Google Cloud Build: CI/CD Serverless, Redes Privadas y Seguridad en Supply Chain

steps:
  # Paso 1: Pruebas unitarias y análisis estático con persistencia de entorno
  - name: 'python:3.11-slim'
    entrypoint: '/bin/sh'
    args:
      - '-c'
      - |
        pip install --no-cache-dir pytest flake8
        flake8 src/
        pytest tests/
    id: 'unit-tests'

  # Paso 2: Compilación de alta velocidad y push con Kaniko Cache habilitado
  - name: 'gcr.io/kaniko-project/executor:latest'
    args:
      - '--destination=${_LOCATION}-docker.pkg.dev/${PROJECT_ID}/${_REPO_NAME}/app:${SHORT_SHA}'
      - '--destination=${_LOCATION}-docker.pkg.dev/${PROJECT_ID}/${_REPO_NAME}/app:latest'
      - '--cache=true'
      - '--cache-ttl=168h'
      - '--cache-dir=/workspace/.kaniko-cache'
    id: 'kaniko-build-push'
    waitFor: ['unit-tests']

  # Paso 3: Firma de Atestación criptográfica mediante Cloud KMS para Binary Authorization
  - name: 'gcr.io/google.com/cloudsdktool/cloud-sdk:slim'
    entrypoint: '/bin/bash'
    args:
      - '-c'
      - |
        DIGEST=$(gcloud artifacts docker images describe \
          ${_LOCATION}-docker.pkg.dev/${PROJECT_ID}/${_REPO_NAME}/app:${SHORT_SHA} \
          --format='get(image_summary.digest)')
        
        gcloud beta container binauthz attestations sign-and-create \
          --artifact-url="${_LOCATION}-docker.pkg.dev/${PROJECT_ID}/${_REPO_NAME}/app@${DIGEST}" \
          --attestor="${_ATTESTOR_NAME}" \
          --attestor-project="${PROJECT_ID}" \
          --keyversion-project="${PROJECT_ID}" \
          --keyversion-location="${_KMS_LOCATION}" \
          --keyversion-keyring="${_KMS_KEYRING}" \
          --keyversion-key="${_KMS_KEY}" \
          --keyversion="1"
    id: 'sign-binary-authorization'
    waitFor: ['kaniko-build-push']

  # Paso 4: Despliegue continuo hacia Cloud Run verificando la imagen autenticada
  - name: 'gcr.io/google.com/cloudsdktool/cloud-sdk:slim'
    entrypoint: 'gcloud'
    args:
      - 'run'
      - 'deploy'
      - '${_SERVICE_NAME}'
      - '--image=${_LOCATION}-docker.pkg.dev/${PROJECT_ID}/${_REPO_NAME}/app:${SHORT_SHA}'
      - '--region=${_LOCATION}'
      - '--platform=managed'
      - '--binary-authorization=default'
    id: 'deploy-cloud-run'
    waitFor: ['sign-binary-authorization']

substitutions:
  _LOCATION: 'europe-west1'
  _REPO_NAME: 'production-containers'
  _SERVICE_NAME: 'payments-core-api'
  _ATTESTOR_NAME: 'quality-gate-attestor'
  _KMS_LOCATION: 'europe-west1'
  _KMS_KEYRING: 'binauthz-keyring'
  _KMS_KEY: 'attestor-signer'

options:
  logging: CLOUD_LOGGING_ONLY
  machineType: 'E2_HIGHCPU_8'