.gitlab-ci.yml

include:
  - "/tests/integration/aval/aval-tests.yml"

# TODO: GitLab's documentation recommends specifying a version:
#       See https://docs.gitlab.com/ee/ci/docker/using_docker_build.html#use-docker-in-docker
#       Also in the services attribute.
image: docker:latest

variables:
  RELEASE_TYPE:
    value: "official"
    description: "Type of pipeline to run. Allowed values: 'official', 'early-access' or 'internal'."

  DEBIAN_RELEASE: "bullseye-slim"
  # Pipeline Settings
  GIT_CLONE_PATH: $CI_BUILDS_DIR/$CI_CONCURRENT_ID/$CI_PROJECT_PATH
  GET_SOURCES_ATTEMPTS: 3
  # Container version:
  TORIZONCORE_BUILDER_MAJOR: "3"
  TORIZONCORE_BUILDER_MINOR: "12"
  TORIZONCORE_BUILDER_PATCH: "0"
  # This should be set by docker image already, just to be sure...
  DOCKER_HOST: tcp://docker:2375
  DOCKER_TLS_CERTDIR: ""
  # Use overlayfs driver for better performance
  DOCKER_DRIVER: overlay2
  DOCKER_BUILDKIT: 1
  GITLAB_DOCKERREGISTRY_SUFFIX: ${CI_COMMIT_REF_SLUG}-${CI_PIPELINE_ID}
  GITLAB_DOCKERREGISTRY_SUFFIX_LATEST: ${CI_COMMIT_REF_SLUG}-latest
  # TC image default versions:
  TEST_IMAGES_TC6_VERSION: "6.2.0"
  TEST_IMAGE_TC6_32BIT: "torizon-core-docker-colibri-imx7-emmc-Tezi_6.2.0-devel-20230324+build.220.tar"
  TEST_IMAGE_TC6_64BIT: "torizon-core-docker-apalis-imx8-Tezi_6.2.0-devel-20230324+build.220.tar"
  TEST_IMAGES_TOS7_VERSION: "7.0.0"
  TEST_IMAGE_TOS7_32BIT: "torizon-docker-apalis-imx6-Tezi_7.0.0-devel-20240830+build.40.tar"
  TEST_IMAGE_TOS7_64BIT: "torizon-docker-apalis-imx8-Tezi_7.0.0-devel-20240830+build.40.tar"
  # Common Torizon .wic/.img images:
  TEST_IMAGES_TC_COMMON_VERSION: "6.6.0-common"
  TEST_IMAGE_TC_COMMON_INTEL: "torizon-core-common-docker-dev-intel-corei7-64-20240226043251.rootfs.wic"
  TEST_IMAGE_TC_COMMON_RASPI4: "torizon-core-common-docker-dev-v6.6.0-common-raspberrypi4-64.img"
  # TC custom image parameters
  INTERNAL_ARTIFACTORY_URL: "" # "https://artifactory-horw.int.toradex.com/artifactory"
  ARTIFACTORY_SRC_REPO: "" # "devtorizoncore-oe-prerelease-horw"
  BUILD_DISTRO: "" # "torizon-upstream"
  BUILD_MACHINE: "" # "colibri-imx6"
  BUILD_MANIFEST_BRANCH: "" # "dunfell-5.x.y"
  BUILD_PIPELINETYPE: "" # "nightly"
  BUILD_RECIPE: "" # "torizon-core-docker""
  DISTRO_VERSION: "" # "5.7.3-devel-20230502+build.25"
  MATRIX_BUILD_NUMBER: "" # "25""
  # Set to "echo" for dry running specific actions:
  D: ""        # deployment actions
  T: ""        # test actions
  B: ""        # build actions

services:
  - name: docker:dind

stages:
  - pre-build
  - build
  - test-platform
  - test
  - build-multiarch
  - deploy
  - deploy-multiarch
  - tag

lint-dockerfiles:
  stage: pre-build
  image: hadolint/hadolint:latest-debian
  script:
    # Some rules cannot be applied in our specific cases.
    # However, since we don't want to completely ignore these rules,
    # we are changing the following rules to have the level "info":
    # - DL3003 (use WORKDIR to switch to a directory)
    # - DL3008 (pin versions in apt-get install)
    # - DL3029 (do not use --platform flag with FROM)
    # - DL4006 (set the SHELL option -o pipefail before RUN with a pipe in it)
    - ${T} hadolint *Dockerfile
           --failure-threshold warning
           --info DL3003 --info DL3008 --info DL3029 --info DL4006

lint-python:
  stage: pre-build
  script:
    # Refresh a cached image with pylint and all employed libraries.
    - ${T} docker login -u "${CI_REGISTRY_USER}" -p "${CI_REGISTRY_PASSWORD}" "${CI_REGISTRY}"
    - ${T} docker login -u "${CI_DOCKER_HUB_PULL_USER}" -p "${CI_DOCKER_HUB_PULL_PASSWORD}"
    - ${T} docker build -f torizoncore-builder.Dockerfile
                        --cache-from "${CI_REGISTRY_IMAGE}/tcbuilder-dev-latest"
                        --build-arg IMAGE_ARCH=linux/amd64
                        --target tcbuilder-dev
                        --tag tcbuilder-dev-amd64
                        .
    - ${T} docker tag tcbuilder-dev-amd64 "${CI_REGISTRY_IMAGE}/tcbuilder-dev-latest"
    - ${T} docker push "${CI_REGISTRY_IMAGE}/tcbuilder-dev-latest"
    # Run the code linter disabling only docstring related warnings, use this run as exit code
    # IMPORTANT: when running locally, DO NOT pass these --disable arguments to the program
    - ${T} docker run --rm -v $(pwd):/work -w /work ${CI_REGISTRY_IMAGE}/tcbuilder-dev-latest
           pylint --output-format=colorized
                  --disable=missing-module-docstring
                  --disable=missing-class-docstring
                  --disable=missing-function-docstring
                  --disable=fixme
                  $(find tcbuilder/ -type f -name "*.py") *.py || exit_code=$?
    - exit ${exit_code}

