update ci

(cherry picked from commit 6dabe9eb)

.gitlab-ci.yml

-image: docker:latest
-
-variables:
-  BASE_REPOSITORY: 'igwn/base'
-
 stages:
-  - docker
+  - build
+  - scan
+  - deploy
   - rebuild
 
-docker:build:
-  stage: docker
-  script:
-    - docker login -u gitlab-ci-token -p $CI_JOB_TOKEN $CI_REGISTRY
-    - docker build --no-cache --pull -t $CI_REGISTRY_IMAGE:$CI_COMMIT_REF_NAME .
-    - docker push $CI_REGISTRY_IMAGE:$CI_COMMIT_REF_NAME
-    - docker logout $CI_REGISTRY
-    - |
-        # push to docker hub
-        if [[ $CI_PROJECT_NAMESPACE == 'docker' ]]; then
-          docker login -u $DOCKER_HUB_USER -p $DOCKER_HUB_TOKEN
-          docker tag $CI_REGISTRY_IMAGE:$CI_COMMIT_REF_NAME $BASE_REPOSITORY:$CI_COMMIT_REF_NAME
-          docker push $BASE_REPOSITORY:$CI_COMMIT_REF_NAME
-          docker logout
-        fi
-    - |
-        # push to quay.io
-        if [[ $CI_PROJECT_NAMESPACE == 'docker' ]]; then
-          docker login -u $QUAY_USER -p $QUAY_TOKEN quay.io
-          docker tag  $CI_REGISTRY_IMAGE:$CI_COMMIT_REF_NAME quay.io/$BASE_REPOSITORY:$CI_COMMIT_REF_NAME
-          docker push quay.io/$BASE_REPOSITORY:$CI_COMMIT_REF_NAME
-          docker logout quay.io
-        fi
-
-#
-# trigger rebuilds of downstream containers
-#
-
-# lint
-
-rebuild:lint:
-  stage: rebuild
-  only:
-    - branches@docker/base
-  trigger:
-    project: docker/lint
-    branch: latest
-
-# packaging
-
-rebuild:el8-production:
-  stage: rebuild
-  only:
-    - branches@docker/base
-  trigger:
-    project: docker/packaging
-    branch: el8-production
-
-rebuild:el8-production-staging:
-  stage: rebuild
-  only:
-    - branches@docker/base
-  trigger:
-    project: docker/packaging
-    branch: el8-production-staging
-
-rebuild:el8-testing:
-  stage: rebuild
-  only:
-    - branches@docker/base
-  trigger:
-    project: docker/packaging
-    branch: el8-testing
-
-rebuild:el8-staging:
-  stage: rebuild
-  only:
-    - branches@docker/base
-  trigger:
-    project: docker/packaging
-    branch: el8-staging
+include:
+  # build and publish _this_ image
+  - local: '.gitlab/ci/build.yml'
+  # trigger rebuilds of downstream images
+  - local: '.gitlab/ci/trigger.yml'

.gitlab/ci/build.yml

+# ---------------------------
+# Build workflow
+# ---------------------------
+
+include:
+  # https://computing.docs.ligo.org/gitlab-ci-templates/
+  - project: computing/gitlab-ci-templates
+    # https://computing.docs.ligo.org/gitlab-ci-templates/docker/
+    file: docker.yml
+  # https://docs.gitlab.com/ee/user/application_security/container_scanning/
+  - template: Security/Container-Scanning.gitlab-ci.yml
+
+# -- build the image --------
+
+build:
+  stage: build
+  extends:
+    # https://computing.docs.ligo.org/gitlab-ci-templates/docker/#.docker:build
+    - .docker:build
+  variables:
+    # use the branch name as the tag
+    CI_REGISTRY_TAG: '$CI_COMMIT_REF_SLUG'
+
+# -- scan the image ---------
+
+# check the image for vulnerabilities, see
+# https://docs.gitlab.com/ee/user/application_security/container_scanning/
+container_scanning:
+  stage: scan
+  needs: [build]
+  variables:
+    DOCKER_IMAGE: '$CI_REGISTRY_IMAGE:$CI_COMMIT_REF_SLUG'
+
+# -- push the image ---------
+
+.push:
+  stage: deploy
+  needs: [build]
+  variables:
+    # pull the branch image
+    PULL_IMAGE: "$CI_REGISTRY_IMAGE:$CI_COMMIT_REF_SLUG"
+    # push to igwn namespace
+    PUSH_IMAGE: "igwn/$CI_PROJECT_NAME:$CI_COMMIT_REF_SLUG"
+  rules:
+    # only run on pushes to the upstream repo (not on forks)
+    - if: '$CI_PROJECT_NAMESPACE == "docker" && $CI_COMMIT_BRANCH'
+
+push:docker_io:
+  extends:
+    # https://computing.docs.ligo.org/gitlab-ci-templates/docker/#.docker:push:docker_io
+    - .docker:push:docker_io
+    - .push
+
+push:quay_io:
+  extends:
+    # https://computing.docs.ligo.org/gitlab-ci-templates/docker/#.docker:push:quay_io
+    - .docker:push:quay_io
+    - .push

.gitlab/ci/trigger.yml

+# ---------------------------
+# Downstream trigger workflow
+# ---------------------------
+
+.rebuild:
+  stage: rebuild
+  rules:
+    # only run on pushes to the upstream repo (not on forks)
+    - if: '$CI_PROJECT_NAMESPACE == "docker" && $CI_COMMIT_BRANCH'
+  trigger:
+    # default rebuilds to trigger on the same branch
+    branch: $CI_COMMIT_BRANCH
+
+# builder
+
+rebuild:builder:
+  extends: [.rebuild]
+  trigger:
+    project: docker/builder
+
+# lint
+
+rebuild:lint:
+  extends: [.rebuild]
+  trigger:
+    project: docker/lint
+    branch: latest
+
+# packaging
+
+rebuild:el8-production:
+  extends: [.rebuild]
+  trigger:
+    project: docker/packaging
+    branch: el8-production
+
+rebuild:el8-production-staging:
+  extends: [.rebuild]
+  trigger:
+    project: docker/packaging
+    branch: el8-production-staging
+
+rebuild:el8-testing:
+  extends: [.rebuild]
+  trigger:
+    project: docker/packaging
+    branch: el8-testing
+
+rebuild:el8-staging:
+  extends: [.rebuild]
+  trigger:
+    project: docker/packaging
+    branch: el8-staging