# Declarable SBOM upload for GitLab CI. Include this file, then extend the job:
#
#   include:
#     - local: integrations/gitlab-ci/declarable.yml
#   declarable_upload:
#     extends: .declarable_upload
#     variables:
#       DECLARABLE_PRODUCT_ID: "<your product id>"
#       DECLARABLE_SBOM_PATH: "build/spdx/*.spdx"
#
# DECLARABLE_API_KEY is not set here: put it in Settings -> CI/CD -> Variables (masked, protected).
# Every variable below is read by integrations/github-action/upload.mjs, the same script the
# GitHub Action runs, so the three integrations behave alike. See README.md in this folder.
.declarable_upload:
  # node:24-alpine is the current LTS (checked against the schedule at nodejs.org/en/about/previous-releases
  # on 2026-10-10: 24.x is LTS until 2028-04-30).
  image: node:24-alpine
  # Needs the SBOM files from an earlier job: add `needs:` with `artifacts: true` in your own job.
  variables:
    # Path to the upload.mjs you copied into your own repository. Required: no default here, because
    # any default would point into Declarable's own tree, which means nothing in yours.
    DECLARABLE_UPLOAD_SCRIPT: ""
    DECLARABLE_VERSION: $CI_COMMIT_SHA
    DECLARABLE_API_BASE_URL: https://declarable.io
    # "true" sends each file under its path inside the project instead of its base name. Needed only
    # by a reader that takes the environment from the file's path (PlatformIO today); the job stops
    # if a file is outside the folder it runs in. Uncomment to turn it on.
    # DECLARABLE_KEEP_PATHS: "true"
    # "true" replaces the release already under this version when the files differ.
    DECLARABLE_REPLACE: "false"
    # Optional day the firmware shipped, YYYY-MM-DD, read as a UTC date. Empty sends no date.
    DECLARABLE_RELEASED_AT: ""
    # The commit stored with the release. "none" sends no commit.
    DECLARABLE_COMMIT: $CI_COMMIT_SHA
    # Optional build fields, stored with the release; empty sends nothing. The image hash is 64 hex
    # characters; the support date is YYYY-MM-DD. A value Declarable would refuse stops the job (exit 2).
    DECLARABLE_BUILD_ID: ""
    DECLARABLE_IMAGE_SHA256: ""
    DECLARABLE_SUPPORTED_UNTIL: ""
    DECLARABLE_FAIL_ON_GAP: blocker
    DECLARABLE_FAIL_ON_EXPLOITED: "true"
  # Default-branch pipelines and tags; a job that extends this can replace `rules:` with its own.
  rules:
    - if: $CI_COMMIT_TAG
    - if: $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH
  script:
    # Exit 0 uploaded and inside your thresholds, 1 a threshold was crossed, 2 the upload failed.
    - |
      if [ -z "$DECLARABLE_UPLOAD_SCRIPT" ]; then
        echo "DECLARABLE_UPLOAD_SCRIPT is not set: point it at the upload.mjs you copied into this repository." >&2
        exit 2
      fi
    - node "$DECLARABLE_UPLOAD_SCRIPT"