.gitlab-ci.yml

---
include:
  - https://gitlab-templates.ddbuild.io/slack-notifier/v3-sdm/template.yml
  - .gitlab/dev_envs.yml
  - .gitlab/devcontainer.yml

stages:
  - setup
  - build
  - availability_message
  - trigger_build_kernels
  - test
  - dev_envs
  - devcontainer
  - release
  - notify

variables:
  # To release Windows images, we need tools that are not necessarily present on the Windows Gitlab runners
  # (eg. updated versions of awscli, tools to sign images - if we decide to sign buildimages some day)
  # Thus, to release buildimages, we do the same thing as what we do in the Agent: we run the Docker publish script in
  # the buildimage for the highest Windows version supported.
  # This image must use the same Windows version as the Windows version of the Gitlab runner used in .winrelease
  WINDOWS_RELEASE_IMAGE: $BUILDENV_REGISTRY/ci/datadog-agent-buildimages/windows_ltsc2022_x64
  SETUP_IMAGE_NAME: $BUILDENV_REGISTRY/ci/datadog-agent-buildimages/deb_x64:v19805261-b468a29 # Image used during setup task, must contains pyinvoke
  S3_CP_CMD: aws s3 cp $S3_CP_OPTIONS
  S3_PERMANENT_ARTIFACTS_URI: s3://dd-ci-persistent-artefacts-build-stable/datadog-agent
  DATADOG_AGENT_EMBEDDED_PATH: /opt/datadog-agent/embedded
  S3_OMNIBUS_CACHE_BUCKET: dd-ci-datadog-agent-omnibus-cache-build-stable
  S3_OMNIBUS_CACHE_ANONYMOUS_ACCESS: "true"
  EXTRA_KCONFIG_VERSION: "0.1"
  ECR_TEST_ONLY: "_test_only"
  CI_IMAGE_REPO: "ci/${CI_PROJECT_NAME}"
  CI_IMAGE: "${BUILDENV_REGISTRY}/${CI_IMAGE_REPO}:v30023992-5c09d40b@sha256:5a83247d330ea44b437eb207711561005ca08343ccf4aa523d3540fe01e095f6" # https://gitlab.ddbuild.io/DataDog/datadog-agent-buildimages/-/jobs/458723556
  IMAGE_VERSION: "v$CI_PIPELINE_ID-${CI_COMMIT_SHORT_SHA}"

#
# Workflow rules
# Rules used to define whether a pipeline should run, and with which variables
#

.if_release_or_main_branch: &if_release_or_main_branch
  if: $CI_COMMIT_BRANCH =~ /^[0-9]+\.[0-9]+\.x$/ || $CI_COMMIT_BRANCH == "main"

.if_not_release_nor_main_branch: &if_not_release_nor_main_branch
  if: $CI_COMMIT_BRANCH !~ /^[0-9]+\.[0-9]+\.x$/ && $CI_COMMIT_BRANCH != "main"

.on_push:
  - if: $CI_PIPELINE_SOURCE == "schedule"
    when: never
  - if: $CI_COMMIT_TAG != null
    when: never
  - when: always

.on_default_branch_push:
  - if: $CI_PIPELINE_SOURCE == "schedule"
    when: never
  - if: $CI_COMMIT_TAG != null
    when: never
  - if: $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH
    when: always

workflow:
  rules:
    - <<: *if_release_or_main_branch
      variables:
        # Don't use the `*_test_only` ECR for images built from commits that are on main or on a release branch
        ECR_TEST_ONLY: ""
    - <<: *if_not_release_nor_main_branch
      variables:
        # Use the `*_test_only` ECR for images built from commits that are not on main nor on a release branch
        ECR_TEST_ONLY: "_test_only"

default:
  retry:
    max: 2
    when:
      - runner_system_failure
      - stuck_or_timeout_failure
      - unknown_failure
      - api_failure

get_agent_version:
  stage: setup
  image: $SETUP_IMAGE_NAME
  script:
    - VERSION=$(inv agent.version)
    - echo "AGENT_VERSION=$VERSION"
    - echo "AGENT_VERSION=$VERSION" >> version.env
  artifacts:
    reports:
      dotenv: version.env
  tags: ["arch:amd64"]

