CI/CD integration

variables:
  # TIGERGATE_REGION: "eu1"      # the region that issued the key; omit for us1
  GIT_CONFIG_COUNT: "1"
  GIT_CONFIG_KEY_0: "safe.directory"
  GIT_CONFIG_VALUE_0: "*"

mr-scan:
  image: tigergate/tigergate-cli:latest 
  script:
    - tigergate scan --type all --scan-scope diff --upload
  rules:
    - if: '$CI_PIPELINE_SOURCE == "merge_request_event"'

full-scan:
  image: tigergate/tigergate-cli:latest 
  script:
    - tigergate scan --type all --scan-scope full --upload
  rules:
    - if: '$CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH'

# TIGERGATE_API_KEY is a repository variable. Add TIGERGATE_REGION the same
# way for any region other than us1 — the region that issued the key.
image: tigergate/tigergate-cli:latest
clone:
  depth: full

pipelines:
  pull-requests:
    '**':
      - step:
          name: PR scan (diff)
          script:
            - export GIT_CONFIG_COUNT=1 GIT_CONFIG_KEY_0=safe.directory GIT_CONFIG_VALUE_0='*'
            - tigergate scan --type all --scan-scope diff --upload
  branches:
    main:
      - step:
          name: Full scan
          script:
            - export GIT_CONFIG_COUNT=1 GIT_CONFIG_KEY_0=safe.directory GIT_CONFIG_VALUE_0='*'
            - tigergate scan --type all --scan-scope full --upload

pipeline {
  agent {
    docker {
      image 'tigergate/tigergate-cli:latest'
      reuseNode true
    }
  }
  environment {
    TIGERGATE_API_KEY  = credentials('tigergate-api-key')
    // TIGERGATE_REGION = 'eu1'  // the region that issued the key; omit for us1
    GIT_CONFIG_COUNT   = '1'
    GIT_CONFIG_KEY_0   = 'safe.directory'
    GIT_CONFIG_VALUE_0 = '*'
  }
  stages {
    stage('Security Scan') {
      steps {
        script {
          if (env.CHANGE_ID) {
            sh 'tigergate scan --type all --scan-scope diff --upload'
          } else {
            sh 'tigergate scan --type all --scan-scope full --upload'
          }
        }
      }
    }
  }
}

version: 2.1
jobs:
  tigergate:
    docker:
      - image: tigergate/tigergate-cli:latest
    # TIGERGATE_API_KEY comes from a project env var. Add TIGERGATE_REGION
    # the same way for any region other than us1.
    steps:
      - checkout
      - run: tigergate scan --type all --fail-on critical,high --upload

workflows:
  ci:
    jobs:
      - tigergate

trigger:
  branches: { include: [main] }
pr:
  branches: { include: [main] }

pool:
  vmImage: ubuntu-latest

container:
  image: tigergate/tigergate-cli:latest
  env:
    GIT_CONFIG_COUNT: '1'
    GIT_CONFIG_KEY_0: safe.directory
    GIT_CONFIG_VALUE_0: '*'

steps:
  - checkout: self
    fetchDepth: 0

  # Azure does not auto-expose variables to the script environment, so outside
  # us1 name the region here too — the region that issued the key:
  #   env: { TIGERGATE_API_KEY: $(TIGERGATE_API_KEY), TIGERGATE_REGION: eu1 }
  - script: tigergate scan --type all --scan-scope full --upload
    condition: ne(variables['Build.Reason'], 'PullRequest')
    env: { TIGERGATE_API_KEY: $(TIGERGATE_API_KEY) }

  - script: tigergate scan --type all --scan-scope diff --upload
    condition: eq(variables['Build.Reason'], 'PullRequest')
    env: { TIGERGATE_API_KEY: $(TIGERGATE_API_KEY) }

pool:
  name: 'Default'   # your self-hosted agent pool

version: 0.2
env:
  variables:
    TIGERGATE_REGION: us1    # the region that issued the key
phases:
  build:
    commands:
      - tigergate scan --type all --scan-scope full --upload

- docker run --rm -e TIGERGATE_API_KEY -e TIGERGATE_REGION -v "$PWD":/workspace -w /workspace tigergate/tigergate-cli:latest  scan --type all --scan-scope full --upload

steps:
  - name: 'tigergate/tigergate-cli:latest'
    args: ['scan', '--type', 'all', '--scan-scope', 'full', '--upload']
    secretEnv: ['TIGERGATE_API_KEY']
    # env: ['TIGERGATE_REGION=eu1']   # the region that issued the key; omit for us1

availableSecrets:
  secretManager:
    - versionName: projects/$PROJECT_ID/secrets/tigergate-api-key/versions/latest
      env: 'TIGERGATE_API_KEY'

kind: pipeline
type: docker
name: security-scan

steps:
  - name: tigergate-scan
    image: tigergate/tigergate-cli:latest 
    environment:
      TIGERGATE_API_KEY:
        from_secret: tigergate_api_key
      # TIGERGATE_REGION: eu1   # the region that issued the key; omit for us1
      CI_MERGE_REQUEST_TARGET_BRANCH_NAME: ${DRONE_TARGET_BRANCH}
    commands:
      - tigergate scan --type all --upload

language: minimal
services:
  - docker
script:
  - >
    docker run --rm
    -e TIGERGATE_API_KEY
    -e TIGERGATE_REGION
    -e CI_MERGE_REQUEST_TARGET_BRANCH_NAME=$TRAVIS_BRANCH
    -v "$PWD":/workspace -w /workspace
    tigergate/tigergate-cli:latest 
    scan --type all --upload

steps:
  - label: "TigerGate scan"
    command: "tigergate scan --type all --upload"
    plugins:
      - docker#v5.11.0:
          image: "tigergate/tigergate-cli:latest"
          environment:
            - "TIGERGATE_API_KEY"
            # - "TIGERGATE_REGION=eu1"   # the region that issued the key; omit for us1
            - "CI_MERGE_REQUEST_TARGET_BRANCH_NAME=${BUILDKITE_PULL_REQUEST_BASE_BRANCH}"

docker run --rm \
  -e TIGERGATE_API_KEY \
  -e TIGERGATE_REGION \
  -e CI_MERGE_REQUEST_TARGET_BRANCH_NAME=%teamcity.pullRequest.targetBranch% \
  -v "%teamcity.build.checkoutDir%":/workspace -w /workspace \
  tigergate/tigergate-cli:latest  \
  scan --type all --upload

apiVersion: tekton.dev/v1
kind: Task
metadata:
  name: tigergate-scan
spec:
  workspaces:
    - name: source
  steps:
    - name: scan
      image: tigergate/tigergate-cli:latest 
      workingDir: $(workspaces.source.path)
      env:
        - name: TIGERGATE_API_KEY
          valueFrom:
            secretKeyRef:
              name: tigergate-ci
              key: api-key
        # - name: TIGERGATE_REGION      # the region that issued the key
        #   value: eu1                  # omit for us1
      script: |
        tigergate scan --type all --upload

docker run --rm \
  -e TIGERGATE_API_KEY="$TIGERGATE_API_KEY" \
  -e TIGERGATE_REGION="${TIGERGATE_REGION:-us1}" \
  -v "$PWD":/workspace -w /workspace \
  tigergate/tigergate-cli:latest  \
  scan --type all --upload