.common-ci.yml

# Copyright (c) 2022, NVIDIA CORPORATION.  All rights reserved.
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
#     http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.

default:
  image: docker:dind
  services:
    - name: docker:dind
      command: ["--experimental"]

variables:
  DRIVER_VERSIONS: 535.216.03 550.127.08
  BUILD_MULTI_ARCH_IMAGES: "true"

stages:
  - trigger
  - image-build
  - test
  - scan
  - release
  - sign

.pipeline-trigger-rules:
  rules:
    # We trigger the pipeline if started manually
    - if: $CI_PIPELINE_SOURCE == "web"
    # We trigger the pipeline on the main branch
    - if: $CI_COMMIT_BRANCH == "main"
    # We trigger the pipeline on tags
    - if: $CI_COMMIT_TAG && $CI_COMMIT_TAG != ""

workflow:
  rules:
    # We trigger the pipeline on a merge request
    - if: $CI_PIPELINE_SOURCE == 'merge_request_event'
    # We trigger the pipeline on a schedule
    - if: $CI_PIPELINE_SOURCE == 'schedule'
    # We then add all the regular triggers
    - !reference [.pipeline-trigger-rules, rules]

# This template is used to filter out distributions or architectures that are not required on
# every build.
.manual-only:
  rules:
    - if: $CI_PIPELINE_SOURCE != "schedule"
      when: manual

trigger-pipeline:
  stage: trigger
  script:
    - echo "starting pipeline"
  rules:
    # All pipelines on merge requests must be manually triggered
    - if: $CI_PIPELINE_SOURCE == 'merge_request_event'
      when: manual
      allow_failure: false
    # We schedule the job on a pipeline schedule
    - if: $CI_PIPELINE_SOURCE == "schedule"
    # We then add all the regular triggers
    - !reference [.pipeline-trigger-rules, rules]

# Define the driver versions for jobs that can be run in parallel
.driver-versions:
  parallel:
    matrix:
      - DRIVER_VERSION: [535.216.03, 550.127.08]

# Define the driver versions for jobs that can be run in parallel
.driver-versions-ubuntu24.04:
  parallel:
    matrix:
      - DRIVER_VERSION: [550.127.08]

# Define the matrix of precompiled jobs that can be run in parallel for ubuntu22.04
.driver-versions-precompiled-ubuntu22.04:
  parallel:
    matrix:
      - DRIVER_BRANCH: [535, 550]
        KERNEL_FLAVOR: [aws, azure, generic, nvidia, oracle]

# Define the matrix of precompiled jobs that can be run in parallel for ubuntu24.04
.driver-versions-precompiled-ubuntu24.04:
  parallel:
    matrix:
      - DRIVER_BRANCH: [550]
        KERNEL_FLAVOR: [aws, azure, generic, nvidia, oracle]

# Define the distribution targets
.dist-ubuntu20.04:
  variables:
    DIST: ubuntu20.04
    CVE_UPDATES: "openssl"

.dist-ubuntu22.04:
  variables:
    DIST: ubuntu22.04
    CVE_UPDATES: "openssl"

.dist-ubuntu24.04:
  variables:
    DIST: ubuntu24.04

.dist-rhel8:
  variables:
    DIST: rhel8

.dist-rhel9:
  variables:
    DIST: rhel9

.dist-fedora36:
  variables:
    DIST: fedora36

# Define the platform targets
.platform-amd64:
  variables:
    PLATFORM: linux/amd64

.platform-arm64:
  variables:
    PLATFORM: linux/arm64

# Make buildx available as a docker CLI plugin
.buildx-setup:
  before_script:
    -  export BUILDX_VERSION=v0.16.2
    -  apk add --no-cache curl
    -  mkdir -p ~/.docker/cli-plugins
    -  curl -sSLo ~/.docker/cli-plugins/docker-buildx "https://github.com/docker/buildx/releases/download/${BUILDX_VERSION}/buildx-${BUILDX_VERSION}.linux-amd64"
    -  chmod a+x ~/.docker/cli-plugins/docker-buildx
    -  docker buildx create --use --platform=linux/amd64,linux/arm64
    -  '[[ -n "${SKIP_QEMU_SETUP}" ]] || docker run --rm --privileged multiarch/qemu-user-static --reset -p yes'