.x64:
  tags: ["runner:docker"]
  image: "$BUILDENV_REGISTRY/images/docker:20.10-py3"
  variables:
    DD_TARGET_ARCH: x64

.arm:
  tags: ["runner:docker-arm", "platform:arm64"]
  image: "$BUILDENV_REGISTRY/images/docker:20.10-py3"
  variables:
    DD_TARGET_ARCH: aarch64

.build:
  stage: build
  rules:
    - if: $CI_COMMIT_TAG == null
  script:
    # Dockerhub login
    - DOCKER_REGISTRY_LOGIN=$(aws ssm get-parameter --region us-east-1 --name ci.datadog-agent.docker_hub_login --with-decryption --query "Parameter.Value" --out text)
    - aws ssm get-parameter --region us-east-1 --name ci.datadog-agent.docker_hub_pwd --with-decryption --query "Parameter.Value" --out text | docker login --username "$DOCKER_REGISTRY_LOGIN" --password-stdin docker.io
    # ECR login
    - eval "$(aws ecr get-login --region us-east-1 --no-include-email --registry-ids 486234852809)"
    # Build
    - GO_BUILD_ARGS=$(cat go.env | sed -e 's/^/--build-arg /' | tr '\n' ' ')
    - docker build --build-arg BASE_IMAGE=$BASE_IMAGE --build-arg DD_TARGET_ARCH=$DD_TARGET_ARCH $GO_BUILD_ARGS $CUSTOM_BUILD_ARGS --tag registry.ddbuild.io/ci/datadog-agent-buildimages/$IMAGE${ECR_TEST_ONLY}:$IMAGE_VERSION --file $DOCKERFILE .
    # For size debug purposes
    - docker images registry.ddbuild.io/ci/datadog-agent-buildimages/$IMAGE${ECR_TEST_ONLY}:$IMAGE_VERSION
    - docker history --no-trunc registry.ddbuild.io/ci/datadog-agent-buildimages/$IMAGE${ECR_TEST_ONLY}:$IMAGE_VERSION
    - |
      if [ "$CI_PIPELINE_SOURCE" != "schedule" ]; then
        docker push registry.ddbuild.io/ci/datadog-agent-buildimages/$IMAGE${ECR_TEST_ONLY}:$IMAGE_VERSION
      fi
  after_script:
    - if [ "${CI_JOB_STATUS}" != 'success' ]; then echo -e "\033[0;32m\033[1mBuild failed.\033[0m"; exit 0; fi
    - export SIZE=$(docker inspect -f "{{ .Size }}" registry.ddbuild.io/ci/datadog-agent-buildimages/$IMAGE${ECR_TEST_ONLY}:$IMAGE_VERSION)
    - ./send-metrics.sh $IMAGE $SIZE $CI_COMMIT_REF_NAME
    - |
      if [ "$CI_PIPELINE_SOURCE" != "schedule" ]; then
        echo -e "\033[0;32m\033[1mImage registry.ddbuild.io/ci/datadog-agent-buildimages/$IMAGE${ECR_TEST_ONLY}:$IMAGE_VERSION is available.\033[0m"
      else
        echo -e "\033[0;33m\033[1mScheduled pipeline, image push skipped.\033[0m"
      fi


