.gitlab-ci.yml

include:
  - file: /Scan/trivy.yml
    project: jitesoft/gitlab-ci-lib
  - file: /OCI/push-readme.yml
    project: jitesoft/gitlab-ci-lib

stages:
  - readme
  - pre
  - build
  - containerize
  - runtime

update-readme:
  stage: pre
  extends: .readme-check.v2
  variables:
    PUSHRM_FILE: "$CI_PROJECT_DIR/README.md"
    GIT_DEPTH: "3"
    REGISTRIES: "quay.io/jitesoft/php,docker.io/jitesoft/php"
  tags: [ protected ]

check:
  stage: pre
  parallel:
    matrix:
      - { MINOR: "8.1", GREP_EXP: '(?<=>php-)([8]\.[1]\.[0-9]{1,2})', TAGS: "8.1", GIT_STRATEGY: "none" }
      - { MINOR: "8.2", GREP_EXP: '(?<=>php-)([8]\.[2]\.[0-9]{1,2})', TAGS: "8.2", GIT_STRATEGY: "none" }
      - { MINOR: "8.3", GREP_EXP: '(?<=>php-)([8]\.[3]\.[0-9]{1,2})', TAGS: "8.3,latest", GIT_STRATEGY: "none" }
      - { MINOR: "8.4", GREP_EXP: '(?<=>php-)([8]\.[4]\.[0-9]{1,2})', TAGS: "8,8.4,latest", GIT_STRATEGY: "none" }
  image: registry.gitlab.com/jitesoft/dockerfiles/misc:latest
  rules:
    - if: '$CI_PIPELINE_SOURCE == "schedule"'
      when: always
    - if: '$CI_PIPELINE_SOURCE == "web"'
      when: always
    - when: never
  script:
    - touch version${MINOR}.txt
    - FULL_VERSION=$(wget -qO- https://www.php.net/downloads.php | grep -oP "${GREP_EXP}" | sort -V -f | tail -n1)
    - |
      if [ ! -z "${FORCE_BUILD+x}" ] || [ "$(cat version${MINOR}.txt)" != "${FULL_VERSION}" ]; then
        echo "Triggering build of ${FULL_VERSION}"
        curl \
          -F token=${CI_JOB_TOKEN} \
          -F ref=master \
          -F "variables[PHP_KEY]=${MINOR}" \
          -F "variables[VERSION]=${FULL_VERSION}" \
          -F "variables[BUILD]=true" \
          -F "variables[TAGS]=${TAGS}" \
          -F "variables[DOWNLOAD_URL]=https://www.php.net/get/php-${FULL_VERSION}.tar.xz/from/this/mirror" \
          https://gitlab.com/api/v4/projects/${CI_PROJECT_ID}/trigger/pipeline
      else
        echo "Triggering scan of ${FULL_VERSION}"
        curl \
          -F token=${CI_JOB_TOKEN} \
          -F ref=master \
          -F "variables[VERSION]=${FULL_VERSION}" \
          -F "variables[SCAN]=true" \
          https://gitlab.com/api/v4/projects/${CI_PROJECT_ID}/trigger/pipeline
      fi
  cache:
    policy: pull
    key: php-versions
    paths:
      - version${MINOR}.txt

gpg:import:
  only:
    changes:
      - gpg-keys.txt
  image: registry.gitlab.com/jitesoft/dockerfiles/misc:latest
  stage: .pre
  script:
    - if [ -f keys.out ]; then gpg --import keys.out; fi
    - |
      for key in `cat gpg-keys.txt`; do
        gpg --list-keys ${key} || (gpg --keyserver keyserver.ubuntu.com --recv-keys "${key}" || gpg --keyserver pgp.mit.edu --recv-keys "${key}" || gpg --keyserver keyserver.pgp.com --recv-keys "${key}" || gpg --keyserver ha.pool.sks-keyservers.net --recv-keys "${key}")
      done
    - gpg --export > keys.out
  cache:
    key: php.gpg.keyring
    paths:
      - keys.out

download:
  rules:
    - if: "$BUILD"
      when: always
    - when: never
  stage: .pre
  image: registry.gitlab.com/jitesoft/dockerfiles/misc:latest
  script:
    - echo "Downloading ${VERSION}"
    - curl -sSL "${DOWNLOAD_URL}" -o php.tar.xz;
    - curl -sSL "$(echo $DOWNLOAD_URL | sed 's/tar.xz/tar.xz.asc/g')" -o php.tar.xz.asc;
    - gpg --import keys.out
    - gpg --verify php.tar.xz.asc php.tar.xz
  artifacts:
    paths:
      - php.tar.xz
    expire_in: 1 day
  cache:
    policy: pull
    key: php.gpg.keyring
    paths:
      - keys.out

