.gitlab-ci.yml

# .gitlab-ci.yml
# paritytech/scripts
#

stages:
  - build
  - test
  - prod

variables:                         &default-vars
  REGISTRY_PATH:                   docker.io/paritytech
  REGISTRY_NAME:                   docker.io
  CI_IMAGE:                        quay.io/buildah/stable:v1.27

default:
  cache:                           {}
  interruptible:                   true
  retry:
    max: 2
    when:
      - runner_system_failure
      - unknown_failure
      - api_failure

.build:                            &docker_build
  stage:                           build
  image:                           $CI_IMAGE
  rules:
    - if: $IMAGE_NAME == $CI_JOB_NAME
  tags:
    - kubernetes-parity-build

# Push to Dockerhub using buildah
.push_to_docker_hub:               &push_to_docker_hub
  - export IMAGE_DATE_TAG="$CI_COMMIT_SHORT_SHA-$(date +%Y%m%d)"
  - buildah version
  - buildah bud
      --format=docker
      --build-arg VCS_REF="$CI_COMMIT_SHA"
      --build-arg BUILD_DATE="$(date +%Y%m%d)"
      --build-arg REGISTRY_PATH="$REGISTRY_PATH"
      --tag "$REGISTRY_PATH/$IMAGE_NAME:$IMAGE_DATE_TAG"
      --tag "$REGISTRY_PATH/$IMAGE_NAME:latest"
      --file "dockerfiles/$IMAGE_NAME/Dockerfile" dockerfiles
  - buildah info
  - echo "$Docker_Hub_Pass_Parity" |
      buildah login --username "$Docker_Hub_User_Parity" --password-stdin "$REGISTRY_NAME"
  - buildah push --format=v2s2 "$REGISTRY_PATH/$IMAGE_NAME:$IMAGE_DATE_TAG"
  - buildah push --format=v2s2 "$REGISTRY_PATH/$IMAGE_NAME:latest"
  - buildah logout "$REGISTRY_NAME"

.push_to_staging:                  &push_to_staging
  - buildah bud
      --format=docker
      --build-arg VCS_REF="$CI_COMMIT_SHA"
      --build-arg BUILD_DATE="$(date +%Y%m%d)"
      --build-arg REGISTRY_PATH="$REGISTRY_PATH"
      --tag "$REGISTRY_PATH/$IMAGE_NAME:staging"
      --file "dockerfiles/$IMAGE_NAME/Dockerfile" dockerfiles
  - echo "$Docker_Hub_Pass_Parity" |
      buildah login --username "$Docker_Hub_User_Parity" --password-stdin "$REGISTRY_NAME"
  - buildah info
  - buildah push --format=v2s2 "$REGISTRY_PATH/$IMAGE_NAME:staging"
  - buildah logout "$REGISTRY_NAME"

.publish_as_latest_too:            &publish_as_latest_too
  - echo "$Docker_Hub_Pass_Parity" |
      buildah login --username "$Docker_Hub_User_Parity" --password-stdin "$REGISTRY_NAME"
  - buildah info
  - buildah tag "$REGISTRY_PATH/$IMAGE_NAME:staging" "$REGISTRY_PATH/$IMAGE_NAME:latest"
  - buildah push --format=v2s2 "$REGISTRY_PATH/$IMAGE_NAME:latest"
  - buildah logout "$REGISTRY_NAME"

.push_to_production:               &push_to_production
  - export IMAGE_DATE_TAG="$CI_COMMIT_SHORT_SHA-$(date +%Y%m%d)"
  - env REGISTRY_AUTH_FILE= buildah pull "$REGISTRY_PATH/$IMAGE_NAME:staging"
  - buildah tag "$REGISTRY_PATH/$IMAGE_NAME:staging" "$REGISTRY_PATH/$IMAGE_NAME:production"
  - buildah tag "$REGISTRY_PATH/$IMAGE_NAME:staging" "$REGISTRY_PATH/$IMAGE_NAME:$IMAGE_DATE_TAG"
  - echo "$Docker_Hub_Pass_Parity" |
      buildah login --username "$Docker_Hub_User_Parity" --password-stdin "$REGISTRY_NAME"
  - buildah info
  - buildah push --format=v2s2 "$REGISTRY_PATH/$IMAGE_NAME:production"
  - buildah push --format=v2s2 "$REGISTRY_PATH/$IMAGE_NAME:$IMAGE_DATE_TAG"
  - buildah logout "$REGISTRY_NAME"