.build_ddregistry:
  stage: build
  rules:
    - if: $CI_COMMIT_TAG == null
  script:
    # Dockerhub login
    - DOCKER_REGISTRY_LOGIN=$(aws ssm get-parameter --region us-east-1 --name ci.datadog-agent.docker_hub_login --with-decryption --query "Parameter.Value" --out text)
    - aws ssm get-parameter --region us-east-1 --name ci.datadog-agent.docker_hub_pwd --with-decryption --query "Parameter.Value" --out text | docker login --username "$DOCKER_REGISTRY_LOGIN" --password-stdin docker.io
    # Build
    - GO_BUILD_ARGS=$(cat go.env | sed -e 's/^/--build-arg /' | tr '\n' ' ')
    - docker build --build-arg BASE_IMAGE=$BASE_IMAGE --build-arg DD_TARGET_ARCH=$DD_TARGET_ARCH $GO_BUILD_ARGS $CUSTOM_BUILD_ARGS --tag registry.ddbuild.io/ci/datadog-agent-buildimages/$IMAGE${ECR_TEST_ONLY}:$IMAGE_VERSION --label target=none --file $DOCKERFILE .
    # For size debug purposes
    - docker images registry.ddbuild.io/ci/datadog-agent-buildimages/$IMAGE${ECR_TEST_ONLY}:$IMAGE_VERSION
    - docker history --no-trunc registry.ddbuild.io/ci/datadog-agent-buildimages/$IMAGE${ECR_TEST_ONLY}:$IMAGE_VERSION
    - |
      if [ "$CI_PIPELINE_SOURCE" != "schedule" ]; then
        docker push registry.ddbuild.io/ci/datadog-agent-buildimages/$IMAGE${ECR_TEST_ONLY}:$IMAGE_VERSION
      fi
  after_script:
    - if [ "${CI_JOB_STATUS}" != 'success' ]; then echo -e "\033[0;32m\033[1mBuild failed.\033[0m"; exit 0; fi
    - export SIZE=$(docker inspect -f "{{ .Size }}" registry.ddbuild.io/ci/datadog-agent-buildimages/$IMAGE${ECR_TEST_ONLY}:$IMAGE_VERSION)
    - ./send-metrics.sh $IMAGE $SIZE $CI_COMMIT_REF_NAME
    - |
      if [ "$CI_PIPELINE_SOURCE" != "schedule" ]; then
        echo -e "\033[0;32m\033[1mImage registry.ddbuild.io/ci/datadog-agent-buildimages/$IMAGE${ECR_TEST_ONLY}:$IMAGE_VERSION is available.\033[0m"
      else
        echo -e "\033[0;33m\033[1mScheduled pipeline, image push skipped.\033[0m"
      fi

build_ci_image:
  stage: build
  image: "${CI_IMAGE}"
  tags: ["arch:amd64"]
  script: |-
    docker buildx build \
      --file ci/Dockerfile \
      --platform linux/amd64 \
      --label target=build \
      --tag registry.ddbuild.io/${CI_IMAGE_REPO}:v${CI_PIPELINE_ID}-${CI_COMMIT_SHORT_SHA} \
      --push \
      .
  rules:
    - changes:
        paths:
          - "ci/Dockerfile"
        compare_to: 'main'
    - when: manual
      allow_failure: true

build_deb_x64:
  extends: [.build, .x64]
  variables:
    DOCKERFILE: deb-x64/Dockerfile
    IMAGE: deb_x64

build_rpm_x64:
  extends: [.build, .x64]
  variables:
    DOCKERFILE: rpm-x64/Dockerfile
    IMAGE: rpm_x64
    BASE_IMAGE: centos:7

build_deb_arm64:
  extends: [.build, .arm]
  variables:
    DOCKERFILE: deb-arm/Dockerfile
    IMAGE: deb_arm64
    BASE_IMAGE: arm64v8/ubuntu:16.04

build_deb_armhf:
  extends: [.build, .arm]
  variables:
    DOCKERFILE: deb-arm/Dockerfile
    IMAGE: deb_armhf
    BASE_IMAGE: arm32v7/ubuntu:16.04
    DD_TARGET_ARCH: armhf

build_rpm_arm64:
  extends: [.build, .arm]
  variables:
    DOCKERFILE: rpm-arm64/Dockerfile
    IMAGE: rpm_arm64
    BASE_IMAGE: amazonlinux:2.0.20181114

build_rpm_armhf:
  extends: [.build, .arm]
  variables:
    DOCKERFILE: rpm-armhf/Dockerfile
    IMAGE: rpm_armhf
    BASE_IMAGE: arm32v7/centos:7
    DD_TARGET_ARCH: armhf

build_system-probe_x64:
  extends: [.build, .x64]
  variables:
    DOCKERFILE: system-probe_x64/Dockerfile
    IMAGE: system-probe_x64

build_system-probe_arm64:
  extends: [.build, .arm]
  variables:
    DOCKERFILE: system-probe_arm64/Dockerfile
    IMAGE: system-probe_arm64

build_dd_agent_testing:
  extends: [.build, .x64]
  variables:
    DOCKERFILE: dd-agent-testing/Dockerfile
    IMAGE: dd-agent-testing

build_linux_glibc_2_17_x64:
  extends: [.build_ddregistry, .x64]
  variables:
    DOCKERFILE: linux-glibc-2.17-x64/Dockerfile
    IMAGE: linux-glibc-2-17-x64

