.prow.yaml

presubmits:
  - name: nmath-unit-test
    decorate: true
    run_if_changed: "^.*.go$"
    spec:
      containers:
      - image: nephio/gotests:1671656214984921088
        command:
        - make
        args:
        - unit

  - name: nmath-lint
    decorate: true
    run_if_changed: "^.*.go$"
    spec:
      containers:
      - image: nephio/gotests:1671656214984921088
        command:
        - make
        args:
        - lint

  - name: nmath-test-gosec
    decorate: true
    run_if_changed: "^.*.go$"
    spec:
      containers:
      - image: nephio/gotests:1671656214984921088
        command:
        - make
        args:
        - gosec
        
  - name: nmath-test-license-header
    decorate: true
    run_if_changed: "^.*.go$"
    spec:
      containers:
      - image: nephio/gotests:1671656214984921088
        command:
        - "/bin/sh"
        - "-c"
        - |
          /usr/local/bin/checklicense.sh > ${ARTIFACTS}/license_headers_results.txt

  - name: nmath-test-scancode-toolkit
    decorate: true
    run_if_changed: "^.*.go$"
    spec:
      containers:
      - image: nephio/scancode-toolkit:v31.2.5
        command:
        - "/bin/sh"
        args:
        - "-c"
        - |
          /scancode-toolkit/scancode --ignore "whitelist.json" -clpeui -n 2 --html ${ARTIFACTS}/scancode_report.html . --tallies-with-details
        resources:
          requests:
            cpu: 2
            memory: 2Gi

  - name: nmath-lichen
    decorate: true
    run_if_changed: "^.*.go$"
    spec:
      containers:
      - image: nephio/gotests:1671656214984921088
        command:
        - "/usr/local/bin/lichen.sh"

  - name: nmath-fossology
    decorate: true
    always_run: true
    spec:
      containers:
      - image: fossology/fossology:scanner
        command:
        - "/bin/bash"
        args:
        - "-c"
        - |
          /bin/fossologyscanner --report SPDX_JSON repo nomos ojo copyright keyword
          cp -R results ${ARTIFACTS}/

postsubmits:
  - name: build-push-image
    cluster: default
    run_if_changed: "^VERSION$"
    branches:
    - main
    - master
    annotations:
      description: Build and Push Image to DockerHub
    decorate: true
    decoration_config:
      censor_secrets: true
    max_concurrency: 1
    spec:
      containers:
      - name: kaniko
        image: gcr.io/kaniko-project/executor:debug
        command:
        - "/bin/sh"
        - "-c"
        - |
          executor --context=${PWD} \
            --dockerfile=Dockerfile --destination=nephio/nmath:${BUILD_ID}
        volumeMounts:
          - name: kaniko-secret
            mountPath: /kaniko/.docker/
        resources:
          requests:
            cpu: 2
            memory: 2Gi
      volumes:
        - name: kaniko-secret
          secret:
            secretName: regcred
            items:
              - key: .dockerconfigjson
                path: config.json
  - name: image-nephio-test-sign
    cluster: default
    always_run: true
    branches:
    - "^v.*$"
    annotations:
      description: Build and Push Image to DockerHub when release tag is created
    decorate: true
    decoration_config:
      censor_secrets: true
    max_concurrency: 0
    spec:
      containers:
      - name: kaniko
        image: gcr.io/kaniko-project/executor:debug
        command:
        - "/bin/sh"
        - "-c"
        - |
          executor --context=${PWD} \
            --dockerfile=Dockerfile --destination=nephio/nmath:${PULL_BASE_REF}
        volumeMounts:
          - name: kaniko-secret
            mountPath: /kaniko/.docker/
        resources:
          requests:
            cpu: 1
            memory: 1Gi
      - name: nephio-image-signer
        image: nephio/releaser:v0.0.2
        command:
          - "/bin/sh"
          - "-c"
          - |
            /usr/local/bin/release docker.io nephio nmath ${PULL_BASE_REF}
        volumeMounts:
          - name: cosign-secret
            mountPath: /root/.docker/
        resources:
          requests:
            cpu: 1
            memory: 64Mi
          limits:
            cpu: 1
            memory: 128Mi
        env:
          - name: COSIGN_PRIVATE_KEY
            valueFrom:
              secretKeyRef:
                name: cosign-private-key
                key: COSIGN_PRIVATE_KEY
          - name: COSIGN_PASSWORD
            valueFrom:
              secretKeyRef:
                name: cosign-private-key-passwd
                key: COSIGN_PASSWORD
      volumes:
        - name: kaniko-secret
          secret:
            secretName: regcred
            items:
              - key: .dockerconfigjson
                path: config.json
        - name: cosign-secret
          secret:
            secretName: cosign-login
            items:
              - key: configjson
                path: config.json