.build:
  needs:
    - job: download
      artifacts: true
  image: registry.gitlab.com/jitesoft/dockerfiles/misc/buildbase/3.20:latest
  stage: build
  rules:
    - if: "$BUILD"
      when: on_success
    - when: never
  script:
    - export CCACHE_DIR="${CI_PROJECT_DIR}/ccache"
    - apk add --no-cache oniguruma-dev argon2-dev curl-dev libedit-dev libsodium-dev libxml2-dev openssl-dev sqlite-dev dpkg-dev readline-dev
    - if [ ! -d "ccache" ]; then mkdir ccache; fi
    - export PATH="/usr/lib/ccache/bin:$PATH"
    - ccache -s
    - export CPPFLAGS="${CPPFLAGS} -fstack-protector-strong -fpic -fpie -O2"
    - export CFLAGS="${CFLAGS} -fstack-protector-strong -fpic -fpie -O2"
    - mkdir src
    - tar -Jxhf php.tar.xz -C src/ --strip-components=1
    - adduser -u 82 -D -S -G www-data www-data
    - echo "Building ${VERSION}"
    - cd src
    - EXTRA=""
    - |
      ./configure ${TYPE_FLAGS} \
        --prefix=/usr/local \
        --disable-short-tags \
        --build="$(cat /etc/apk/arch)-linux-musl" \
        --host="$(cat /etc/apk/arch)-linux-musl" \
        --with-config-file-path=/usr/local/etc/php \
        --with-config-file-scan-dir=/usr/local/etc/php/conf.d \
        --enable-option-checking=fatal \
        --with-pic \
        --with-openssl \
        --with-sodium \
        --with-mhash \
        --with-readline \
        --with-password-argon2 \
        --with-mysqli \
        --with-pdo-mysql \
        --with-pear \
        --with-pdo-sqlite=/usr \
        --with-sqlite3=/usr \
        --with-zlib \
        --with-curl \
        --enable-exif \
        --enable-calendar \
        --enable-ftp \
        --enable-mbstring \
        --enable-mysqlnd
    - make --jobs=2 -i V= | awk 'NR%20==0 {print NR,$0}'
    - find -type f -name '*.a' -delete
    - make install
    - cp php.ini-* /usr/local/
  after_script:
    - ccache -s
    - rm -f /usr/local/bin/phpdbg
    - cp scripts/* /usr/local/bin/
    - $(cd /usr/local && tar -czf /tmp/php-${ARCH}-${BUILD_TYPE}.tar.gz *)
    - mkdir binaries
    - mv /tmp/php-${ARCH}-${BUILD_TYPE}.tar.gz binaries/
  cache:
    paths:
      - ccache
    key: "php.build.ccache-${ARCH}-${BUILD_TYPE}-${PHP_KEY}"
  artifacts:
    paths:
      - binaries/
    when: on_success
    expire_in: 1 day

build:amd:
  tags:
    - "native-amd64"
  extends: .build
  parallel:
    matrix:
      - { TYPE_FLAGS: "--enable-phpdbg --enable-phpdbg-readline", BUILD_TYPE: "cli", ARCH: "amd64" }
      - { TYPE_FLAGS: "--enable-fpm --disable-phpdbg --with-fpm-user=www-data --with-fpm-group=www-data", BUILD_TYPE: "fpm", ARCH: "amd64" }

build:arm:
  tags:
    - "native-aarch64"
  extends: .build
  parallel:
    matrix:
      - { TYPE_FLAGS: "--enable-phpdbg --enable-phpdbg-readline", BUILD_TYPE: "cli", ARCH: "arm64" }
      - { TYPE_FLAGS: "--enable-fpm --disable-phpdbg --with-fpm-user=www-data --with-fpm-group=www-data", BUILD_TYPE: "fpm", ARCH: "arm64" }