.docker_build_only:                &docker_build_only
  - buildah bud
      --format=docker
      --build-arg VCS_REF="$CI_COMMIT_SHA"
      --build-arg BUILD_DATE="$(date +%Y%m%d)"
      --build-arg REGISTRY_PATH="$REGISTRY_PATH"
      --tag "$REGISTRY_PATH/$IMAGE_NAME:staging"
      --file "dockerfiles/$IMAGE_NAME/Dockerfile" dockerfiles

#### stage:                        build

# Only build in PR

.docker_build_pr:                  &docker_build_pr
  stage:                           build
  image:                           $CI_IMAGE
  rules:
    - if: $CI_COMMIT_REF_NAME =~ /^[0-9]+$/                         # PRs
      changes:
        - dockerfiles/${IMAGE_NAME}/**
  script:
    - *docker_build_only
  tags:
    - kubernetes-parity-build

ansible-pr:
  <<: *docker_build_pr
  variables:
    IMAGE_NAME:                    "ansible"

awscli-pr:
  <<: *docker_build_pr
  variables:
    IMAGE_NAME:                    "awscli"

base-ci-pr:
  <<: *docker_build_pr
  variables:
    IMAGE_NAME:                    "base-ci"

base-ci-linux-pr:
  <<: *docker_build_pr
  variables:
    IMAGE_NAME:                    "base-ci-linux"

benchmarks-pr:
  <<: *docker_build_pr
  variables:
    IMAGE_NAME:                    "benchmarks"

bridges-pr:
  <<: *docker_build_pr
  variables:
    IMAGE_NAME:                    "bridges"

cachepot-ci-pr:
  <<: *docker_build_pr
  variables:
    IMAGE_NAME:                    "cachepot-ci"

ci-linux-pr:
  <<: *docker_build_pr
  variables:
    IMAGE_NAME:                    "ci-linux"

contracts-ci-linux-pr:
  <<: *docker_build_pr
  variables:
    IMAGE_NAME:                    "contracts-ci-linux"

ink-ci-linux-pr:
  <<: *docker_build_pr
  variables:
    IMAGE_NAME:                    "ink-ci-linux"

ink-waterfall-ci-pr:
  <<: *docker_build_pr
  variables:
    IMAGE_NAME:                    "ink-waterfall-ci"

lz4-pr:
  <<: *docker_build_pr
  variables:
    IMAGE_NAME:                    "lz4"

mdbook-utils-pr:
  <<: *docker_build_pr
  variables:
    IMAGE_NAME:                    "mdbook-utils"
  rules:
    - if: $CI_COMMIT_REF_NAME =~ /^[0-9]+$/                         # PRs
      changes:
        - dockerfiles/mdbook-utils/**

mitogen-pr:
  <<: *docker_build_pr
  variables:
    IMAGE_NAME:                    "mitogen"

molecule-pr:
  <<: *docker_build_pr
  variables:
    IMAGE_NAME:                    "molecule"

multisig-ci-pr:
  <<: *docker_build_pr
  variables:
    IMAGE_NAME:                    "multisig-ci"

node-bench-regression-guard-pr:
  <<: *docker_build_pr
  variables:
    IMAGE_NAME:                    "node-bench-regression-guard"

node-wrk-pr:
  <<: *docker_build_pr
  variables:
    IMAGE_NAME:                    "node-wrk"

parity-keyring-pr:
  <<: *docker_build_pr
  variables:
    IMAGE_NAME:                    "parity-keyring"

parity-scale-codec-pr:
  <<: *docker_build_pr
  variables:
    IMAGE_NAME:                    "parity-scale-codec"

query-exporter-pr:
  <<: *docker_build_pr
  variables:
    IMAGE_NAME:                    "query-exporter"

redis-exporter-pr:
  <<: *docker_build_pr
  variables:
    IMAGE_NAME:                    "redis-exporter"

rpm-pr:
  <<: *docker_build_pr
  variables:
    IMAGE_NAME:                    "rpm"

