azure-pipelines.yaml

# Starter pipeline
# Start with a minimal pipeline that you can customize to build and deploy your code.
# Add steps that build, run tests, deploy, and more:
# https://aka.ms/yaml

trigger:
  branches:
    include:
      - master
  tags:
    include:
      - v*

pool:
  vmImage: 'ubuntu-latest'

variables:
  imageName: 'f5networks/k8s-bigip-ctlr-devel'
  quayConnection: 'quay-bot'
  redhatConnection: 'redhat-bot'
  dockerConnection: 'docker-bot'
  scanConnection: 'cis-scan-bot'
  quay_path: 'quay.io/f5networks/k8s-bigip-ctlr-devel'
  redhat_prj_name: 'cntr-ingress-svcs'
  docker_repo: 'f5networks/k8s-bigip-ctlr'
  chartPath: 'incubator'
  chartRepoName: 'charts'
  chartOrganization: F5Networks
  helmVersion: 'v3.5.4'
  chartsUpdated: False
  operatorUpdated: False
  operatorImageName: 'f5networks/f5-cis-operator-devel'
  operatorBundleImageName: 'f5networks/f5-cis-operator-bundle-devel'
  operatorIndexImage: 'f5networks/f5-cis-operator-index-devel'
  goVersion: 1.21.4

stages:
- stage: PreCheck
  jobs:
  - job: Preverification
    steps:
    - task: GoTool@0
      inputs:
        version: $(goVersion)
      displayName: Install Go 1.21.4
    - task: CmdLine@2
      displayName: Check Go format and Suspicious constructs
      inputs:
        script: 'make verify'
    - task: CmdLine@2
      displayName: Check documentation
      inputs:
        script: 'make docs'
- stage: ContainerImage
  dependsOn: PreCheck
  jobs:
  - job: BuildContainerImage
    steps:
      - script: |
          echo "##vso[task.setvariable variable=BUILD_VERSION]$(cat next-version.txt)"
        displayName: Set CIS Version
      - task: Docker@2
        displayName: Login to redhat registry
        inputs:
          command: login
          containerRegistry: $(redhatConnection)
      - task: Docker@2
        displayName: Login to quay registry
        inputs:
          command: login
          containerRegistry: $(quayConnection)
      - task: Docker@2
        displayName: Login to docker registry
        condition: startsWith(variables['build.sourceBranch'], 'refs/tags/')
        inputs:
          command: login
          containerRegistry: $(dockerConnection)
      - task: Docker@2
        displayName: Login to scan registry
        condition: startsWith(variables['build.sourceBranch'], 'refs/tags/')
        inputs:
          command: login
          containerRegistry: $(scanConnection)
      - task: Docker@2
        displayName: Build from Red Hat Universal Base Image
        inputs:
          command: build
          containerRegistry: $(quayConnection)
          repository: $(imageName)
          Dockerfile: build-tools/Dockerfile.ubi
          buildContext: .
          tags: $(Build.SourceVersion)
          arguments: "--build-arg BUILD_INFO=azure-$(Build.BuildId)-$(Build.SourceVersion) --build-arg BUILD_VERSION=$(BUILD_VERSION) --build-arg RUN_TESTS=$(RUN_TESTS) --build-arg COVERALLS_TOKEN=$(COVERALLS_TOKEN)"
      - task: Docker@2
        displayName: Push image to Quay
        inputs:
          command: push
          containerRegistry: $(quayConnection)
          repository: $(imageName)
          tags: $(Build.SourceVersion)
      - script: |
          set -ex
          podman pull --authfile $(DOCKER_CONFIG)/config.json $(quay_path):$(Build.SourceVersion)
          podman tag $(quay_path):$(Build.SourceVersion) scan.connect.redhat.com/$(REDHAT_PRJ_ID)/$(redhat_prj_name):$(BUILD_VERSION)-ubi8
          podman push --authfile $(DOCKER_CONFIG)/config.json scan.connect.redhat.com/$(REDHAT_PRJ_ID)/$(redhat_prj_name):$(BUILD_VERSION)-ubi8
        condition: and(succeeded(), startsWith(variables['build.sourceBranch'], 'refs/tags/'))
        displayName: 'Push image to Redhat'
        continueOnError: true
      - script: |
          set -ex
          docker pull $(quay_path):$(Build.SourceVersion)
          docker tag $(quay_path):$(Build.SourceVersion) $(docker_repo):latest
          docker tag $(quay_path):$(Build.SourceVersion) $(docker_repo):$(BUILD_VERSION)
          patch_version=`echo $(BUILD_VERSION) | awk -F '.'  '{print $3}'`
          if [ "${patch_version}" == "0" ] ; then
            stripped_version=`echo $(BUILD_VERSION) | rev | cut -c3- | rev`
            docker tag $(quay_path):$(Build.SourceVersion) $(docker_repo):${stripped_version}
            docker push $(docker_repo):${stripped_version}
          fi
          docker push $(docker_repo):latest
          docker push $(docker_repo):$(BUILD_VERSION)
        displayName: 'Push image to DockerHub'
        condition: startsWith(variables['build.sourceBranch'], 'refs/tags/')
  - job: ScanContainerImage
    dependsOn: BuildContainerImage
    steps:
      - task: CmdLine@2
        displayName: Install Trivy
        inputs:
          script: |
            sudo apt-get install wget apt-transport-https gnupg lsb-release
            wget -qO - https://aquasecurity.github.io/trivy-repo/deb/public.key | sudo apt-key add -
            echo deb https://aquasecurity.github.io/trivy-repo/deb $(lsb_release -sc) main | sudo tee -a /etc/apt/sources.list.d/trivy.list
            sudo apt-get update
            sudo apt-get install trivy
      - task: CmdLine@2
        displayName: "Run trivy scan"
        inputs:
          script: |
            trivy image --format template --template "@junit.tpl" -o test.xml --severity HIGH,CRITICAL $(quay_path):$(Build.SourceVersion)
      - task: PublishTestResults@2
        inputs:
          testResultsFormat: 'JUnit'
          testResultsFiles: '**/test.xml'
          mergeTestResults: true
          failTaskOnFailedTests: false
          testRunTitle: 'Trivy - Vulnerabilities Summary'