# Docker image builds
#
# Build the Docker images  specified in DOCKERFILE_FOLDER/IMAGE_NAME and push
# it to Gitlab's internal Docker registry
.build-base:
  stage: build
  variables:
    IMAGE_TAG: ${DEBIAN_RELEASE}
  before_script:
    - export DATE=$(date +%Y%m%d)
    - docker login -u "${CI_REGISTRY_USER}" -p "${CI_REGISTRY_PASSWORD}" "${CI_REGISTRY}"
    - docker login -u "${CI_DOCKER_HUB_PULL_USER}" -p "${CI_DOCKER_HUB_PULL_PASSWORD}"
    - if [ "${RELEASE_TYPE}" = "official" ]; then
         export VERSION_SUFFIX="";
      else
         export VERSION_SUFFIX="+${RELEASE_TYPE}";
      fi
  script:
    - ${B} docker build -f "${DOCKERFILE_NAME}"
                        --build-arg "IMAGE_ARCH=${IMAGE_ARCH}"
                        --build-arg "IMAGE_TAG=${IMAGE_TAG}"
                        --build-arg "VERSION_SUFFIX=${VERSION_SUFFIX}"
                        --label "container.name=${IMAGE_NAME}"
                        --label "container.version=${TORIZONCORE_BUILDER_MAJOR}.${TORIZONCORE_BUILDER_MINOR}.${TORIZONCORE_BUILDER_PATCH}-${DATE}"
                        --label "git.branch=${CI_COMMIT_BRANCH}"
                        --label "git.hash=${CI_COMMIT_SHA}"
                        --label "pipeline.id=${CI_PIPELINE_ID}"
                        -t "${CI_REGISTRY_IMAGE}/${IMAGE_NAME}:${GITLAB_DOCKERREGISTRY_SUFFIX}"
                        -t "${CI_REGISTRY_IMAGE}/${IMAGE_NAME}:${GITLAB_DOCKERREGISTRY_SUFFIX_LATEST}"
                        .
    - ${B} docker push "${CI_REGISTRY_IMAGE}/${IMAGE_NAME}:${GITLAB_DOCKERREGISTRY_SUFFIX}"
    - ${B} docker push "${CI_REGISTRY_IMAGE}/${IMAGE_NAME}:${GITLAB_DOCKERREGISTRY_SUFFIX_LATEST}"

build-amd64:
  extends: .build-base
  variables:
    IMAGE_ARCH: linux/amd64
    IMAGE_NAME: torizoncore-builder-amd64
    DOCKERFILE_NAME: torizoncore-builder.Dockerfile

# TODO: Consider removing arm64 completely.
build-arm64:
  extends: .build-base
  timeout: 5h
  when: manual
  variables:
    IMAGE_ARCH: linux/arm64/v8
    IMAGE_NAME: torizoncore-builder-arm64
    DOCKERFILE_NAME: torizoncore-builder.Dockerfile

