substitutions:
  # using this base image for now, because there is an issue causing the newest COS dev
  # image not booting with cs.
  '_BASE_IMAGE': '' # left empty means using the latest image in the family
  '_BASE_IMAGE_FAMILY': 'cos-dev' # base image family
  '_OUTPUT_IMAGE_PREFIX': 'confidential-space'
  '_OUTPUT_IMAGE_SUFFIX': ''
  '_OUTPUT_IMAGE_FAMILY': ''
  '_BUCKET_NAME': '${PROJECT_ID}_cloudbuild'

steps:
# determine the base image
- name: 'gcr.io/cloud-builders/gcloud'
  id: BaseImageIdent
  env:
  - 'BASE_IMAGE=$_BASE_IMAGE'
  - 'BASE_IMAGE_FAMILY=$_BASE_IMAGE_FAMILY'
  script: |
    #!/usr/bin/env bash

    # if BASE_IMAGE is not specified in the substitutions, use the latest COS dev image
    base_image=${BASE_IMAGE}
    if [ -z ${base_image} ]
    then
      echo "getting the latest COS image"
      base_image=$(gcloud compute images describe-from-family ${BASE_IMAGE_FAMILY} --project cos-cloud | grep name | cut -d ' ' -f 2)
    fi

    echo ${base_image} > /workspace/base_image.txt

- name: 'gcr.io/cloud-builders/gcloud'
  id: DebugImageBuild
  waitFor: ['BaseImageIdent']
  env:
  - 'OUTPUT_IMAGE_PREFIX=$_OUTPUT_IMAGE_PREFIX'
  - 'OUTPUT_IMAGE_SUFFIX=$_OUTPUT_IMAGE_SUFFIX'
  - 'OUTPUT_IMAGE_FAMILY=$_OUTPUT_IMAGE_FAMILY'
  - 'BUCKET_NAME=$_BUCKET_NAME'
  script: |
    #!/usr/bin/env bash
    set -exuo pipefail

    base_image=$(cat /workspace/base_image.txt)
    echo "building the debug image: ${OUTPUT_IMAGE_PREFIX}-debug-${OUTPUT_IMAGE_SUFFIX} with the base image: ${base_image}"
    gcloud builds submit --config=launcher/image/cloudbuild.yaml --region us-west1 \
      --substitutions _BASE_IMAGE=${base_image},_OUTPUT_IMAGE_FAMILY=${OUTPUT_IMAGE_FAMILY}-debug,_OUTPUT_IMAGE_NAME=${OUTPUT_IMAGE_PREFIX}-debug-${OUTPUT_IMAGE_SUFFIX},_IMAGE_ENV=debug,_CS_LICENSE=projects/confidential-space-images/global/licenses/confidential-space-debug,_BUCKET_NAME=${BUCKET_NAME}
    exit

- name: 'gcr.io/cloud-builders/gcloud'
  id: HardenedImageBuild
  waitFor: ['BaseImageIdent']
  env:
  - 'OUTPUT_IMAGE_PREFIX=$_OUTPUT_IMAGE_PREFIX'
  - 'OUTPUT_IMAGE_SUFFIX=$_OUTPUT_IMAGE_SUFFIX'
  - 'OUTPUT_IMAGE_FAMILY=$_OUTPUT_IMAGE_FAMILY'
  - 'BUCKET_NAME=$_BUCKET_NAME'
  script: |
    #!/usr/bin/env bash
    set -exuo pipefail

    base_image=$(cat /workspace/base_image.txt)
    echo "building the hardened image: ${OUTPUT_IMAGE_PREFIX}-hardened-${OUTPUT_IMAGE_SUFFIX} with the base image: ${base_image}"
    gcloud builds submit --config=launcher/image/cloudbuild.yaml --region us-west1 \
      --substitutions _BASE_IMAGE=${base_image},_OUTPUT_IMAGE_FAMILY=${OUTPUT_IMAGE_FAMILY},_OUTPUT_IMAGE_NAME=${OUTPUT_IMAGE_PREFIX}-hardened-${OUTPUT_IMAGE_SUFFIX},_IMAGE_ENV=hardened,_CS_LICENSE=projects/confidential-space-images/global/licenses/confidential-space,_BUCKET_NAME=${BUCKET_NAME}
    exit