rusty-cachier-env-pr:
  <<: *docker_build_pr
  variables:
    IMAGE_NAME:                    "rusty-cachier-env"

smart-bench-ci-pr:
  <<: *docker_build_pr
  variables:
    IMAGE_NAME:                    "ink-waterfall-ci"

sops-pr:
  <<: *docker_build_pr
  variables:
    IMAGE_NAME:                    "sops"

substrate-session-keys-grabber-pr:
  <<: *docker_build_pr
  variables:
    IMAGE_NAME:                    "substrate-session-keys-grabber"

terraform-pr:
  <<: *docker_build_pr
  variables:
    IMAGE_NAME:                    "terraform"

tools-pr:
  <<: *docker_build_pr
  variables:
    IMAGE_NAME:                    "tools"

ws-health-exporter-pr:
  <<: *docker_build_pr
  variables:
    IMAGE_NAME:                    "ws-health-exporter"

# Build and push to docker hub
ansible:
  <<:                              *docker_build
  script:
    - *push_to_docker_hub

base-ci-linux:
  <<:                              *docker_build
  script:
    - *push_to_docker_hub

base-ci:
  <<:                              *docker_build
  script:
    - *push_to_docker_hub

ci-linux:
  <<:                              *docker_build
  script:
    - *push_to_staging

ink-ci-linux:
  <<:                              *docker_build
  script:
    - *push_to_staging

parity-scale-codec:
  <<:                              *docker_build
  script:
    - *push_to_staging

ink-waterfall-ci:
  <<:                              *docker_build
  script:
    - *push_to_docker_hub

smart-bench-ci:
  <<:                              *docker_build
  script:
    - *push_to_docker_hub

contracts-ci-linux:
  <<:                              *docker_build
  script:
    - *push_to_staging
    - *publish_as_latest_too

debian10:
  <<:                              *docker_build
  script:
    - *push_to_docker_hub

bridges-ci:
  <<:                              *docker_build
  script:
    - *push_to_staging

cachepot-ci:
  <<:                              *docker_build
  script:
    - *push_to_staging

awscli:
  <<:                              *docker_build
  script:
    - *push_to_docker_hub

tools:
  <<:                              *docker_build
  script:
    - *push_to_docker_hub

benchmarks:
  <<:                              *docker_build
  script:
    - *push_to_docker_hub

query-exporter:
  <<:                              *docker_build
  script:
    - *push_to_docker_hub

redis-exporter:
  <<:                              *docker_build
  script:
    - *push_to_docker_hub

rusty-cachier-env:
  <<:                              *docker_build
  script:
    - *push_to_docker_hub

mdbook-utils:
  <<:                              *docker_build
  script:
    - *push_to_docker_hub

mitogen:
  <<:                              *docker_build
  script:
    - *push_to_docker_hub

molecule:
  <<:                              *docker_build
  script:
    - *push_to_docker_hub

multisig-ci:
  <<:                              *docker_build
  script:
    - *push_to_docker_hub

node-bench-regression-guard:
  <<:                              *docker_build
  script:
    - *push_to_docker_hub

node-wrk:
  <<:                              *docker_build
  script:
    - *push_to_docker_hub

gnupg:
  <<:                              *docker_build
  script:
    - *push_to_docker_hub

parity-keyring:
  <<:                              *docker_build
  script:
    - *push_to_docker_hub

rpm:
  <<:                              *docker_build
  script:
    - *push_to_docker_hub

deb:
  <<:                              *docker_build
  script:
    - *push_to_docker_hub

lz4:
  <<:                              *docker_build
  script:
    - *push_to_docker_hub

ws-health-exporter:
  <<:                              *docker_build
  script:
    - *push_to_docker_hub

