Merge branch 'bullseye-update-ci' into 'bullseye'

Update CI [bullseye]

See merge request docker/base!16

.gitlab-ci.yml

-image: docker:latest
-
-variables:
-  BASE_REPOSITORY: 'igwn/base'
-
 stages:
-  - docker
+  - build
+  - scan
+  - deploy
   - rebuild
 
-docker:build:
-  stage: docker
-  script:
-    - docker login -u gitlab-ci-token -p $CI_JOB_TOKEN $CI_REGISTRY
-    - docker build --no-cache --pull -t $CI_REGISTRY_IMAGE:$CI_COMMIT_REF_NAME .
-    - docker push $CI_REGISTRY_IMAGE:$CI_COMMIT_REF_NAME
-    - docker logout $CI_REGISTRY
-    - |
-        # push to docker hub
-        if [[ $CI_PROJECT_NAMESPACE == 'docker' ]]; then
-          docker login -u $DOCKER_HUB_USER -p $DOCKER_HUB_TOKEN
-          docker tag $CI_REGISTRY_IMAGE:$CI_COMMIT_REF_NAME $BASE_REPOSITORY:$CI_COMMIT_REF_NAME
-          docker push $BASE_REPOSITORY:$CI_COMMIT_REF_NAME
-          docker logout
-        fi
-    - |
-        # push to quay.io
-        if [[ $CI_PROJECT_NAMESPACE == 'docker' ]]; then
-          docker login -u $QUAY_USER -p $QUAY_TOKEN quay.io
-          docker tag  $CI_REGISTRY_IMAGE:$CI_COMMIT_REF_NAME quay.io/$BASE_REPOSITORY:$CI_COMMIT_REF_NAME
-          docker push quay.io/$BASE_REPOSITORY:$CI_COMMIT_REF_NAME
-          docker logout quay.io
-        fi
-
-#
-# trigger rebuilds of downstream containers
-#
-
-# lalsuite-dev
-
-rebuild:lalsuite-dev:
-  stage: rebuild
-  only:
-    - branches@docker/base
-  trigger:
-    project: docker/lalsuite-dev
-    branch: bullseye
-
-## ssh container
-#
-#rebuild:ssh:
-#  stage: rebuild
-#  only:
-#    - branchesdocker/base
-#  trigger:
-#    project: docker/ssh
-#    branch: bullseye
-#
-## software container
-#
-#rebuild:software:
-#  stage: rebuild
-#  only:
-#    - branches@docker/base
-#  trigger:
-#    project: docker/software
-#    branch: bullseye
+include:
+  # build and publish _this_ image
+  - local: '.gitlab/ci/build.yml'
+  # trigger rebuilds of downstream images
+  - local: '.gitlab/ci/trigger.yml'

.gitlab/ci/build.yml

+# ---------------------------
+# Build workflow
+# ---------------------------
+
+include:
+  # https://computing.docs.ligo.org/gitlab-ci-templates/
+  - project: computing/gitlab-ci-templates
+    # https://computing.docs.ligo.org/gitlab-ci-templates/docker/
+    file: docker.yml
+  # https://docs.gitlab.com/ee/user/application_security/container_scanning/
+  - template: Security/Container-Scanning.gitlab-ci.yml
+
+# -- build the image --------
+
+build:
+  stage: build
+  extends:
+    # https://computing.docs.ligo.org/gitlab-ci-templates/docker/#.docker:build
+    - .docker:build
+  variables:
+    # use the branch name as the tag
+    CI_REGISTRY_TAG: '$CI_COMMIT_REF_SLUG'
+
+# -- scan the image ---------
+
+# check the image for vulnerabilities, see
+# https://docs.gitlab.com/ee/user/application_security/container_scanning/
+container_scanning:
+  stage: scan
+  needs: [build]
+  variables:
+    DOCKER_IMAGE: '$CI_REGISTRY_IMAGE:$CI_COMMIT_REF_SLUG'
+
+# -- push the image ---------
+
+.push:
+  stage: deploy
+  needs: [build]
+  variables:
+    # pull the branch image
+    PULL_IMAGE: "$CI_REGISTRY_IMAGE:$CI_COMMIT_REF_SLUG"
+    # push to igwn namespace
+    PUSH_IMAGE: "igwn/$CI_PROJECT_NAME:$CI_COMMIT_REF_SLUG"
+  rules:
+    # only run on pushes to the upstream repo (not on forks)
+    - if: '$CI_PROJECT_NAMESPACE == "docker" && $CI_COMMIT_BRANCH'
+
+push:docker_io:
+  extends:
+    # https://computing.docs.ligo.org/gitlab-ci-templates/docker/#.docker:push:docker_io
+    - .docker:push:docker_io
+    - .push
+
+push:quay_io:
+  extends:
+    # https://computing.docs.ligo.org/gitlab-ci-templates/docker/#.docker:push:quay_io
+    - .docker:push:quay_io
+    - .push

.gitlab/ci/trigger.yml

+# ---------------------------
+# Downstream trigger workflow
+# ---------------------------
+
+.rebuild:
+  stage: rebuild
+  rules:
+    # only run on pushes to the upstream repo (not on forks)
+    - if: '$CI_PROJECT_NAMESPACE == "docker" && $CI_COMMIT_BRANCH'
+  trigger:
+    # default rebuilds to trigger on the same branch
+    branch: $CI_COMMIT_BRANCH
+
+rebuild:builder:
+  extends: [.rebuild]
+  trigger:
+    project: docker/builder
+
+rebuild:lalsuite-dev:
+  extends: [.rebuild]
+  trigger:
+    project: docker/lalsuite-dev