build_linux_glibc_2_23_arm64:
  extends: [.build_ddregistry, .arm]
  variables:
    DOCKERFILE: linux-glibc-2.23-arm64/Dockerfile
    IMAGE: linux-glibc-2-23-arm64

build_docker_arm64:
  extends: [.build, .arm]
  variables:
    DOCKERFILE: docker-arm64/Dockerfile
    IMAGE: docker_arm64

build_docker_x64:
  extends: [.build, .x64]
  variables:
    DOCKERFILE: docker-x64/Dockerfile
    IMAGE: docker_x64

build_btf_gen:
  extends: [.build, .x64]
  variables:
    DOCKERFILE: btf-gen/Dockerfile
    IMAGE: btf-gen

build_kernel_version_testing_x64:
  extends: [.build, .x64]
  variables:
    CUSTOM_BUILD_ARGS: --build-arg KERNEL_EXTRA_CONFIG_VERSION=$EXTRA_KCONFIG_VERSION
    DOCKERFILE: kernel-version-testing/kernel-version-testing_x64/Dockerfile
    IMAGE: kernel-version-testing_x64

build_kernel_version_testing_arm64:
  extends: [.build, .arm]
  variables:
    CUSTOM_BUILD_ARGS: --build-arg KERNEL_EXTRA_CONFIG_VERSION=$EXTRA_KCONFIG_VERSION
    DOCKERFILE: kernel-version-testing/kernel-version-testing_arm64/Dockerfile
    IMAGE: kernel-version-testing_arm64

build_circleci_runner:
  extends: [.x64]
  stage: build
  rules:
    - if: $CI_COMMIT_TAG == null
  variables:
    DOCKERFILE: circleci/Dockerfile
    IMAGE: circleci-runner
  script:
    # Dockerhub login
    - DOCKER_REGISTRY_LOGIN=$(aws ssm get-parameter --region us-east-1 --name ci.datadog-agent.docker_hub_login --with-decryption --query "Parameter.Value" --out text)
    - aws ssm get-parameter --region us-east-1 --name ci.datadog-agent.docker_hub_pwd --with-decryption --query "Parameter.Value" --out text | docker login --username "$DOCKER_REGISTRY_LOGIN" --password-stdin docker.io
    # Build
    - GO_BUILD_ARGS=$(cat go.env | sed -e 's/^/--build-arg /' | tr '\n' ' ')
    - docker build --build-arg BASE_IMAGE=$BASE_IMAGE --build-arg DD_TARGET_ARCH=$DD_TARGET_ARCH $GO_BUILD_ARGS $CUSTOM_BUILD_ARGS --tag datadog/agent-buildimages-${IMAGE}${ECR_TEST_ONLY}:$IMAGE_VERSION --file $DOCKERFILE .
    - |
      if [ "$CI_PIPELINE_SOURCE" != "schedule" ]; then
        docker push datadog/agent-buildimages-${IMAGE}${ECR_TEST_ONLY}:$IMAGE_VERSION
      fi
  after_script:
    - if [ "${CI_JOB_STATUS}" != 'success' ]; then echo -e "\033[0;32m\033[1mBuild failed.\033[0m"; exit 0; fi
    - |
      if [ "$CI_PIPELINE_SOURCE" != "schedule" ]; then
        echo -e "\033[0;32m\033[1mImage datadog/agent-buildimages-${IMAGE}${ECR_TEST_ONLY}:$IMAGE_VERSION is available.\033[0m"
      else
        echo -e "\033[0;33m\033[1mScheduled pipeline, image push skipped.\033[0m"
      fi

build_gitlab_agent_deploy:
  extends: [.build, .x64]
  variables:
    DOCKERFILE: agent-deploy/Dockerfile
    IMAGE: gitlab_agent_deploy

trigger_build_kernels:
  stage: trigger_build_kernels
  needs:
    ["build_kernel_version_testing_x64", "build_kernel_version_testing_arm64"]
  rules:
    - when: manual
      allow_failure: true
  # Pass variables to the child pipeline
  variables:
    PARENT_EXTRA_KCONFIG_VERSION: $EXTRA_KCONFIG_VERSION
    PARENT_PIPELINE_ID: $CI_PIPELINE_ID
  trigger:
    include:
      - local: .gitlab/kernel_version_testing.yml
    strategy: depend