# special case as version tags are introduced
kubetools:
  <<:                              *docker_build
  variables:
    <<:                            *default-vars
    # https://github.com/kubernetes/kubernetes/releases
    BUILD_KUBE_VERSION:            "1.18.2"
    # https://github.com/kubernetes/helm/releases
    # will be overwritten by the global variable at
    # https://gitlab.parity.io/groups/parity/-/settings/ci_cd
    BUILD_HELM_VERSION:            "2.16.11"
  script:
    - |
      cat <<-EOT
      |
      | # build of kubetools image
      |
      | KUBE_VERSION = $BUILD_KUBE_VERSION
      | HELM_VERSION = $BUILD_HELM_VERSION
      |
      EOT
    # beware that latest is helm2, not helm3
    # TODO: helm3 should be latest
    - buildah bud
      --format=docker
      --build-arg VCS_REF="$CI_COMMIT_SHA"
      --build-arg BUILD_DATE="$(date -u '+%Y-%m-%dT%H:%M:%SZ')"
      --build-arg REGISTRY_PATH="$REGISTRY_PATH"
      --build-arg KUBE_VERSION="$BUILD_KUBE_VERSION"
      --build-arg HELM_VERSION="$BUILD_HELM_VERSION"
      --tag "$REGISTRY_PATH/$IMAGE_NAME:latest"
      --tag "$REGISTRY_PATH/$IMAGE_NAME:helm2"
      --tag "$REGISTRY_PATH/$IMAGE_NAME:$BUILD_HELM_VERSION"
      --file "dockerfiles/$IMAGE_NAME/helm/Dockerfile" dockerfiles
    # Push to Dockerhub
    - echo "$Docker_Hub_Pass_Parity" |
        buildah login --username "$Docker_Hub_User_Parity" --password-stdin "$REGISTRY_NAME"
    - buildah info
    - buildah push --format=v2s2 "$REGISTRY_PATH/$IMAGE_NAME:latest"
    - buildah push --format=v2s2 "$REGISTRY_PATH/$IMAGE_NAME:helm2"
    - buildah push --format=v2s2 "$REGISTRY_PATH/$IMAGE_NAME:$BUILD_HELM_VERSION"
    - buildah logout "$REGISTRY_NAME"

# waits until kubetools job above is deprecated, "latest" tag remains after the old image
kubetools-helm:
  <<:                              *docker_build
  variables:
    <<:                            *default-vars
    # https://kubernetes.io/docs/tasks/tools/install-kubectl-linux/
    KUBE_VERSION:             "1.24.3"
    # https://github.com/helm/helm/releases
    HELM_VERSION:             "3.9.2"
    # https://github.com/roboll/helmfile/releases
    HELMFILE_VERSION:         "0.144.0"
    # https://github.com/databus23/helm-diff/releases
    HELM_DIFF_PLUGIN_VERSION: "3.5.0"
    # https://github.com/jkroepke/helm-secrets
    HELM_SECRETS_VERSION:     "3.14.0"
    # https://github.com/variantdev/vals/releases
    VALS_VERSION:             "0.18.0"
    # https://releases.hashicorp.com/vault/
    VAULT_VERSION:            "1.11.2"
    # https://github.com/kubernetes-sigs/kustomize/releases
    KUSTOMIZE_VERSION:        "4.5.7"
  script:
    - |
      cat <<-EOT
      |
      | # build of kubetools image
      |
      |
      | HELM_VERSION = $HELM_VERSION
      | HELMFILE_VERSION = $HELMFILE_VERSION
      | HELM_DIFF_PLUGIN_VERSION = $HELM_DIFF_PLUGIN_VERSION
      | HELM_SECRETS_VERSION = $HELM_SECRETS_VERSION
      | KUBE_VERSION = $KUBE_VERSION
      | VALS_VERSION = $VALS_VERSION
      | VAULT_VERSION = $VAULT_VERSION
      | KUSTOMIZE_VERSION = $KUSTOMIZE_VERSION
      |
      EOT
    - buildah bud
      --format=docker
      --build-arg VCS_REF="$CI_COMMIT_SHA"
      --build-arg BUILD_DATE="$(date -u '+%Y-%m-%dT%H:%M:%SZ')"
      --build-arg REGISTRY_PATH="$REGISTRY_PATH"
      --build-arg KUBE_VERSION="$KUBE_VERSION"
      --build-arg HELM_VERSION="$HELM_VERSION"
      --build-arg HELMFILE_VERSION="$HELMFILE_VERSION"
      --build-arg HELM_DIFF_PLUGIN_VERSION="$HELM_DIFF_PLUGIN_VERSION"
      --build-arg HELM_SECRETS_VERSION="$HELM_SECRETS_VERSION"
      --build-arg VALS_VERSION="$VALS_VERSION"
      --build-arg VAULT_VERSION="$VAULT_VERSION"
      --build-arg KUSTOMIZE_VERSION="$KUSTOMIZE_VERSION"
      --tag "$REGISTRY_PATH/kubetools:helm3"
      --tag "$REGISTRY_PATH/kubetools:$HELM_VERSION"
      --tag "$REGISTRY_PATH/$IMAGE_NAME:latest"
      --tag "$REGISTRY_PATH/$IMAGE_NAME:$HELM_VERSION"
      --file "dockerfiles/kubetools/helm/helm3.Dockerfile" dockerfiles
    # Push to Dockerhub
    - echo "$Docker_Hub_Pass_Parity" |
        buildah login --username "$Docker_Hub_User_Parity" --password-stdin "$REGISTRY_NAME"
    - buildah info
    - buildah push --format=v2s2 "$REGISTRY_PATH/kubetools:helm3"
    - buildah push --format=v2s2 "$REGISTRY_PATH/kubetools:$HELM_VERSION"
    - buildah push --format=v2s2 "$REGISTRY_PATH/$IMAGE_NAME:latest"
    - buildah push --format=v2s2 "$REGISTRY_PATH/$IMAGE_NAME:$HELM_VERSION"
    - buildah logout "$REGISTRY_NAME"