.test-base:
  stage: test
  rules:
    # Following condition is needed to avoid the execution of merge-request pipelines.
    - if: '$CI_PIPELINE_SOURCE == "merge_request_event"'
      when: never
    # Following condition prevents execution with custom TorizonCore images (triggered by Jenkins).
    - if: $BUILD_MACHINE
      when: never
    - when: on_success
  variables:
    IMAGE_NAME: torizoncore-builder-amd64
    # Don't run 'platform' tests
    TCB_TESTCASES_32BIT: "torizoncore-builder images images-unpack images-download images-serve union deploy isolate dt dto build bundle bundle-registry combine kernel ostree push splash"
    TCB_TESTCASES_64BIT: "dt dto kernel"
  before_script:
    # setup environment for the tests
    - apk update && apk add git sshpass zstd wget bash tar openssl zip
    - cd tests/integration/
    - mkdir -p workdir/reports && rm -Rf workdir/reports/*
    - TCB_SKIP_PULL=1 ./setup.sh
    # pull latest build of TorizonCore Builder
    - echo -e "\e[0Ksection_start:$(date +%s):pull_eval_tcb_section\r\e[0KPull TorizonCore Builder to be evaluated"
    - ${T} docker login -u "${CI_DOCKER_HUB_PULL_USER}" -p "${CI_DOCKER_HUB_PULL_PASSWORD}"
    - ${T} docker login -u "${CI_REGISTRY_USER}" -p "${CI_REGISTRY_PASSWORD}" "${CI_REGISTRY}"
    - ${T} docker pull "${CI_REGISTRY_IMAGE}/${IMAGE_NAME}:${GITLAB_DOCKERREGISTRY_SUFFIX}"
    - echo -e "\e[0Ksection_end:$(date +%s):pull_eval_tcb_section\r\e[0K"
    # TODO: Switch to Bash and use tcb-env-setup.sh script later
    - export TCBCMD="docker run --rm -v /deploy -v $(pwd)/workdir:/workdir -v storage:/storage --net=host -v /var/run/docker.sock:/var/run/docker.sock ${CI_REGISTRY_IMAGE}/${IMAGE_NAME}:${GITLAB_DOCKERREGISTRY_SUFFIX}"
  script:
    # prepare images
    - echo -e "\e[0Ksection_start:$(date +%s):download_tzimgs_section\r\e[0KDownload TorizonCore test images"
    - mkdir -p workdir/images
    - 'wget --progress=dot:giga --header "PRIVATE-TOKEN: ${ACCESS_TOKEN}" ${CI_API_V4_URL}/projects/907/packages/generic/images/${TEST_IMAGES_VERSION}/${TEST_IMAGE_32BIT} -O workdir/images/${TEST_IMAGE_32BIT}'
    - 'wget --progress=dot:giga --header "PRIVATE-TOKEN: ${ACCESS_TOKEN}" ${CI_API_V4_URL}/projects/907/packages/generic/images/${TEST_IMAGES_VERSION}/${TEST_IMAGE_64BIT} -O workdir/images/${TEST_IMAGE_64BIT}'
    - touch workdir/images/.images_downloaded
    - echo -e "\e[0Ksection_end:$(date +%s):download_tzimgs_section\r\e[0K"
    # run tests (32-bit device)
    - TCB_MACHINE=$(echo "${TEST_IMAGE_32BIT}" | sed -E 's/^torizon(-core)?-docker-(evaluation-)?(.*)-Tezi.*$/\3/')
    - echo -e "\e[0Ksection_start:$(date +%s):test_32bit_section\r\e[0KRun ${TCB_MACHINE} tests"
    - TCB_REPORT=1 TCB_UNDER_CI=1 TCB_MACHINE=${TCB_MACHINE} TCB_TESTCASE=${TCB_TESTCASES_32BIT} ${T} ./run.sh
    - echo -e "\e[0Ksection_end:$(date +%s):test_32bit_section\r\e[0K"
    # run test (64-bit device)
    - TCB_MACHINE=$(echo "${TEST_IMAGE_64BIT}" | sed -E 's/^torizon(-core)?-docker-(evaluation-)?(.*)-Tezi.*$/\3/')
    - echo -e "\e[0Ksection_start:$(date +%s):test_64bit_section\r\e[0KRun ${TCB_MACHINE} tests"
    - TCB_REPORT=1 TCB_UNDER_CI=1 TCB_MACHINE=${TCB_MACHINE} TCB_TESTCASE=${TCB_TESTCASES_64BIT} ${T} ./run.sh
    - echo -e "\e[0Ksection_end:$(date +%s):test_64bit_section\r\e[0K"
    # check results
    - (! grep "^not ok" workdir/reports/*)

test-platform-tc6:
  extends: .test-base
  stage: test-platform
  variables:
    TEST_IMAGES_VERSION: ${TEST_IMAGES_TC6_VERSION}
    TEST_IMAGE_32BIT: ${TEST_IMAGE_TC6_32BIT}
    TEST_IMAGE_64BIT: ${TEST_IMAGE_TC6_64BIT}
    TCB_TESTCASES_32BIT: "torizoncore-builder"
    TCB_TESTCASES_64BIT: "platform"

test-platform-tos7:
  extends: .test-base
  stage: test-platform
  needs: ["test-platform-tc6"]
  variables:
    TEST_IMAGES_VERSION: ${TEST_IMAGES_TOS7_VERSION}
    TEST_IMAGE_32BIT: ${TEST_IMAGE_TOS7_32BIT}
    TEST_IMAGE_64BIT: ${TEST_IMAGE_TOS7_64BIT}
    TCB_TESTCASES_32BIT: "platform"
    TCB_TESTCASES_64BIT: "torizoncore-builder"

test-torizoncore6:
  extends: .test-base
  variables:
    TEST_IMAGES_VERSION: ${TEST_IMAGES_TC6_VERSION}
    TEST_IMAGE_32BIT: ${TEST_IMAGE_TC6_32BIT}
    TEST_IMAGE_64BIT: ${TEST_IMAGE_TC6_64BIT}

test-torizonos7:
  extends: .test-base
  variables:
    TEST_IMAGES_VERSION: ${TEST_IMAGES_TOS7_VERSION}
    TEST_IMAGE_32BIT: ${TEST_IMAGE_TOS7_32BIT}
    TEST_IMAGE_64BIT: ${TEST_IMAGE_TOS7_64BIT}

