# Scheduled stackalarm watch for GitLab.
#
# 1. Include this file in .gitlab-ci.yml:
#      include:
#        - remote: https://raw.githubusercontent.com/yoanbernabeu/stackalarm/main/ci/gitlab/stackalarm.yml
# 2. Add a CI/CD variable STACKALARM_GITLAB_TOKEN (masked): a project access
#    token with the api scope and the Reporter role, to open the issues.
# 3. Create a pipeline schedule (Build > Pipeline schedules), every 4 hours:
#    17 */4 * * *
# 4. Recommended on shared runners: a CI/CD variable GITHUB_TOKEN (masked), a
#    GitHub token with no permission at all. The GitHub advisory sources allow
#    60 anonymous requests per hour per IP, and shared runners share their IP.
#    Optional: NVD_API_KEY, to search the NVD faster.
#
# The job reads the .stackalarm.yaml profile the stackalarm skill wrote, and
# opens an issue when a heads-up, an alert or a security release is new. The
# state of what was reported lives in the job cache: on runners without a
# shared cache, a few items may be reported twice, never missed.
stackalarm:
  image: alpine:3
  rules:
    - if: $CI_PIPELINE_SOURCE == "schedule"
  variables:
    STACKALARM_PROFILE: .stackalarm.yaml
    STACKALARM_SINCE: 48h
    STACKALARM_FAIL_ON: heads-up,alert,release
    STACKALARM_LABEL: stackalarm
  cache:
    key: stackalarm-state
    paths:
      - .stackalarm-cache/
    when: on_success # if the issue could not be opened, the next run reports the items again
  script:
    - apk add --no-cache curl
    - curl -sSL https://raw.githubusercontent.com/yoanbernabeu/stackalarm/main/install.sh | INSTALL_DIR=/usr/local/bin sh
    - |
      set +e
      stackalarm news --profile "$STACKALARM_PROFILE" --since "$STACKALARM_SINCE" --fail-on "$STACKALARM_FAIL_ON" \
        --state .stackalarm-cache/state --format markdown > stackalarm-report.md
      code=$?
      set -e
      cat stackalarm-report.md
      if [ "$code" = 2 ]; then
        if [ -z "${STACKALARM_GITLAB_TOKEN:-}" ]; then
          echo "New items found, but STACKALARM_GITLAB_TOKEN is not set: no issue opened." >&2
          exit 1
        fi
        head -c 60000 stackalarm-report.md > stackalarm-issue.md
        curl --fail-with-body -sS -o /dev/null --header "PRIVATE-TOKEN: $STACKALARM_GITLAB_TOKEN" \
          --data-urlencode "title=stackalarm: security news to check ($(date -u +%F))" \
          --data-urlencode "labels=$STACKALARM_LABEL" \
          --data-urlencode "description@stackalarm-issue.md" \
          "$CI_API_V4_URL/projects/$CI_PROJECT_ID/issues"
      elif [ "$code" != 0 ]; then
        exit "$code"
      fi
  artifacts:
    when: always
    paths:
      - stackalarm-report.md