bitbucket-pipelines.yml

clone:
  depth: full

definitions:
  caches:
    sonar: ~/.sonar/cache
  steps:
    - step: &build-docker-image
        name: 'Build Docker Image'
        size: 2x
        script:
          - docker build --build-arg ARCH=amd64 --tag "${BITBUCKET_REPO_SLUG}:local" .
          - docker save "${BITBUCKET_REPO_SLUG}:local" --output "${BITBUCKET_REPO_SLUG}.tar"
        services:
          - docker
        caches:
          - docker
        artifacts:
          - "*.tar"
    - step: &docker-lint
        image: hadolint/hadolint:v2.12.0-alpine
        name: 'Docker Lint'
        script:
          - echo "Linting Dockerfile(s)"
          - hadolint Dockerfile || echo "found linting issues in Dockerfile"
    - step: &build-test
        image: golang:1.22-alpine3.20
        name: 'Build & Test'
        script:
          - apk add --no-cache make bash
          - go install github.com/wadey/gocovmerge@latest
          - make clean build test
        artifacts:
          - "bin/*"
          - "coverage/*"
    - step: &go-formatter
        image: golang:1.22-alpine3.20
        name: 'Check Go Formatting'
        script:
          - gofmt -s -d $(find . -name "*.go")
    - step: &go-lint-yourself
        image: golang:1.22-alpine3.20
        name: 'Go Linter'
        script:
          - wget -O- -nv https://raw.githubusercontent.com/golangci/golangci-lint/master/install.sh | sh -s v1.54.2
          - bin/golangci-lint run ./...
    - step: &gen-sbom-for-project
          name: gen sbom
          image: debian:bookworm-slim
          services:
            - docker
          caches:
            - docker
          script:
            - apt-get update
            - DEBIAN_FRONTEND=noninteractive apt-get -y upgrade
            - apt-get install -y curl
            - curl -sSfL https://raw.githubusercontent.com/anchore/syft/main/install.sh | sh -s -- -b /usr/local/bin v1.18.0
            - docker load --input "${BITBUCKET_REPO_SLUG}.tar"
            - mkdir sbom_output
            - syft "${BITBUCKET_REPO_SLUG}:local" --output cyclonedx-json@1.4 >> sbom_output/${BITBUCKET_REPO_SLUG}_cyclonedx-sbom.json
          artifacts:
            - sbom_output/*
    - step: &sonarcloud
          name: sonarcloud scan
          size: 2x
          image: sonarsource/sonar-scanner-cli:5
          caches:
            - sonar
          script:
            - sonar-scanner

pipelines:
  pull-requests:
    '**':
      - parallel:
        - step: *docker-lint
        - step: *build-docker-image
        - step: *build-test
        - step: *go-formatter
        - step: *go-lint-yourself
      - parallel:
        - step: *sonarcloud
        - step: *gen-sbom-for-project
  branches:
    main:
      - parallel:
        - step: *docker-lint
        - step: *build-docker-image
        - step: *build-test
        - step: *go-formatter
        - step: *go-lint-yourself
      - parallel:
        - step: *sonarcloud
        - step: *gen-sbom-for-project
  custom:
    push to Dockerhub (dev):
      - step: *build-docker-image
      - step:
          name: 'Publish Dev Docker Image'
          deployment: Development
          script:
            - echo ${DOCKERHUB_PASSWORD} | docker login --username "${DOCKERHUB_USERNAME}" --password-stdin
            - docker load --input "${BITBUCKET_REPO_SLUG}.tar"
            - docker tag "${BITBUCKET_REPO_SLUG}:local" "${DOCKERHUB_NAMESPACE}/${BITBUCKET_REPO_SLUG}:${DEV_VERSION}-${BITBUCKET_BUILD_NUMBER}"
            - docker push "${DOCKERHUB_NAMESPACE}/${BITBUCKET_REPO_SLUG}:${DEV_VERSION}-${BITBUCKET_BUILD_NUMBER}"
          services:
            - docker
    Prod Release:
      - variables:
          - name: PRODUCTION_VERSION
      - step: *build-docker-image
      - stage:
          name: OSS Scan
          steps:
            - step: *gen-sbom-for-project
            - step:
                name: Scan SBOM
                script:
                    - chmod 777 sbom_output
                    - pipe: docker://ccideas/sbom-utilities-pipe:1.6.0
                      variables:
                          PATH_TO_SBOM: 'sbom_output/${BITBUCKET_REPO_SLUG}_cyclonedx-sbom.json'
                          SCAN_SBOM_WITH_BOMBER: 'true'
                          BOMBER_OUTPUT_FORMAT: 'html'
                          BOMBER_DEBUG: 'true'
                          OUTPUT_DIRECTORY: 'sbom_output'
                          SCAN_SBOM_WITH_SBOMQS: 'true'
                          SBOMQS_OUTPUT_FORMAT: 'table'
                          SCAN_SBOM_WITH_OSV: 'true'
                          OSV_OUTPUT_FORMAT: 'json'
                artifacts:
                  - sbom_output/*
      - stage:
          name: Deploy to Prod
          deployment: Production
          steps:
            - step:
                name: 'Publish Prod Docker Image'
                script:
                  - echo ${DOCKERHUB_PASSWORD} | docker login --username "${DOCKERHUB_USERNAME}" --password-stdin
                  - docker load --input "${BITBUCKET_REPO_SLUG}.tar"
                  - docker tag "${BITBUCKET_REPO_SLUG}:local" "${DOCKERHUB_NAMESPACE}/${BITBUCKET_REPO_SLUG}:${PRODUCTION_VERSION}"
                  - docker push "${DOCKERHUB_NAMESPACE}/${BITBUCKET_REPO_SLUG}:${PRODUCTION_VERSION}"
                services:
                  - docker
                caches:
                  - docker
            - step:
                name: tag branch
                image: alpine/git:1.0.26
                script:
                  - git tag -a "v${PRODUCTION_VERSION}" -m "release version ${PRODUCTION_VERSION}"
                  - git push origin "v${PRODUCTION_VERSION}"