test-torizoncore-common:
  extends: .test-base
  script:
    # prepare image
    - echo -e "\e[0Ksection_start:$(date +%s):download_rawimgs_section\r\e[0KDownload WIC/raw test images"
    - mkdir -p workdir/images
    - 'wget --progress=dot:giga --header "PRIVATE-TOKEN: ${ACCESS_TOKEN}" ${CI_API_V4_URL}/projects/907/packages/generic/images/${TEST_IMAGES_TC_COMMON_VERSION}/${TEST_IMAGE_TC_COMMON_INTEL} -O workdir/images/${TEST_IMAGE_TC_COMMON_INTEL}'
    - 'wget --progress=dot:giga --header "PRIVATE-TOKEN: ${ACCESS_TOKEN}" ${CI_API_V4_URL}/projects/907/packages/generic/images/${TEST_IMAGES_TC_COMMON_VERSION}/${TEST_IMAGE_TC_COMMON_RASPI4} -O workdir/images/${TEST_IMAGE_TC_COMMON_RASPI4}'
    - touch workdir/images/.raw_images_downloaded
    - echo -e "\e[0Ksection_end:$(date +%s):download_rawimgs_section\r\e[0K"
    # run tests (Intel)
    - TCB_MACHINE=$(echo "${TEST_IMAGE_TC_COMMON_INTEL}" | sed -E 's/^torizon(-core)?-common-docker-dev-(evaluation-)?(.*)-.*$/\3/')
    - echo -e "\e[0Ksection_start:$(date +%s):test_intel64_section\r\e[0KRun ${TCB_MACHINE} tests"
    - TCB_REPORT=1 TCB_UNDER_CI=1 TCB_MACHINE=${TCB_MACHINE} ${T} ./run.sh
    - echo -e "\e[0Ksection_end:$(date +%s):test_intel64_section\r\e[0K"
    # run tests (Raspberry Pi 4)
    - TCB_MACHINE=$(echo "${TEST_IMAGE_TC_COMMON_RASPI4}" | sed -E 's/^torizon(-core)?-common-docker-dev-(evaluation-)?(v.*-)?(.*-..).*$/\4/')
    - echo -e "\e[0Ksection_start:$(date +%s):test_rasp4_64_section\r\e[0KRun ${TCB_MACHINE} tests"
    - TCB_REPORT=1 TCB_UNDER_CI=1 TCB_MACHINE=${TCB_MACHINE} ${T} ./run.sh
    - echo -e "\e[0Ksection_end:$(date +%s):test_rasp4_64_section\r\e[0K"
    # check results
    - (! grep "^not ok" workdir/reports/*)

# Job mostly triggered by Jenkins.
test-torizoncore:
  extends: .test-base
  variables:
    # Don't run 'platform' tests
    TCB_TESTS: "torizoncore-builder images images-unpack images-download images-serve union deploy isolate dt dto build bundle bundle-registry combine kernel ostree push splash"
  rules:
    # Following condition is needed to avoid the execution of merge-request pipelines.
    - if: '$CI_PIPELINE_SOURCE == "merge_request_event"'
      when: never
    - if: $BUILD_MACHINE
  script:
    - if [ -z ${INTERNAL_ARTIFACTORY_URL} ]; then echo "Missing variable INTERNAL_ARTIFACTORY_URL." && exit1; fi
    - if [ -z ${ARTIFACTORY_SRC_REPO} ]; then echo "Missing variable ARTIFACTORY_SRC_REPO." && exit 1; fi
    - if [ -z ${BUILD_MANIFEST_BRANCH} ]; then echo "Missing variable BUILD_MANIFEST_BRANCH." && exit 1; fi
    - if [ -z ${BUILD_PIPELINETYPE} ]; then echo "Missing variable BUILD_PIPELINETYPE." && exit 1; fi
    - if [ -z ${BUILD_MACHINE} ]; then echo "Missing variable BUILD_MACHINE." && exit 1; fi
    - if [ -z ${BUILD_RECIPE} ]; then echo "Missing variable BUILD_RECIPE." && exit 1; fi
    - if [ -z ${BUILD_DISTRO} ]; then echo "Missing variable BUILD_DISTRO." && exit 1; fi
    - if [ -z ${DISTRO_VERSION} ]; then echo "Missing variable DISTRO_VERSION." && exit 1; fi
    - if [ -z ${MATRIX_BUILD_NUMBER} ]; then echo "Missing variable MATRIX_BUILD_NUMBER." && exit 1; fi
    # prepare images
    - echo -e "\e[0Ksection_start:$(date +%s):download_tzimgs_section\r\e[0KDownload TorizonCore test images"
    - mkdir -p workdir/images
    - "TEST_IMAGE_TORIZONCORE_URL=${INTERNAL_ARTIFACTORY_URL}/${ARTIFACTORY_SRC_REPO}\
        /${BUILD_MANIFEST_BRANCH}/${BUILD_PIPELINETYPE}/${MATRIX_BUILD_NUMBER}\
        /${BUILD_MACHINE}/${BUILD_DISTRO}/${BUILD_RECIPE}/oedeploy\
        /${BUILD_RECIPE}-${BUILD_MACHINE}-Tezi_${DISTRO_VERSION}.tar"
    - 'wget --progress=dot:giga ${TEST_IMAGE_TORIZONCORE_URL} -P workdir/images/'
    - touch workdir/images/.images_downloaded
    - echo -e "\e[0Ksection_end:$(date +%s):download_tzimgs_section\r\e[0K"
    # run tests (32-bit device)
    - echo -e "\e[0Ksection_start:$(date +%s):test_section\r\e[0KRun ${BUILD_MACHINE} tests"
    - TCB_REPORT=1 TCB_UNDER_CI=1 TCB_MACHINE=${BUILD_MACHINE} TCB_TESTCASE=${TCB_TESTS} ${T} ./run.sh
    - echo -e "\e[0Ksection_end:$(date +%s):test_section\r\e[0K"
    # check results
    - (! grep "^not ok" workdir/reports/*)

# Enable experimental features in Docker client (experimental feature are needed for manifest)
.do_docker_experimental: &do_docker_experimental
    - mkdir -p $HOME/.docker
    - "echo -e '{\n  \"experimental\": \"enabled\"\n}' | tee $HOME/.docker/config.json"
    - docker version

