buildspec.yaml

# Copyright © 2020 Amazon Web Services
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
#      http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.

# https://docs.aws.amazon.com/codebuild/latest/userguide/build-spec-ref.html

# https://docs.aws.amazon.com/codebuild/latest/userguide/build-env-ref-env-vars.html
version: 0.2

env:
  secrets-manager:
    DOCKER_USERNAME: /osdu/devops/docker_credentials:username
    DOCKER_PASSWORD: /osdu/devops/docker_credentials:password
    SONAR_USERNAME: /osdu/devops/sonar_credentials:username
    SONAR_PASSWORD: /osdu/devops/sonar_credentials:password
  
  parameter-store:
    SONAR_URL: /osdu/devops/sonar_url

phases:
  install:
    runtime-versions:
      java: corretto17
    commands:
      - java -version
      - mvn -version
      - mkdir -p /root/.m2
      - cp ./.mvn/community-maven.settings.xml /root/.m2/settings.xml
      # Install git secrets

      - git clone https://github.com/awslabs/git-secrets.git
      - cd git-secrets && make install && cd ..
      - git secrets --install && git secrets --register-aws
  pre_build:
    commands:
      - echo "Logging in to Amazon ECR..."
      - aws ecr get-login-password --region ${AWS_REGION} | docker login --username AWS --password-stdin ${ECR_REGISTRY} # authenticate with ECR via the AWS CLI
      - echo "Logging into Docker Hub..."
      - docker login -u ${DOCKER_USERNAME} -p ${DOCKER_PASSWORD}
  build:
    commands:
      - export OUTPUT_DIR="dist"
      - export BRANCH_NAME=`echo ${BRANCH_NAME} | awk '{gsub("refs/heads/","");gsub("\\.","-");gsub("[[:space:]]","-")}1' | sed 's/\//-/g' | awk '{print tolower($0)}'`
      - export ECR_TAG=`echo build.${BRANCH_NAME}.${CODEBUILD_BUILD_NUMBER}.${COMMIT_ID} | cut -c 1-120`
      - export PUSH_ENDPOINT_ECR_TAG=`echo push_endpoint.${BRANCH_NAME}.${CODEBUILD_BUILD_NUMBER}.${COMMIT_ID} | cut -c 1-120`
      - export ECR_IMAGE=${ECR_REGISTRY}:${ECR_TAG}
      - export ECR_IMAGE_BRANCH_LATEST=${ECR_REGISTRY}:${BRANCH_NAME}
      - export PUSH_ENDPOINT_IMAGE=${ECR_REGISTRY}:${PUSH_ENDPOINT_ECR_TAG}
      - export INTEGRATION_TEST_OUTPUT=${OUTPUT_DIR}/testing/integration
      - export INTEGRATION_TEST_OUTPUT_BIN=${INTEGRATION_TEST_OUTPUT}/bin
      - mkdir -p ${OUTPUT_DIR}/bin
      - mkdir -p ${OUTPUT_DIR}/testing && mkdir -p ${INTEGRATION_TEST_OUTPUT}  && mkdir -p ${INTEGRATION_TEST_OUTPUT}/bin
      - echo "Placeholder" >> ${OUTPUT_DIR}/build-info.json # touched so that the output directory has some content incase the build fails so that testing reports are uploaded
      - pom_version=$(mvn help:evaluate -Dexpression=project.version -q -DforceStdout)
      - export VERSION=${pom_version%-*}
      - printenv

      - GIT_SECRETS_SCAN_RESULT=$(git secrets --scan 2> ${OUTPUT_DIR}/git_secrets.out.txt && echo OK || echo FAILED)
      - if [ "$GIT_SECRETS_SCAN_RESULT" = "FAILED" ]; then echo "Secrets detected!" && exit 1; fi