- name: 'gcr.io/cloud-builders/gcloud'
  id: DebugImageTests
  waitFor: ['DebugImageBuild']
  env:
  - 'OUTPUT_IMAGE_PREFIX=$_OUTPUT_IMAGE_PREFIX'
  - 'OUTPUT_IMAGE_SUFFIX=$_OUTPUT_IMAGE_SUFFIX'
  - 'PROJECT_ID=$PROJECT_ID'
  script: |
    #!/usr/bin/env bash

    cd launcher/image/test
    echo "running debug image tests on ${OUTPUT_IMAGE_PREFIX}-debug-${OUTPUT_IMAGE_SUFFIX}"
    gcloud builds submit --config=test_debug_cloudbuild.yaml --region us-west1 \
      --substitutions _IMAGE_NAME=${OUTPUT_IMAGE_PREFIX}-debug-${OUTPUT_IMAGE_SUFFIX},_IMAGE_PROJECT=${PROJECT_ID}
    exit

- name: 'gcr.io/cloud-builders/gcloud'
  id: HardenedImageTests
  waitFor: ['HardenedImageBuild']
  env:
  - 'OUTPUT_IMAGE_PREFIX=$_OUTPUT_IMAGE_PREFIX'
  - 'OUTPUT_IMAGE_SUFFIX=$_OUTPUT_IMAGE_SUFFIX'
  - 'PROJECT_ID=$PROJECT_ID'
  script: |
    #!/usr/bin/env bash

    cd launcher/image/test
    echo "running hardened image tests on ${OUTPUT_IMAGE_PREFIX}-hardened-${OUTPUT_IMAGE_SUFFIX}"
    gcloud builds submit --config=test_hardened_cloudbuild.yaml --region us-west1 \
      --substitutions _IMAGE_NAME=${OUTPUT_IMAGE_PREFIX}-hardened-${OUTPUT_IMAGE_SUFFIX},_IMAGE_PROJECT=${PROJECT_ID}
    exit
- name: 'gcr.io/cloud-builders/gcloud'
  id: LaunchPolicyTests
  waitFor: ['HardenedImageBuild']
  env:
  - 'OUTPUT_IMAGE_PREFIX=$_OUTPUT_IMAGE_PREFIX'
  - 'OUTPUT_IMAGE_SUFFIX=$_OUTPUT_IMAGE_SUFFIX'
  - 'PROJECT_ID=$PROJECT_ID'
  script: |
    #!/usr/bin/env bash

    cd launcher/image/test
    echo "running launch policy tests on ${OUTPUT_IMAGE_PREFIX}-hardened-${OUTPUT_IMAGE_SUFFIX}"
    gcloud builds submit --config=test_launchpolicy_cloudbuild.yaml --region us-west1 \
      --substitutions _IMAGE_NAME=${OUTPUT_IMAGE_PREFIX}-hardened-${OUTPUT_IMAGE_SUFFIX},_IMAGE_PROJECT=${PROJECT_ID}
    exit

- name: 'gcr.io/cloud-builders/gcloud'
  id: HardenedNetworkIngressTests
  waitFor: ['HardenedImageBuild']
  env:
  - 'OUTPUT_IMAGE_PREFIX=$_OUTPUT_IMAGE_PREFIX'
  - 'OUTPUT_IMAGE_SUFFIX=$_OUTPUT_IMAGE_SUFFIX'
  - 'PROJECT_ID=$PROJECT_ID'
  script: |
    #!/usr/bin/env bash
    cd launcher/image/test
    echo "running hardened image ingress network tests on ${OUTPUT_IMAGE_PREFIX}-hardened-${OUTPUT_IMAGE_SUFFIX}"
    gcloud builds submit --config=test_ingress_network.yaml --region us-west1 \
      --substitutions _IMAGE_NAME=${OUTPUT_IMAGE_PREFIX}-hardened-${OUTPUT_IMAGE_SUFFIX},_IMAGE_PROJECT=${PROJECT_ID}
    exit
- name: 'gcr.io/cloud-builders/gcloud'
  id: DebugNetworkIngressTests
  waitFor: ['DebugImageBuild']
  env:
  - 'OUTPUT_IMAGE_PREFIX=$_OUTPUT_IMAGE_PREFIX'
  - 'OUTPUT_IMAGE_SUFFIX=$_OUTPUT_IMAGE_SUFFIX'
  - 'PROJECT_ID=$PROJECT_ID'
  script: |
    #!/usr/bin/env bash
    cd launcher/image/test
    echo "running debug image ingress network tests on ${OUTPUT_IMAGE_PREFIX}-debug-${OUTPUT_IMAGE_SUFFIX}"
    gcloud builds submit --config=test_ingress_network.yaml --region us-west1 \
      --substitutions _IMAGE_NAME=${OUTPUT_IMAGE_PREFIX}-debug-${OUTPUT_IMAGE_SUFFIX},_IMAGE_PROJECT=${PROJECT_ID}
    exit

options:
  pool:
    name: 'projects/confidential-space-images-dev/locations/us-west1/workerPools/cs-image-build-vpc'