.build-multiarch-base:
  before_script:
    - *do_docker_experimental
    - rm -rf ~/.docker/manifests/*
  script:
    - ${D} docker login -u "${CI_REGISTRY_USER}" -p "${CI_REGISTRY_PASSWORD}" "${CI_REGISTRY}"
    - ${D} docker pull "${CI_REGISTRY_IMAGE}/${IMAGE_NAME_AMD64}:${GITLAB_DOCKERREGISTRY_SUFFIX}"
    - ${D} docker manifest create "${CI_REGISTRY_IMAGE}/${IMAGE_NAME}:${GITLAB_DOCKERREGISTRY_SUFFIX_LATEST}" "${CI_REGISTRY_IMAGE}/${IMAGE_NAME_AMD64}:${GITLAB_DOCKERREGISTRY_SUFFIX}"
    - ${D} docker manifest annotate "${CI_REGISTRY_IMAGE}/${IMAGE_NAME}:${GITLAB_DOCKERREGISTRY_SUFFIX_LATEST}" "${CI_REGISTRY_IMAGE}/${IMAGE_NAME_AMD64}:${GITLAB_DOCKERREGISTRY_SUFFIX}" --os linux --arch amd64
    - ${D} docker manifest inspect -v "${CI_REGISTRY_IMAGE}/${IMAGE_NAME}:${GITLAB_DOCKERREGISTRY_SUFFIX_LATEST}"
    - ${D} docker manifest push "${CI_REGISTRY_IMAGE}/${IMAGE_NAME}:${GITLAB_DOCKERREGISTRY_SUFFIX_LATEST}"

# TODO: Note that this multiarch image is not actually used for anything at the moment.
#       Maybe the goal is to allow debugging before pushing a (different) multi-arch image to DockerHub?
build-multiarch:
  extends: .build-multiarch-base
  rules:
    # Following condition is needed to avoid the execution of merge-request pipelines.
    - if: '$CI_PIPELINE_SOURCE == "merge_request_event"'
      when: never
    # Following condition prevents execution with custom TorizonCore images (triggered by Jenkins).
    - if: $BUILD_MACHINE
      when: never
    - if: '$RELEASE_TYPE == "early-access"'
      when: on_success
    - when: manual
  variables:
    IMAGE_NAME: torizoncore-builder
    IMAGE_NAME_AMD64: torizoncore-builder-amd64
  stage: build-multiarch

# ---
# Reusable deployment jobs
# ---

# Deploy to Docker Hub
#
# Inputs (variables):
# - DOCKER_HUB_REPOSITORY
# - DOCKER_HUB_USER
# - DOCKER_HUB_TOKEN
#
# IMPORTANT: Make sure above variables are set properly in your Gitlab CI settings.
#
.deploy-dh-base:
  before_script:
    - *do_docker_experimental
  script:
    - ${D} docker login -u "${CI_REGISTRY_USER}" -p "${CI_REGISTRY_PASSWORD}" "${CI_REGISTRY}"
    - ${D} docker pull "${CI_REGISTRY_IMAGE}/${IMAGE_NAME}:${GITLAB_DOCKERREGISTRY_SUFFIX}"
    - ${D} docker login -u "${DOCKER_HUB_USER}" -p "${DOCKER_HUB_TOKEN}"
    - for tag in ${DOCKER_TAGS_CHECK};
        do
          ${D} docker manifest inspect "${DOCKER_HUB_REPOSITORY}/${IMAGE_NAME}:${tag}" > /dev/null && true; RESULT=$?;
          (if [ $RESULT == 0 ] ; then echo "Image with ${tag} tag already exists." && ${D} exit 1; fi);
        done
    - for tag in ${DOCKER_TAGS} ${DOCKER_TAGS_CHECK};
        do
          ${D} docker tag "${CI_REGISTRY_IMAGE}/${IMAGE_NAME}:${GITLAB_DOCKERREGISTRY_SUFFIX}" "${DOCKER_HUB_REPOSITORY}/${IMAGE_NAME}:${tag}";
          ${D} docker push "${DOCKER_HUB_REPOSITORY}/${IMAGE_NAME}:${tag}";
        done

.deploy-dh-multiarch-base:
  before_script:
    - *do_docker_experimental
    - rm -rf ~/.docker/manifests/*
  script:
    - ${D} docker login -u "${DOCKER_HUB_USER}" -p "${DOCKER_HUB_TOKEN}"
    - for tag in ${DOCKER_TAGS_CHECK};
        do
          ${D} docker manifest inspect "${DOCKER_HUB_REPOSITORY}/${IMAGE_NAME}:${tag}" > /dev/null && true; RESULT=$?;
          (if [ $RESULT == 0 ] ; then echo "Image with ${tag} tag already exists." && ${D} exit 1; fi);
        done
    - for tag in ${DOCKER_TAGS} ${DOCKER_TAGS_CHECK};
        do
          ${D} docker manifest create "${DOCKER_HUB_REPOSITORY}/${IMAGE_NAME}:${tag}" "${DOCKER_HUB_REPOSITORY}/${IMAGE_NAME_AMD64}:${tag}";
          ${D} docker manifest annotate "${DOCKER_HUB_REPOSITORY}/${IMAGE_NAME}:${tag}" "${DOCKER_HUB_REPOSITORY}/${IMAGE_NAME_AMD64}:${tag}" --os linux --arch amd64;
          ${D} docker manifest inspect -v "${DOCKER_HUB_REPOSITORY}/${IMAGE_NAME}:${tag}";
          ${D} docker manifest push "${DOCKER_HUB_REPOSITORY}/${IMAGE_NAME}:${tag}";
        done