# Download the regctl binary for use in the release steps
.regctl-setup:
  before_script:
    - export REGCTL_VERSION=v0.7.1
    - apk add --no-cache curl
    - mkdir -p bin
    - curl -sSLo bin/regctl https://github.com/regclient/regclient/releases/download/${REGCTL_VERSION}/regctl-linux-amd64
    - chmod a+x bin/regctl
    - export PATH=$(pwd)/bin:${PATH}

.release-generic:
  stage: release
  variables:
    # Define the source image for the release
    IMAGE_NAME: "${CI_REGISTRY_IMAGE}"
    VERSION: "${CI_COMMIT_SHORT_SHA}"
    # OUT_VERSION is overridden for external releases
    OUT_VERSION: "${CI_COMMIT_SHORT_SHA}"
  before_script:
    - !reference [.regctl-setup, before_script]
    - apk add --no-cache make bash
  script:
    - 'echo "Logging in to CI registry ${CI_REGISTRY}"'
    - regctl registry login "${CI_REGISTRY}" -u "${CI_REGISTRY_USER}" -p "${CI_REGISTRY_PASSWORD}"
    - '[ ${CI_REGISTRY} = ${OUT_REGISTRY} ] || echo "Logging in to output registry ${OUT_REGISTRY}"'
    - '[ ${CI_REGISTRY} = ${OUT_REGISTRY} ] || regctl registry login "${OUT_REGISTRY}" -u "${OUT_REGISTRY_USER}" -p "${OUT_REGISTRY_TOKEN}"'
    # Since OUT_IMAGE_NAME and OUT_VERSION are set, this will push the CI image to the target
    - if [[ "${PRECOMPILED}" == "true" ]]; then ./scripts/precompiled.sh push; else make push-${DIST}-${DRIVER_VERSION}; fi

.release-ubuntu22.04:
  # Perform for each DRIVER_VERSION
  extends:
    - .release-generic
    - .driver-versions
  rules:
    - if: $CI_PIPELINE_SOURCE != "schedule"

.release-rhel9:
  # Perform for each DRIVER_VERSION
  extends:
    - .release-generic
    - .driver-versions
  rules:
    - if: $CI_PIPELINE_SOURCE != "schedule"

.release:
  # Perform for each DRIVER_VERSION
  extends:
    - .release-generic
    - .driver-versions
  rules:
    - if: $CI_PIPELINE_SOURCE != "schedule"

# Define a staging release step that pushes an image to an internal "staging" repository
# This is triggered for all pipelines (i.e. not only tags) to test the pipeline steps
# outside of the release process.
.release:staging:
  extends:
    - .release
  variables:
    OUT_REGISTRY_USER: "${CI_REGISTRY_USER}"
    OUT_REGISTRY_TOKEN: "${CI_REGISTRY_PASSWORD}"
    OUT_REGISTRY: "${CI_REGISTRY}"
    OUT_IMAGE_NAME: "${CI_REGISTRY_IMAGE}/staging/driver"

.release:staging-ubuntu22.04:
  extends:
    - .release-ubuntu22.04
  variables:
    OUT_REGISTRY_USER: "${CI_REGISTRY_USER}"
    OUT_REGISTRY_TOKEN: "${CI_REGISTRY_PASSWORD}"
    OUT_REGISTRY: "${CI_REGISTRY}"
    OUT_IMAGE_NAME: "${CI_REGISTRY_IMAGE}/staging/driver"