trigger_tests:
  stage: test
  rules:
    - when: manual
      allow_failure: true
  variables:
    RUN_KITCHEN_TESTS: "false"
    BUCKET_BRANCH: "dev"
    DATADOG_AGENT_BUILDIMAGES: "v${CI_PIPELINE_ID}-${CI_COMMIT_SHORT_SHA}"
    DATADOG_AGENT_BUILDIMAGES_SUFFIX: "${ECR_TEST_ONLY}"
    DATADOG_AGENT_WINBUILDIMAGES_SUFFIX: "${ECR_TEST_ONLY}"
    DATADOG_AGENT_WINBUILDIMAGES: "v${CI_PIPELINE_ID}-${CI_COMMIT_SHORT_SHA}"
    DATADOG_AGENT_ARMBUILDIMAGES_SUFFIX: "${ECR_TEST_ONLY}"
    DATADOG_AGENT_ARMBUILDIMAGES: "v${CI_PIPELINE_ID}-${CI_COMMIT_SHORT_SHA}"
    DATADOG_AGENT_SYSPROBE_BUILDIMAGES_SUFFIX: "${ECR_TEST_ONLY}"
    DATADOG_AGENT_SYSPROBE_BUILDIMAGES: "v${CI_PIPELINE_ID}-${CI_COMMIT_SHORT_SHA}"
  trigger:
    project: DataDog/datadog-agent
    strategy: depend

push_to_datadog_agent:
  stage: test
  rules:
    - if: $CI_COMMIT_MESSAGE !~ /^\[push_to_datadog_agent\]/
      when: never
    - if: $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH
      when: never
    - !reference [.on_push]
  tags: ["arch:amd64"]
  image: 486234852809.dkr.ecr.us-east-1.amazonaws.com/docker:20.10-py3
  variables:
    SSM_GITHUB_APP_KEY: ci.datadog-agent.platform-github-app-key
    GITHUB_INSTALLATION_ID: 45116690
    GITHUB_APP_ID: 682216
    REF: main
    BRANCH: buildimages/$CI_COMMIT_BRANCH
    IMAGES_ID: v${CI_PIPELINE_ID}-${CI_COMMIT_SHORT_SHA}
  script:
    - set -o pipefail
    # Get the current go version from the go.env file
    - >
      for line in $(cat go.env); do
        export $line
      done
    # Read the Github app private token from AWS SSM
    - export GITHUB_KEY_B64=$(aws ssm get-parameter --region us-east-1 --name $SSM_GITHUB_APP_KEY --with-decryption --query "Parameter.Value" --out text)
    - pip install -r requirements.txt
    - pip install PyGithub -c requirements/constraints.txt
    - inv update-datadog-agent-buildimages --images-id "$IMAGES_ID" --ref "$REF" --branch "$BRANCH" --test-version

.winbuild: &winbuild
  stage: build
  rules:
    - if: $CI_COMMIT_TAG == null
  timeout: 2h 00m
  script:
    - '$_instance_id = (iwr  -UseBasicParsing http://169.254.169.254/latest/meta-data/instance-id).content ; Write-Host "Running on instance $($_instance_id)"'
    - $SRC_IMAGE = "registry.ddbuild.io/ci/datadog-agent-buildimages/${IMAGE}${ECR_TEST_ONLY}:${IMAGE_VERSION}"
    - .\build-container.ps1 -Arch $DD_TARGET_ARCH -Tag $SRC_IMAGE
    - If ($lastExitCode -ne "0") { throw "Previous command returned `$lastExitCode" }
    - If ($CI_PIPELINE_SOURCE -ne "schedule") { docker push $SRC_IMAGE } else { exit 0 }
    - If ($lastExitCode -ne "0") { throw "Previous command returned `$lastExitCode" }
  after_script:
    - $SRC_IMAGE = "registry.ddbuild.io/ci/datadog-agent-buildimages/${IMAGE}${ECR_TEST_ONLY}:${IMAGE_VERSION}"
    - docker rmi $SRC_IMAGE
    - If ($CI_JOB_STATUS -ne "success") { Write-Host "Build failed."; exit 0 }
    - If ($CI_PIPELINE_SOURCE -ne "schedule") { Write-Host "Image $SRC_IMAGE is available." } else { Write-Host "Scheduled pipeline, image push skipped." }