.containerize:
  needs:
    - job: build:amd
      artifacts: true
    - job: build:arm
      artifacts: true
    - job: download
      artifacts: true
  rules:
    - if: "$BUILD"
      when: on_success
    - when: never
  stage: containerize
  image: registry.gitlab.com/jitesoft/dockerfiles/misc:latest
  script:
    - mv php.tar.xz binaries/
    - docker buildx build --sbom=true --provenance=true --platform linux/amd64,linux/arm64 --progress plain --push ${TAG_LIST} --build-arg BUILD_TIME="$(date -Iseconds)" --build-arg PHP_MINOR="${PHP_KEY}" --build-arg PHP_VERSION="${VERSION}" --build-arg BUILD_TYPE="${PHP_TYPE}" .
  tags: [ buildx, protected ]

containerize.cli:
  extends: .containerize
  variables:
    PHP_TYPE: "cli"
  before_script:
    - |
      TAGS="${TAGS},${VERSION},${PHP_KEY}"
      CLI_TAGS=""; counter=0
      for tag in ${TAGS//,/ }; do
        if [ $counter == 0 ]; then
          CLI_TAGS="${tag}-cli"
        else
          CLI_TAGS="${CLI_TAGS},${tag}-cli"
        fi
        counter=$((counter+1))
      done
    - TAG_LIST="$(helper ${CI_REGISTRY_IMAGE}/cli ${TAGS}) $(helper ghcr.io/jitesoft/php,jitesoft/php,quay.io/jitesoft/php ${CLI_TAGS},${TAGS})"

containerize.fpm:
  extends: .containerize
  variables:
    PHP_TYPE: "fpm"
  before_script:
    - printf 'EXPOSE 9000\nCMD ["php-fpm"]' >> Dockerfile
    - |
      TAGS="${TAGS},${VERSION},${PHP_KEY}"
      FPM_TAGS=""; counter=0
      for tag in ${TAGS//,/ }; do
        if [ $counter == 0 ]; then
          FPM_TAGS="${tag}-fpm"
        else
          FPM_TAGS="${FPM_TAGS},${tag}-fpm"
        fi
        counter=$((counter+1))
      done
    - TAG_LIST="$(helper ${CI_REGISTRY_IMAGE}/fpm ${TAGS}) $(helper ghcr.io/jitesoft/php,jitesoft/php,quay.io/jitesoft/php ${FPM_TAGS})"

containerize.runtime:
  needs:
    - job: containerize.fpm
      artifacts: false
    - job: containerize.cli
      artifacts: false
  rules:
    - if: "$BUILD"
      when: always
    - when: never
  parallel:
    matrix:
      - { PHP_TYPE: "cli" }
      - { PHP_TYPE: "fpm" }
  stage: runtime
  image: registry.gitlab.com/jitesoft/dockerfiles/misc:latest
  script:
    - TAGS="${TAGS},${VERSION},${PHP_KEY}"
    - TAG_LIST="$(helper ${CI_REGISTRY_IMAGE}/runtime/${PHP_TYPE} ${TAGS})"
    - |
      TAGS="${TAGS},${VERSION},${PHP_KEY}"
      EX_TAGS=""; counter=0
      for tag in ${TAGS//,/ }; do
        if [ $counter == 0 ]; then
          EX_TAGS="${tag}-runtime-${PHP_TYPE}"
        else
          EX_TAGS="${EX_TAGS},${tag}-runtime-${PHP_TYPE}"
        fi
        counter=$((counter+1))
      done
    - TAG_LIST="${TAG_LIST} $(helper ghcr.io/jitesoft/php,jitesoft/php,quay.io/jitesoft/php ${EX_TAGS})"
    - docker buildx build --sbom=true --provenance=true --platform linux/amd64,linux/arm64 --progress plain --push ${TAG_LIST} --build-arg BUILD_TIME="$(date -Iseconds)" --build-arg PHP_MINOR="${PHP_KEY}" --build-arg PHP_VERSION="${VERSION}" --build-arg PHP_TYPE="${PHP_TYPE}" -f runtime/Dockerfile .
  tags: [ buildx, protected ]

create:cache:
  rules:
    - if: "$BUILD"
      when: on_success
    - when: never
  needs:
    - job: containerize.fpm
      artifacts: false
    - job: containerize.cli
      artifacts: false
    - job: containerize.runtime
      artifacts: false
  stage: .post
  image: registry.gitlab.com/jitesoft/dockerfiles/misc:latest
  script:
    - echo "${VERSION}" > "version${PHP_KEY}.txt"
  cache:
    key: php-versions
    policy: pull-push
    paths:
      - version8.4.txt
      - version8.3.txt
      - version8.2.txt
      - version8.1.txt

scan:
  stage: .post
  extends: .scan.container.trivy.remote
  rules:
    - if: "$SCAN"
      when: always
    - if: "$BUILD"
      when: on_success
    - when: never
  parallel:
    matrix:
      - { IMAGE: "fpm" }
      - { IMAGE: "cli" }
      - { IMAGE: "runtime/fpm" }
      - { IMAGE: "runtime/cli" }
  before_script:
    - export SCANNING_IMAGE_NAME="${CI_REGISTRY_IMAGE}/${IMAGE}:${VERSION}"