kubetools-kubectl:
  <<:                              *docker_build
  variables:
    <<:                            *default-vars
    KUBE_VERSION:                  "1.24.7"
  script:
    - buildah bud
      --format=docker
      --build-arg VCS_REF="$CI_COMMIT_SHA"
      --build-arg BUILD_DATE="$(date -u '+%Y-%m-%dT%H:%M:%SZ')"
      --build-arg REGISTRY_PATH="$REGISTRY_PATH"
      --build-arg KUBE_VERSION="$KUBE_VERSION"
      --tag "$REGISTRY_PATH/$IMAGE_NAME:latest"
      --tag "$REGISTRY_PATH/$IMAGE_NAME:$KUBE_VERSION"
      --file "dockerfiles/kubetools/kubectl/Dockerfile" dockerfiles
    # Push to Dockerhub
    - echo "$Docker_Hub_Pass_Parity" |
        buildah login --username "$Docker_Hub_User_Parity" --password-stdin "$REGISTRY_NAME"
    - buildah info
    - buildah push --format=v2s2 "$REGISTRY_PATH/$IMAGE_NAME:latest"
    - buildah push --format=v2s2 "$REGISTRY_PATH/$IMAGE_NAME:$KUBE_VERSION"
    - buildah logout "$REGISTRY_NAME"

terraform:
  <<:                              *docker_build
  variables:
    <<:                            *default-vars
    # https://releases.hashicorp.com/terraform/
    TERRAFORM_VERSION:             "1.3.1"
    # https://releases.hashicorp.com/vault/
    VAULT_VERSION:                 "1.8.0"
  script:
    - |
      cat <<-EOT
      |
      | # build of terraform image
      |
      | TERRAFORM_VERSION = $TERRAFORM_VERSION
      | VAULT_VERSION     = $VAULT_VERSION
      |
      EOT
    - buildah bud
      --format=docker
      --build-arg VCS_REF="$CI_COMMIT_SHA"
      --build-arg BUILD_DATE="$(date -u '+%Y-%m-%dT%H:%M:%SZ')"
      --build-arg REGISTRY_PATH="$REGISTRY_PATH"
      --build-arg TERRAFORM_VERSION="$TERRAFORM_VERSION"
      --build-arg VAULT_VERSION="$VAULT_VERSION"
      --tag "$REGISTRY_PATH/$IMAGE_NAME:latest"
      --tag "$REGISTRY_PATH/$IMAGE_NAME:$TERRAFORM_VERSION"
      --file "dockerfiles/$IMAGE_NAME/Dockerfile" dockerfiles
    # Push to Dockerhub
    - echo "$Docker_Hub_Pass_Parity" |
        buildah login --username "$Docker_Hub_User_Parity" --password-stdin "$REGISTRY_NAME"
    - buildah info
    - buildah push --format=v2s2 "$REGISTRY_PATH/$IMAGE_NAME:latest"
    - buildah push --format=v2s2 "$REGISTRY_PATH/$IMAGE_NAME:$TERRAFORM_VERSION"
    - buildah logout "$REGISTRY_NAME"