# Deploy to internal registry
#
.deploy-int-base:
  before_script:
    - *do_docker_experimental
  script:
    - ${D} docker login -u "${CI_REGISTRY_USER}" -p "${CI_REGISTRY_PASSWORD}" "${CI_REGISTRY}"
    - ${D} docker pull "${CI_REGISTRY_IMAGE}/${IMAGE_NAME}:${GITLAB_DOCKERREGISTRY_SUFFIX}"
    - for tag in ${DOCKER_TAGS_CHECK};
        do
          ${D} docker manifest inspect "${CI_REGISTRY_IMAGE}/${IMAGE_NAME_DEST}:${tag}" > /dev/null && true; RESULT=$?;
          (if [ $RESULT == 0 ] ; then echo "Image with ${tag} tag already exists." && ${D} exit 1; fi);
        done
    - for tag in ${DOCKER_TAGS} ${DOCKER_TAGS_CHECK};
        do
          ${D} docker tag "${CI_REGISTRY_IMAGE}/${IMAGE_NAME}:${GITLAB_DOCKERREGISTRY_SUFFIX}" "${CI_REGISTRY_IMAGE}/${IMAGE_NAME_DEST}:${tag}";
          ${D} docker push "${CI_REGISTRY_IMAGE}/${IMAGE_NAME_DEST}:${tag}";
        done

.deploy-int-multiarch-base:
  before_script:
    - *do_docker_experimental
    - rm -rf ~/.docker/manifests/*
  script:
    - ${D} docker login -u "${CI_REGISTRY_USER}" -p "${CI_REGISTRY_PASSWORD}" "${CI_REGISTRY}"
    - for tag in ${DOCKER_TAGS_CHECK};
        do
          ${D} docker manifest inspect "${CI_REGISTRY_IMAGE}/${IMAGE_NAME_DEST}:${tag}" > /dev/null && true; RESULT=$?;
          (if [ $RESULT == 0 ] ; then echo "Image with ${tag} tag already exists." && ${D} exit 1; fi);
        done
    - for tag in ${DOCKER_TAGS} ${DOCKER_TAGS_CHECK};
        do
          ${D} docker manifest create "${CI_REGISTRY_IMAGE}/${IMAGE_NAME_DEST}:${tag}" "${CI_REGISTRY_IMAGE}/${IMAGE_NAME_AMD64}:${tag}";
          ${D} docker manifest annotate "${CI_REGISTRY_IMAGE}/${IMAGE_NAME_DEST}:${tag}" "${CI_REGISTRY_IMAGE}/${IMAGE_NAME_AMD64}:${tag}" --os linux --arch amd64;
          ${D} docker manifest inspect -v "${CI_REGISTRY_IMAGE}/${IMAGE_NAME_DEST}:${tag}";
          ${D} docker manifest push "${CI_REGISTRY_IMAGE}/${IMAGE_NAME_DEST}:${tag}";
        done

# ---
# Official deployment to Docker Hub (used when RELEASE_TYPE is "official")
# ---

deploy-official-amd64:
  extends: .deploy-dh-base
  stage: deploy
  rules:
    # Following condition is needed to avoid the execution of merge-request pipelines.
    - if: '$CI_PIPELINE_SOURCE == "merge_request_event"'
      when: never
    # Following condition prevents execution with custom TorizonCore images (triggered by Jenkins).
    - if: $BUILD_MACHINE
      when: never
    - if: '$RELEASE_TYPE == "official"'
      when: manual
    - when: never
  allow_failure: false
  before_script:
    - export MAJOR="${TORIZONCORE_BUILDER_MAJOR}"
    - export MINOR="${TORIZONCORE_BUILDER_MINOR}"
    - export PATCH="${TORIZONCORE_BUILDER_PATCH}"
    - export DATE=$(date +%Y%m%d)
    - export DOCKER_TAGS_CHECK="${MAJOR}.${MINOR}.${PATCH} ${MAJOR}.${MINOR}.${PATCH}-${DATE}"
    - export DOCKER_TAGS="latest ${MAJOR} ${MAJOR}.${MINOR}"
  variables:
    IMAGE_NAME: torizoncore-builder-amd64

deploy-official-arm64:
  extends: .deploy-dh-base
  stage: deploy
  rules:
    # Following condition is needed to avoid the execution of merge-request pipelines.
    - if: '$CI_PIPELINE_SOURCE == "merge_request_event"'
      when: never
    # Following condition prevents execution with custom TorizonCore images (triggered by Jenkins).
    - if: $BUILD_MACHINE
      when: never
    - if: '$RELEASE_TYPE == "official"'
      when: manual
    - when: never
  allow_failure: true
  before_script:
    - export MAJOR="${TORIZONCORE_BUILDER_MAJOR}"
    - export MINOR="${TORIZONCORE_BUILDER_MINOR}"
    - export PATCH="${TORIZONCORE_BUILDER_PATCH}"
    - export DATE=$(date +%Y%m%d)
    - export DOCKER_TAGS_CHECK="${MAJOR}.${MINOR}.${PATCH} ${MAJOR}.${MINOR}.${PATCH}-${DATE}"
    - export DOCKER_TAGS="latest ${MAJOR} ${MAJOR}.${MINOR}"
  variables:
    IMAGE_NAME: torizoncore-builder-arm64