build_windows_1809_x64:
  extends: .winbuild
  tags: ["runner:windows-docker", "windowsversion:1809"]
  variables:
    DOCKERFILE: windows/Dockerfile
    IMAGE: windows_1809_x64
    DD_TARGET_ARCH: x64

build_windows_ltsc2022_x64:
  extends: .winbuild
  tags: ["runner:windows-docker", "windowsversion:2022"]
  variables:
    DOCKERFILE: windows/Dockerfile
    IMAGE: windows_ltsc2022_x64
    DD_TARGET_ARCH: x64

.release:
  stage: release
  rules:
    - !reference [.on_default_branch_push]
  tags: ["arch:amd64"]
  image: "${CI_IMAGE}"
  variables:
    SRC_IMAGE: registry.ddbuild.io/ci/datadog-agent-buildimages/$IMAGE:$IMAGE_VERSION
  script:
    # Tag as latest in internal registry
    - crane tag $SRC_IMAGE latest
    # Copy to public dockerhub registry and also tag as latest
    - DOCKER_REGISTRY_LOGIN=$(aws ssm get-parameter --region us-east-1 --name ci.datadog-agent.docker_hub_login --with-decryption --query "Parameter.Value" --out text)
    - aws ssm get-parameter --region us-east-1 --name ci.datadog-agent.docker_hub_pwd --with-decryption --query "Parameter.Value" --out text | docker login --username "$DOCKER_REGISTRY_LOGIN" --password-stdin docker.io
    - crane copy $SRC_IMAGE datadog/agent-buildimages-$IMAGE:$IMAGE_VERSION
    - crane tag datadog/agent-buildimages-$IMAGE:$IMAGE_VERSION latest

.release_ddregistry:
  extends: .release
  variables:
    SRC_IMAGE: registry.ddbuild.io/ci/datadog-agent-buildimages/$IMAGE:$IMAGE_VERSION

.winrelease:
  stage: release
  rules:
    - !reference [.on_default_branch_push]
  ## this always needs to be the newest available builder version
  tags: ["runner:windows-docker", "windowsversion:2022"]
  script:
    - '$_instance_id = (iwr  -UseBasicParsing http://169.254.169.254/latest/meta-data/instance-id).content ; Write-Host "Running on instance $($_instance_id)"'
    - $SRC_IMAGE = "registry.ddbuild.io/ci/datadog-agent-buildimages/${IMAGE}:${IMAGE_VERSION}"
    - mkdir ci-scripts
    - docker pull $SRC_IMAGE
    - |
      @"
      Set-PSDebug -Trace 1
      `$ErrorActionPreference = "Stop"
      # ECR Login
      `$AWS_ECR_PASSWORD = aws ecr get-login-password --region us-east-1
      docker login --username AWS --password "`$AWS_ECR_PASSWORD" 486234852809.dkr.ecr.us-east-1.amazonaws.com
      # DockerHub login
      `$DOCKER_REGISTRY_LOGIN = aws ssm get-parameter --region us-east-1 --name ci.datadog-agent.docker_hub_login --with-decryption --query "Parameter.Value" --out text
      `$DOCKER_REGISTRY_PWD = aws ssm get-parameter --region us-east-1 --name ci.datadog-agent.docker_hub_pwd --with-decryption --query "Parameter.Value" --out text
      docker login --username "`$DOCKER_REGISTRY_LOGIN" --password "`$DOCKER_REGISTRY_PWD" docker.io
      If (`$lastExitCode -ne "0") { throw "Previous command returned `$lastExitCode" }
      docker tag $SRC_IMAGE registry.ddbuild.io/ci/datadog-agent-buildimages/${IMAGE}:latest
      docker push registry.ddbuild.io/ci/datadog-agent-buildimages/${IMAGE}:latest
      If (`$lastExitCode -ne "0") { throw "Previous command returned `$lastExitCode" }
      If ("${DOCKERHUB_IMAGE}" -ne "") {
        docker tag $SRC_IMAGE datadog/${DOCKERHUB_IMAGE}:${DOCKERHUB_TAG_PREFIX}-${IMAGE_VERSION}
        docker push datadog/${DOCKERHUB_IMAGE}:${DOCKERHUB_TAG_PREFIX}-${IMAGE_VERSION}
        If (`$lastExitCode -ne "0") { throw "Previous command returned `$lastExitCode" }
        docker tag $SRC_IMAGE datadog/${DOCKERHUB_IMAGE}:${DOCKERHUB_TAG_PREFIX}
        docker push datadog/${DOCKERHUB_IMAGE}:${DOCKERHUB_TAG_PREFIX}
        If (`$lastExitCode -ne "0") { throw "Previous command returned `$lastExitCode" }
      }
      "@ | out-file ci-scripts/docker-publish.ps1
    - cat ci-scripts/docker-publish.ps1
    - docker run --rm -w C:\mnt -e AWS_NETWORKING=true -e SIGN_WINDOWS_DD_WCS=true -v "$(Get-Location):C:\mnt" -v \\.\pipe\docker_engine:\\.\pipe\docker_engine ${WINDOWS_RELEASE_IMAGE}:${IMAGE_VERSION} powershell -C C:\mnt\ci-scripts\docker-publish.ps1
  after_script:
    - $SHORT_CI_COMMIT_SHA = $($CI_COMMIT_SHA.Substring(0,8))
    - $SRC_IMAGE = "registry.ddbuild.io/ci/datadog-agent-buildimages/${IMAGE}:${IMAGE_VERSION}"
    - docker rmi $SRC_IMAGE registry.ddbuild.io/ci/datadog-agent-buildimages/${IMAGE}:latest
    - If ("${DOCKERHUB_IMAGE}" -ne "") { docker rmi datadog/${DOCKERHUB_IMAGE}:${DOCKERHUB_TAG_PREFIX}-${IMAGE_VERSION} $SRC_IMAGE datadog/${DOCKERHUB_IMAGE}:${DOCKERHUB_TAG_PREFIX} }


