.gitlab-ci.yml

include:
  - project: 'prodsec/scp-scanning/gitlab-checkmarx'
    ref: latest
    file: '/templates/.sast_scan.yml'
  - project: 'ci-cd/templates'
    ref: master
    file: '/prodsec/.oss-scan.yml'

image:
  name: "docker-hub.repo.splunkdev.net/eclipse-temurin:17.0.6_10-jdk"

variables:
  ANDROID_COMPILE_SDK: "34"
  ANDROID_BUILD_TOOLS: "34.0.0"
  ANDROID_COMMAND_LINE_TOOLS: "7302050"

.prepare-android-environment:
  before_script:
    - apt-get --quiet update --yes
    - apt-get --quiet install --yes wget tar unzip lib32stdc++6 lib32z1
    - wget --quiet --output-document=android-sdk.zip https://dl.google.com/android/repository/commandlinetools-linux-${ANDROID_COMMAND_LINE_TOOLS}_latest.zip
    - unzip -d android-sdk-linux android-sdk.zip
    - echo y | android-sdk-linux/cmdline-tools/bin/sdkmanager --sdk_root=. "platforms;android-${ANDROID_COMPILE_SDK}" >/dev/null
    - echo y | android-sdk-linux/cmdline-tools/bin/sdkmanager --sdk_root=. "platform-tools" >/dev/null
    - echo y | android-sdk-linux/cmdline-tools/bin/sdkmanager --sdk_root=. "build-tools;${ANDROID_BUILD_TOOLS}" >/dev/null
    - export ANDROID_SDK_ROOT=$PWD
    - export PATH=$PATH:$PWD/platform-tools/
    # temporarily disable checking for EPIPE error and use yes to accept all licenses
    - set +o pipefail
    - yes | android-sdk-linux/cmdline-tools/bin/sdkmanager --sdk_root=. --licenses
    - set -o pipefail

stages:
  - build
  - verify
  - release

build:
  stage: build
  rules:
    - if: '$CI_COMMIT_REF_NAME == "main"'
  extends: .prepare-android-environment
  script:
    - touch local.properties
    - ./gradlew build publish

sast-scan:
  stage: verify
  rules:
    - if: '$CI_COMMIT_REF_NAME == "main"'
  extends: .sast_scan
  variables:
    SAST_SCANNER: "Semgrep"
    # Fail build on high severity security vulnerabilities
    alert_mode: "policy"

oss-scan:
  extends: .oss-scan
  stage: verify
  before_script:
    - JAVA_HOME=/usr/lib/jvm/java-17-openjdk
    - PATH=$JAVA_HOME/bin:$PATH
    - touch local.properties
  rules:
    - if: '$CI_COMMIT_REF_NAME == "main"'

release:
  stage: release
  rules:
    - if: '$CI_COMMIT_TAG =~ /^v[0-9]+\.[0-9]+\.[0-9]+.*/'
  extends: .prepare-android-environment
  variables:
  script:
    - touch local.properties
    - export ORG_GRADLE_PROJECT_signingKey=$GPG_SECRET_KEY
    - export ORG_GRADLE_PROJECT_signingPassword=$GPG_PASSWORD
    - ./gradlew -Prelease=true --no-build-cache --no-daemon --rerun-tasks build signMavenPublication publishToSonatype closeAndReleaseSonatypeStagingRepository