deploy-official-multiarch:
  extends: .deploy-dh-multiarch-base
  stage: deploy-multiarch
  rules:
    # Following condition is needed to avoid the execution of merge-request pipelines.
    - if: '$CI_PIPELINE_SOURCE == "merge_request_event"'
      when: never
    # Following condition prevents execution with custom TorizonCore images (triggered by Jenkins).
    - if: $BUILD_MACHINE
      when: never
    - if: '$RELEASE_TYPE == "official"'
      when: manual
    - when: never
  before_script:
    - export MAJOR="${TORIZONCORE_BUILDER_MAJOR}"
    - export MINOR="${TORIZONCORE_BUILDER_MINOR}"
    - export PATCH="${TORIZONCORE_BUILDER_PATCH}"
    - export DATE=$(date +%Y%m%d)
    - export DOCKER_TAGS_CHECK="${MAJOR}.${MINOR}.${PATCH} ${MAJOR}.${MINOR}.${PATCH}-${DATE}"
    - export DOCKER_TAGS="latest ${MAJOR} ${MAJOR}.${MINOR}"
  variables:
    IMAGE_NAME: torizoncore-builder
    IMAGE_NAME_AMD64: torizoncore-builder-amd64

# ---
# Early-access deployment to Docker Hub (used when RELEASE_TYPE is "early-access")
# ---

deploy-ea-amd64:
  extends: .deploy-dh-base
  stage: deploy
  rules:
    - if: '$CI_PIPELINE_SOURCE == "merge_request_event"'
      when: never
    # Following condition prevents execution with custom TorizonCore images (triggered by Jenkins).
    - if: $BUILD_MACHINE
      when: never
    - if: '$RELEASE_TYPE == "early-access"'
      when: on_success
    - when: never
  allow_failure: false
  before_script:
    - export DOCKER_TAGS_CHECK=""
    - export DOCKER_TAGS="early-access"
  variables:
    IMAGE_NAME: torizoncore-builder-amd64

# NOTE: arm64 is not being built for early-access ATM.
#deploy-ea-arm64:
#  extends: .deploy-dh-base
#  stage: deploy
#  rules:
#    - if: '$CI_PIPELINE_SOURCE == "merge_request_event"'
#      when: never
#    # Following condition prevents execution with custom TorizonCore images (triggered by Jenkins).
#    - if: $BUILD_MACHINE
#      when: never
#    - if: '$RELEASE_TYPE == "early-access"'
#      when: on_success
#    - when: never
#  allow_failure: true
#  before_script:
#    - export DOCKER_TAGS_CHECK=""
#    - export DOCKER_TAGS="early-access"
#  variables:
#    IMAGE_NAME: torizoncore-builder-arm64

deploy-ea-multiarch:
  extends: .deploy-dh-multiarch-base
  stage: deploy-multiarch
  rules:
    - if: '$CI_PIPELINE_SOURCE == "merge_request_event"'
      when: never
    # Following condition prevents execution with custom TorizonCore images (triggered by Jenkins).
    - if: $BUILD_MACHINE
      when: never
    - if: '$RELEASE_TYPE == "early-access"'
      when: on_success
    - when: never
  before_script:
    - export DOCKER_TAGS_CHECK=""
    - export DOCKER_TAGS="early-access"
  variables:
    IMAGE_NAME: torizoncore-builder
    IMAGE_NAME_AMD64: torizoncore-builder-amd64

# ---
# Internal use deployment (used when RELEASE_TYPE is "internal")
# ---

deploy-int-amd64:
  extends: .deploy-int-base
  stage: deploy
  rules:
    - if: '$CI_PIPELINE_SOURCE == "merge_request_event"'
      when: never
    # Following condition prevents execution with custom TorizonCore images (triggered by Jenkins).
    - if: $BUILD_MACHINE
      when: never
    - if: '$RELEASE_TYPE == "internal"'
      when: manual
    - when: never
  before_script:
    - export DOCKER_TAGS_CHECK=""
    - export DOCKER_TAGS="${TORIZONCORE_BUILDER_MAJOR} ${TORIZONCORE_BUILDER_MAJOR}-latest"
  variables:
    IMAGE_NAME: torizoncore-builder-amd64
    IMAGE_NAME_DEST: torizoncore-builder-internal-amd64

# NOTE: arm64 is not being built for internal ATM.
#deploy-int-arm64:
#  extends: .deploy-int-base
#  stage: deploy
#  rules:
#    - if: '$CI_PIPELINE_SOURCE == "merge_request_event"'
#      when: never
#    # Following condition prevents execution with custom TorizonCore images (triggered by Jenkins).
#    - if: $BUILD_MACHINE
#      when: never
#    - if: '$RELEASE_TYPE == "internal"'
#      when: manual
#    - when: never
#  before_script:
#    - export DOCKER_TAGS_CHECK=""
#    - export DOCKER_TAGS="${TORIZONCORE_BUILDER_MAJOR} ${TORIZONCORE_BUILDER_MAJOR}-latest"
#  variables:
#    IMAGE_NAME: torizoncore-builder-arm64
#    IMAGE_NAME_DEST: torizoncore-builder-internal-arm64

deploy-int-multiarch:
  extends: .deploy-int-multiarch-base
  stage: deploy-multiarch
  rules:
    - if: '$CI_PIPELINE_SOURCE == "merge_request_event"'
      when: never
    # Following condition prevents execution with custom TorizonCore images (triggered by Jenkins).
    - if: $BUILD_MACHINE
      when: never
    - if: '$RELEASE_TYPE == "internal"'
      when: manual
    - when: never
  before_script:
    - export DOCKER_TAGS_CHECK=""
    - export DOCKER_TAGS="${TORIZONCORE_BUILDER_MAJOR} ${TORIZONCORE_BUILDER_MAJOR}-latest"
  variables:
    #IMAGE_NAME: torizoncore-builder
    IMAGE_NAME_DEST: torizoncore-builder-internal
    IMAGE_NAME_AMD64: torizoncore-builder-internal-amd64