release_linux:
  extends: .release
  parallel:
    matrix:
      - IMAGE: [deb_x64,rpm_x64,deb_arm64,rpm_arm64,system-probe_x64,system-probe_arm64]

release_linux_ddregistry:
  extends: .release_ddregistry
  parallel:
    matrix:
      - IMAGE: [linux-glibc-2-17-x64,linux-glibc-2-23-arm64]

release_windows:
  extends: .winrelease
  variables:
    DOCKERHUB_IMAGE: agent-buildimages-windows_x64
  parallel:
    matrix:
      - IMAGE: windows_1809_x64
        DOCKERHUB_TAG_PREFIX: 1809
      - IMAGE: windows_ltsc2022_x64
        DOCKERHUB_TAG_PREFIX: ltsc2022

release_circleci_runner:
  stage: release
  needs: ["build_circleci_runner"]
  variables:
    IMAGE: circleci-runner
  rules:
    - !reference [.on_default_branch_push]
  tags: ["arch:amd64"]
  image: "${CI_IMAGE}"
  script:
    - DOCKER_REGISTRY_LOGIN=$(aws ssm get-parameter --region us-east-1 --name ci.datadog-agent.docker_hub_login --with-decryption --query "Parameter.Value" --out text)
    - aws ssm get-parameter --region us-east-1 --name ci.datadog-agent.docker_hub_pwd --with-decryption --query "Parameter.Value" --out text | docker login --username "$DOCKER_REGISTRY_LOGIN" --password-stdin docker.io
    - SRC_IMAGE=datadog/agent-buildimages-$IMAGE:$IMAGE_VERSION
    # Tag as latest in dockerhub registry
    - crane tag $SRC_IMAGE latest

dev_release_circleci_runner_gcr:
  stage: release
  needs: ["build_circleci_runner"]
  rules:
    - !reference [.on_push]
  variables:
    # Don't rely on ${IMAGE_VERSION} or any variables that is referencing
    # other variables here.
    # They are not expended recursively and end up provided verbatim to the
    # downstream pipeline which then extends the variable with its own CI
    # variables, which causes invalid image tags to be used
    IMG_SOURCES: datadog/agent-buildimages-circleci-runner${ECR_TEST_ONLY}:v$CI_PIPELINE_ID-${CI_COMMIT_SHORT_SHA}
    IMG_DESTINATIONS: agent-circleci-runner${ECR_TEST_ONLY}:v$CI_PIPELINE_ID-${CI_COMMIT_SHORT_SHA}
    IMG_REGISTRIES: gcr-datadoghq
  trigger:
    project: DataDog/public-images
    strategy: depend