sops:
  <<:                              *docker_build
  variables:
    <<:                            *default-vars
    # https://github.com/mozilla/sops/releases/
    SOPS_VERSION:                  "3.7.3"
    # https://releases.hashicorp.com/vault/
    VAULT_VERSION:                 "1.11.2"
  script:
    - |
      cat <<-EOT
      |
      | # build of terraform image
      |
      | SOPS_VERSION      = $SOPS_VERSION
      | VAULT_VERSION     = $VAULT_VERSION
      |
      EOT
    - buildah bud
      --format=docker
      --build-arg VCS_REF="$CI_COMMIT_SHA"
      --build-arg BUILD_DATE="$(date -u '+%Y-%m-%dT%H:%M:%SZ')"
      --build-arg REGISTRY_PATH="$REGISTRY_PATH"
      --build-arg SOPS_VERSION="$SOPS_VERSION"
      --build-arg VAULT_VERSION="$VAULT_VERSION"
      --tag "$REGISTRY_PATH/$IMAGE_NAME:latest"
      --tag "$REGISTRY_PATH/$IMAGE_NAME:$SOPS_VERSION"
      --file "dockerfiles/$IMAGE_NAME/Dockerfile" dockerfiles
    # Push to Dockerhub
    - echo "$Docker_Hub_Pass_Parity" |
        buildah login --username "$Docker_Hub_User_Parity" --password-stdin "$REGISTRY_NAME"
    - buildah info
    - buildah push --format=v2s2 "$REGISTRY_PATH/$IMAGE_NAME:latest"
    - buildah push --format=v2s2 "$REGISTRY_PATH/$IMAGE_NAME:$SOPS_VERSION"
    - buildah logout "$REGISTRY_NAME"

substrate-session-keys-grabber:
  <<:                              *docker_build
  script:
    - *push_to_docker_hub
  variables:
    IMAGE_NAME:                    "substrate-session-keys-grabber"

#### stage:                        test

container_scanning:
  # https://aquasecurity.github.io/trivy/v0.28.0/docs/integrations/gitlab-ci/
  image:
    name:                          docker.io/aquasec/trivy:latest
    entrypoint:                    [""]
  variables:
    GIT_STRATEGY:                  none
    TRIVY_NO_PROGRESS:             "true"
    TRIVY_CACHE_DIR:               ".trivycache/"
    FULL_IMAGE_NAME:               $REGISTRY_PATH/$IMAGE_NAME:$IMAGE_TAG
  script:
    - trivy --version
    # cache cleanup is needed when scanning images with the same tags, it does not remove the database
    - time trivy image --clear-cache
    # update vulnerabilities db
    - time trivy image --download-db-only
    # Builds report and puts it in the default workdir $CI_PROJECT_DIR, so `artifacts:` can take it from there
    - time trivy image --exit-code 0 --format template --template "@/contrib/gitlab.tpl"
        --output "$CI_PROJECT_DIR/gl-container-scanning-report.json" "$FULL_IMAGE_NAME"
    # Prints full report
    - time trivy image --exit-code 0 "$FULL_IMAGE_NAME"
    # Fail on critical vulnerabilities
    - time trivy image --exit-code 1 --severity CRITICAL "$FULL_IMAGE_NAME"
  cache:
    # TODO: move this cache to k8s volume when it's configured
    paths:
      - .trivycache/
  # Enables https://docs.gitlab.com/ee/user/application_security/container_scanning/
  artifacts:
    when:                          always
    reports:
      container_scanning:          gl-container-scanning-report.json
  rules:
    # $IMAGE_TAG is needed for trivy. Should me mentioned in schedule's variables. I.e. latest, staging, v2.0.0.
    - if: $IMAGE_NAME || $IMAGE_TAG
  # TODO: remove when all criticals are solved
  allow_failure:                   true
  tags:
    - kubernetes-parity-build