# ---
# Git tagging
# ---

# Make sure to create a Project Access Token in "Settings/Access Tokens" section with
# "write_repository" scope selected. Then in "Settings/CI/CD" section add a variable
# with key "GIT_TOKEN" and a value of the access token; also mask the variable.
#
.tag-base:
  before_script:
    - if [ -z "${GIT_TOKEN}" ]; then echo "Missing variable GIT_TOKEN."; exit 1; fi
  script:
    - apk update && apk add git
    - git remote set-url --push origin "${CI_SERVER_PROTOCOL}://gitlab-ci-token:${GIT_TOKEN}@${CI_REPOSITORY_URL##*@}"
    - REMOTE_TAGS="$(git ls-remote --tags origin)"
    - for tag in ${GIT_TAGS_CHECK};
        do
          echo "Check existence of tag ${tag}";
          if echo "${REMOTE_TAGS}" | grep "\\brefs/tags/${tag//./\\.}\$" >/dev/null; then
            echo "Git tag ${tag} already exists.";
            exit 1;
          fi
        done
    - for tag in ${GIT_TAGS} ${GIT_TAGS_CHECK};
        do
          echo "Assigning tag ${tag} to HEAD";
          git tag -f "${tag}";
          git push -f -o ci.skip origin "refs/tags/${tag}";
        done

tag-official:
  extends: .tag-base
  stage: tag
  rules:
    - if: '$CI_PIPELINE_SOURCE == "merge_request_event"'
      when: never
    # Following condition prevents execution with custom TorizonCore images (triggered by Jenkins).
    - if: $BUILD_MACHINE
      when: never
    - if: '$RELEASE_TYPE == "official"'
      when: manual
    - when: never
  before_script:
    - export MAJOR="${TORIZONCORE_BUILDER_MAJOR}"
    - export MINOR="${TORIZONCORE_BUILDER_MINOR}"
    - export PATCH="${TORIZONCORE_BUILDER_PATCH}"
    - export DATE=$(date +%Y%m%d)
    - export GIT_TAGS_CHECK="${MAJOR}.${MINOR}.${PATCH}"
    - export GIT_TAGS="${MAJOR}.${MINOR}.${PATCH}-${DATE}"

tag-ea:
  extends: .tag-base
  stage: tag
  rules:
    - if: '$CI_PIPELINE_SOURCE == "merge_request_event"'
      when: never
    # Following condition prevents execution with custom TorizonCore images (triggered by Jenkins).
    - if: $BUILD_MACHINE
      when: never
    - if: '$RELEASE_TYPE == "early-access"'
      when: on_success
    - when: never
  before_script:
    - export MAJOR="${TORIZONCORE_BUILDER_MAJOR}"
    - export MINOR="${TORIZONCORE_BUILDER_MINOR}"
    - export PATCH="${TORIZONCORE_BUILDER_PATCH}"
    - export DATE=$(date +%Y%m%d)
    - export GIT_TAGS_CHECK=""
    - export GIT_TAGS="${MAJOR}.${MINOR}.${PATCH}-ea-${DATE}"

tag-int:
  extends: .tag-base
  stage: tag
  rules:
    - if: '$CI_PIPELINE_SOURCE == "merge_request_event"'
      when: never
    # Following condition prevents execution with custom TorizonCore images (triggered by Jenkins).
    - if: $BUILD_MACHINE
      when: never
    - if: '$RELEASE_TYPE == "internal"'
      when: manual
    - when: never
  before_script:
    - export MAJOR="${TORIZONCORE_BUILDER_MAJOR}"
    - export MINOR="${TORIZONCORE_BUILDER_MINOR}"
    - export PATCH="${TORIZONCORE_BUILDER_PATCH}"
    - export DATE=$(date +%Y%m%d)
    - export GIT_TAGS_CHECK=""
    - export GIT_TAGS="${MAJOR}.${MINOR}.${PATCH}-int-${DATE}"

on-custom-test-error:
  stage: .post
  when: on_failure
  rules:
    # Following condition is needed to avoid the execution of merge-request pipelines.
    - if: '$CI_PIPELINE_SOURCE == "merge_request_event"'
      when: never
    # Following condition for execution with custom TorizonCore images only (triggered by Jenkins).
    - if: $BUILD_MACHINE
  variables:
    ERROR_TEXT: |
      🔴🔴** TCB Pipeline ERROR **🔴🔴
      The ${BUILD_PIPELINETYPE} CI Pipeline failed:
      Link: ${CI_PROJECT_URL}/pipelines/${CI_PIPELINE_ID}
      Distro Version: ${DISTRO_VERSION} (${BUILD_MANIFEST_BRANCH})
      Machine: ${BUILD_MACHINE}
  script:
    - apk update && apk add curl jq
    - >
      MESSAGE=$(jq -n \
        --arg channel "${SLACK_CHANNEL}" \
        --arg slack_text "${ERROR_TEXT}" \
        '{channel: $channel,
          blocks: [{
            type: "section",
            text: {
              type: "mrkdwn",
              text: $slack_text
            }
          }]
        }')
    - >
      curl -H "Content-type: application/json; charset=utf-8" \
           -H "Authorization: Bearer ${SLACK_TOKEN}" \
           -X POST https://slack.com/api/chat.postMessage \
           --data "${MESSAGE}"