release_circleci_runner_gcr:
  stage: release
  needs: ["build_circleci_runner"]
  rules:
    - !reference [.on_default_branch_push]
  variables:
    # Don't rely on ${IMAGE_VERSION} or any variables that is referencing
    # other variables here.
    # They are not expended recursively and end up provided verbatim to the
    # downstream pipeline which then extends the variable with its own CI
    # variables, which causes invalid image tags to be used
    IMG_SOURCES: datadog/agent-buildimages-circleci-runner${ECR_TEST_ONLY}:v$CI_PIPELINE_ID-${CI_COMMIT_SHORT_SHA}
    IMG_DESTINATIONS: agent-circleci-runner${ECR_TEST_ONLY}:v$CI_PIPELINE_ID-${CI_COMMIT_SHORT_SHA}
    IMG_REGISTRIES: gcr-datadoghq
  trigger:
    project: DataDog/public-images
    strategy: depend

notify-images-available:
  extends: .slack-notifier-base
  stage: availability_message # Created a new stage to depend upon all image builds without explicitely name them in 'needs'
  rules:
    - if: $CI_COMMIT_BRANCH == "master" || $CI_COMMIT_BRANCH == "main"
      when: never
    - when: on_success
  dependencies: []
  script: |
    COMMIT_URL="$CI_PROJECT_URL/commit/$CI_COMMIT_SHA"
    BRANCH_URL="$CI_PROJECT_URL/tree/$CI_COMMIT_BRANCH"
    export MESSAGE="Your :docker: images with tag \`$IMAGE_VERSION\` are ready.
    :git: Branch <$BRANCH_URL|$CI_COMMIT_BRANCH> for commit \`$CI_COMMIT_TITLE\` (<$COMMIT_URL|$CI_COMMIT_SHORT_SHA>)
    :idea: You can test them in the \`datadog-agent\` repository by running:
    \`\`\`inv buildimages.update -t $IMAGE_VERSION [--no-test] [-i <image_name>]\`\`\`
    Or run the \`trigger_tests\` manual job in your \`datadog-agent-buildimages\` <$CI_PIPELINE_URL|pipeline>."
    /usr/local/bin/notify.sh

notify-images-failure:
  extends: .slack-notifier-base
  stage: availability_message
  rules:
    - if: $CI_COMMIT_BRANCH == "master" || $CI_COMMIT_BRANCH == "main"
      when: never
    - when: on_failure
  dependencies: []
  script: |
    COMMIT_URL="$CI_PROJECT_URL/commit/$CI_COMMIT_SHA"
    BRANCH_URL="$CI_PROJECT_URL/tree/$CI_COMMIT_BRANCH"
    export MESSAGE=":warning: Your :docker: images with tag \`$IMAGE_VERSION\` failed to build. :warning:
    :git: Branch <$BRANCH_URL|$CI_COMMIT_BRANCH> for commit \`$CI_COMMIT_TITLE\` (<$COMMIT_URL|$CI_COMMIT_SHORT_SHA>)
    More details :arrow_right:"
    /usr/local/bin/notify.sh

notify-on-failure:
  extends: .slack-notifier-base
  rules:
    - if: $CI_COMMIT_BRANCH == "master" || $CI_COMMIT_BRANCH == "main"
      when: on_failure
  dependencies: []
  script: |
    COMMIT_URL="$CI_PROJECT_URL/commit/$CI_COMMIT_SHA"
    AUTHOR=$(git show -s --format="%an" HEAD)
    MESSAGE_TEXT=":red-light: datadog-agent-buildimages build failed in pipeline <$CI_PIPELINE_URL|$CI_PIPELINE_ID> for $CI_COMMIT_TITLE (<$COMMIT_URL|$CI_COMMIT_SHORT_SHA>) by $AUTHOR"
    if [ "$CI_PIPELINE_SOURCE" = "schedule" ]; then
      MESSAGE_TEXT="$MESSAGE_TEXT (this was a scheduled build)"
    fi
    postmessage "#agent-devx-ops" "$MESSAGE_TEXT"