml
      job: collect
    strategy: mirror

metadata:
  rules:
  - if: $CI_PIPELINE_SOURCE == "push" && $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH
    needs:
    - dev_download
    - uniget_download
    - build_trigger
  - if: $METADATA_ONLY == "true"
    needs:
    - dev_download
    - uniget_download
  - if: $SKIP_BUILD == "true"
    needs:
    - dev_download
    - uniget_download
  extends:
  - .docker
  id_tokens:
    SIGSTORE_ID_TOKEN:
      aud: sigstore
  script:
  - ./uniget install cosign
  - cosign version
  - docker buildx create --name=uniget --bootstrap --use
  - ./dev metadata create
  - ./dev metadata sign
  - ./dev metadata build