ci-linux-test-substrate:
  stage:                           test
  variables:
    CI_IMAGE:                      "paritytech/ci-linux:staging"
    # this is to rewrite "-Dwarnings" we use in Substrate CI since new warnings
    # are often introduced and we do not want to fail on them in this case
    RUSTFLAGS:                     "-Cdebug-assertions=y"
  rules:
    - if: $IMAGE_NAME == "ci-linux"
  trigger:
    project:                       parity/mirrors/substrate
    branch:                        master
    strategy:                      depend

ci-linux-test-polkadot:
  stage:                           test
  variables:
    CI_IMAGE:                      "paritytech/ci-linux:staging"
    # this is to rewrite "-Dwarnings" we use in Polkadot CI since new warnings
    # are often introduced and we do not want to fail on them in this case
    RUSTFLAGS:                     "-Cdebug-assertions=y"
  rules:
    - if: $IMAGE_NAME == "ci-linux"
  trigger:
    project:                       parity/mirrors/polkadot
    branch:                        master
    strategy:                      depend

ink-ci-linux-test:
  stage:                           test
  variables:
    CI_IMAGE:                      "paritytech/ink-ci-linux:staging"
  rules:
    - if: $IMAGE_NAME == "ink-ci-linux"
  trigger:
    project:                       parity/mirrors/ink
    branch:                        master
    strategy:                      depend

contracts-ci-linux-test:
  stage:                           test
  variables:
    CI_IMAGE:                      "paritytech/contracts-ci-linux:staging"
  rules:
    - if: $IMAGE_NAME == "contracts-ci-linux"
  trigger:
    project:                       parity/mirrors/cargo-contract
    branch:                        master
    strategy:                      depend

cachepot-ci-test:
  stage:                           test
  variables:
    CI_IMAGE:                      "paritytech/cachepot-ci:staging"
  rules:
    - if: $IMAGE_NAME == "cachepot-ci"
  trigger:
    project:                       parity/mirrors/cachepot
    branch:                        master
    strategy:                      depend

bridges-ci-test:
  stage:                           test
  variables:
    CI_IMAGE:                      "paritytech/bridges-ci:staging"
  rules:
    - if: $IMAGE_NAME == "bridges-ci"
  trigger:
    project:                       parity/mirrors/parity-bridges-common
    branch:                        master
    strategy:                      depend

parity-scale-codec-test:
  stage:                           test
  variables:
    CI_IMAGE:                      "paritytech/parity-scale-codec:staging"
  rules:
    - if: $IMAGE_NAME == "parity-scale-codec"
  trigger:
    project:                       parity/mirrors/parity-scale-codec
    branch:                        master
    strategy:                      depend

#### stage:                        prod

ci-linux-production:
  stage:                           prod
  image:                           $CI_IMAGE
  rules:
    - if: $IMAGE_NAME == "ci-linux"
  script:
    - *push_to_production
  tags:
    - kubernetes-parity-build

ink-ci-linux-production:           &push-after-triggered-pipeline
  stage:                           prod
  image:                           $CI_IMAGE
  needs:
    - job:                         ink-ci-linux-test
      artifacts:                   false
  rules:
    - if: $IMAGE_NAME == "ink-ci-linux"
  script:
    - *push_to_production
  tags:
    - kubernetes-parity-build

contracts-ci-linux-production:
  <<:                              *push-after-triggered-pipeline
  needs:
    - job:                         contracts-ci-linux-test
      artifacts:                   false
  rules:
    - if: $IMAGE_NAME == "contracts-ci-linux"


cachepot-ci-production:
  <<:                              *push-after-triggered-pipeline
  needs:
    - job:                         cachepot-ci-test
      artifacts:                   false
  rules:
    - if: $IMAGE_NAME == "cachepot-ci"

bridges-ci-production:
  <<:                              *push-after-triggered-pipeline
  needs:
    - job:                         bridges-ci-test
      artifacts:                   false
  rules:
    - if: $IMAGE_NAME == "bridges-ci"

parity-scale-codec-production:
  <<:                              *push-after-triggered-pipeline
  needs:
    - job:                         parity-scale-codec-test
      artifacts:                   false
  rules:
    - if: $IMAGE_NAME == "parity-scale-codec"