.release:staging-ubuntu24.04:
  extends:
    - .release-ubuntu24.04
  variables:
    OUT_REGISTRY_USER: "${CI_REGISTRY_USER}"
    OUT_REGISTRY_TOKEN: "${CI_REGISTRY_PASSWORD}"
    OUT_REGISTRY: "${CI_REGISTRY}"
    OUT_IMAGE_NAME: "${CI_REGISTRY_IMAGE}/staging/driver"

.release:staging-rhel9:
  extends:
    - .release-rhel9
  variables:
    OUT_REGISTRY_USER: "${CI_REGISTRY_USER}"
    OUT_REGISTRY_TOKEN: "${CI_REGISTRY_PASSWORD}"
    OUT_REGISTRY: "${CI_REGISTRY}"
    OUT_IMAGE_NAME: "${CI_REGISTRY_IMAGE}/staging/driver"

# Define an external release step that pushes an image to an external repository.
.release:external:
  extends:
    - .release
  rules:
    - if: $CI_COMMIT_TAG
      variables:
        #VERSION: "${CI_COMMIT_TAG}"
        OUT_VERSION: ""
    - if: $CI_COMMIT_BRANCH == $RELEASE_DEVEL_BRANCH
      variables:
        VERSION: "${RELEASE_DEVEL_TAG}"
        OUT_VERSION: "${DEVEL_RELEASE_IMAGE_VERSION}"

.release:external-ubuntu22.04:
  extends:
    - .release-ubuntu22.04
  rules:
    - if: $CI_COMMIT_TAG
      variables:
        #VERSION: "${CI_COMMIT_TAG}"
        OUT_VERSION: ""
    - if: $CI_COMMIT_BRANCH == $RELEASE_DEVEL_BRANCH
      variables:
        VERSION: "${RELEASE_DEVEL_TAG}"
        OUT_VERSION: "${DEVEL_RELEASE_IMAGE_VERSION}"

release:staging-ubuntu20.04:
  extends:
    - .release:staging
    - .dist-ubuntu20.04
  needs:
    - image-ubuntu20.04

release:staging-ubuntu22.04:
  extends:
    - .release:staging-ubuntu22.04
    - .dist-ubuntu22.04
  needs:
    - image-ubuntu22.04

release:staging-rhel8:
  extends:
    - .release:staging
    - .dist-rhel8
  needs:
    - image-rhel8

.release:staging-precompiled:
  stage: release
  variables:
    IN_REGISTRY: "${STAGING_REGISTRY}"
    IN_IMAGE_NAME: driver
    OUT_REGISTRY_USER: "${CI_REGISTRY_USER}"
    OUT_REGISTRY_TOKEN: "${CI_REGISTRY_PASSWORD}"
    OUT_REGISTRY: "${CI_REGISTRY}"
    OUT_IMAGE_NAME: "${CI_REGISTRY_IMAGE}/staging/driver"
    # Define the source image for the release
    IMAGE_NAME: "${CI_REGISTRY_IMAGE}"
    VERSION: "${CI_COMMIT_SHORT_SHA}"
    # OUT_VERSION is overridden for external releases
    OUT_VERSION: "${CI_COMMIT_SHORT_SHA}"
    PRECOMPILED: "true"
  extends:
    - .release-generic


# Precompiled Ubuntu22.04 release
release:staging-precompiled-ubuntu22.04:
  variables:
    DIST: signed_ubuntu22.04
    BASE_TARGET: jammy
  extends:
    - .driver-versions-precompiled-ubuntu22.04
    - .release:staging-precompiled
  needs:
    - image-precompiled-ubuntu22.04

# Precompiled Ubuntu24.04 release
release:staging-precompiled-ubuntu24.04:
  variables:
    DIST: signed_ubuntu24.04
    BASE_TARGET: noble
  extends:
    - .driver-versions-precompiled-ubuntu24.04
    - .release:staging-precompiled
  needs:
    - image-precompiled-ubuntu24.04