cloudbuild.yaml

# Reference: https://cloud.google.com/cloud-build/docs/build-config

steps:
  # Pull pre-existing latest Docker image.
  - name: 'gcr.io/cloud-builders/docker'
    id: pull_image
    waitFor: ['-']
    timeout: 10m
    args: ['pull', 'gcr.io/oak-ci/oak:latest']
  # Build Docker image based on current Dockerfile, if necessary.
  - name: 'gcr.io/cloud-builders/docker'
    id: build_image
    entrypoint: 'bash'
    waitFor: ['pull_image']
    timeout: 20m
    args: ['./scripts/docker_build']
  # Run next build steps inside the newly created Docker image.
  # See: https://cloud.google.com/cloud-build/docs/create-custom-build-steps
  # Init .git repository used by check_generated
  # Workaround for https://github.com/GoogleCloudPlatform/cloud-builders/issues/236
  - name: 'gcr.io/oak-ci/oak:latest'
    id: git_init
    entrypoint: 'bash'
    waitFor: ['build_image']
    timeout: 5m
    args: ['./scripts/git_init']

  - name: 'gcr.io/oak-ci/oak:latest'
    id: cargo_crev
    entrypoint: 'bash'
    waitFor: ['git_init']
    timeout: 5m
    args: ['./scripts/run_cargo_crev']

  - name: 'gcr.io/oak-ci/oak:latest'
    id: xtask_ci
    waitFor: ['git_init']
    timeout: 90m
    entrypoint: 'bash'
    args: ['./scripts/xtask', 'run-ci']

  - name: 'gcr.io/oak-ci/oak:latest'
    id: generate_root_ca_certs
    waitFor: ['git_init']
    timeout: 5m
    entrypoint: 'bash'
    args: ['./scripts/generate_root_ca_certs']

  # Ensure that the previous steps did not modify our source-code and that
  # relevant build artifacts are ignored by git.
  - name: 'gcr.io/oak-ci/oak:latest'
    id: git_check_diff
    waitFor: ['git_init', 'xtask_ci', 'generate_root_ca_certs']
    timeout: 5m
    entrypoint: 'bash'
    args: ['./scripts/git_check_diff']

  # Pull Android Docker image.
  - name: 'gcr.io/cloud-builders/docker'
    id: pull_android_image
    waitFor: ['-']
    timeout: 10m
    args: ['pull', 'gcr.io/oak-ci/oak-android:latest']
  # Build Docker image based for Android SDK.
  - name: 'gcr.io/cloud-builders/docker'
    id: build_android_image
    waitFor: ['pull_android_image']
    timeout: 60m
    args:
      [
        'build',
        '--pull',
        '--cache-from=gcr.io/oak-ci/oak-android:latest',
        '--tag=gcr.io/oak-ci/oak-android:latest',
        '--file=android.Dockerfile',
        '.',
      ]
  # Build Android Hello-World application.
  - name: 'gcr.io/oak-ci/oak-android:latest'
    id: build_examples_android
    waitFor: ['build_android_image']
    timeout: 60m
    entrypoint: 'bash'
    args: ['./scripts/build_examples_android']

# Copy compiled enclave binary to Google Cloud Storage.
# See:
# - https://pantheon.corp.google.com/storage/browser/artifacts.oak-ci.appspot.com/test/?project=oak-ci
# - https://cloud.google.com/cloud-build/docs/configuring-builds/store-images-artifacts#storing_artifacts_in
# TODO: Finalize artifact location.
# TODO(#709): get example Docker image working with dev server
#artifacts:
#  objects:
#    location: gs://artifacts.oak-ci.appspot.com/test
#    paths:
#      - ./liboak_enclave_unsigned.so

timeout: 2h

options:
  env:
    # This variable is only defined in the `merge` GCB trigger,
    # and contains GCB credentials for updating the Bazel cache.
    - 'BAZEL_GOOGLE_CREDENTIALS=$_BAZEL_GOOGLE_CREDENTIALS'
  # See: https://cloud.google.com/cloud-build/docs/api/reference/rest/Shared.Types/MachineType
  machineType: 'N1_HIGHCPU_32'
  requestedVerifyOption: 'VERIFIED'
  sourceProvenanceHash: ['SHA256']