.gitlab-ci.yml

stages:
  - test
  - build
  - scan

.rails_template: &rails_template
  image: ruby:2.6.5-alpine

  services:
    - postgres:latest

  variables:
    POSTGRES_DB: gitlab_ci_test
    POSTGRES_USER: runner
    POSTGRES_HOST_AUTH_METHOD: trust

  stage: test

  cache:
    key:
      files:
        - Gemfile.lock
        - package.json
    paths:
      - vendor/bundle
      - node_modules

  before_script:
    - apk add alpine-sdk chromium-chromedriver nodejs postgresql-dev tzdata yarn
    - bundle check --path vendor/bundle || bundle install --path vendor/bundle
    - yarn install
    - cp config/database.yml.gitlab config/database.yml
    - cp .env.example .env

rails_test:
  <<: *rails_template

  script:
    - bundle exec rake

rails_style:
  <<: *rails_template

  script:
    - bundle exec rake check_style

bundle_audit:
  <<: *rails_template
  script:
    - bundle exec bundle audit update
    - bundle exec bundle audit --ignore CVE-2021-32740

yarn_audit:
  <<: *rails_template

  script:
    - yarn run improved-yarn-audit

.build_template: &build_template
  image: docker:latest

  stage: build

  services:
    - docker:dind

  variables:
    DOCKER_TLS_CERTDIR: ""

  before_script:
    - docker login -u "gitlab-ci-token" -p "$CI_BUILD_TOKEN" $CI_REGISTRY

  rules:
    # Run when a new tag is cut
    - if: $CI_COMMIT_TAG

build_rails:
  <<: *build_template

  script:
    - docker build -f Dockerfile --pull -t "$CI_REGISTRY_IMAGE/rails:$CI_COMMIT_TAG" .
    - docker push "$CI_REGISTRY_IMAGE/rails:$CI_COMMIT_TAG"

include:
  - template: Container-Scanning.gitlab-ci.yml

# Override the defaults in the container_scanning template job
container_scanning:
  # Only run after the build stage has passed
  stage: scan
  # The container scanner will pull from $CI_APPLICATION_REPOSITORY:$CI_APPLICATION_TAG
  variables:
    CI_APPLICATION_REPOSITORY: $CI_REGISTRY_IMAGE/rails
    CI_APPLICATION_TAG: $CI_COMMIT_TAG
    DOCKERFILE_PATH: Dockerfile
  before_script:
    # Scheduled pipelines won't have a commit tag so we set the $CI_APPLICATION_TAG manually
    # This will set $CI_APPLICATION_TAG to the most recent commit
    - >
      if [[ "$CI_PIPELINE_SOURCE" == "schedule" ]]; then
        apk add --update --no-cache git
        git fetch --tags --force
        export CI_APPLICATION_TAG=$(git tag --list --sort=committerdate | tail -n 1)
        echo "Checking $CI_APPLICATION_REPOSITORY:$CI_APPLICATION_TAG"
      fi
  # The pipeline will run only if a rule matches
  rules:
    # Run on scheduled pipelines
    - if: '$CI_PIPELINE_SOURCE == "schedule"'
      when: always
    # Run when a new tag is cut
    - if: $CI_COMMIT_TAG