---
.common_rules: &common_rules
  - if: $SAFESCARF_DISABLED || ($SAFESCARF_DISABLED_FOR_DEFAULT_BRANCH && ($CI_DEFAULT_BRANCH == $CI_COMMIT_REF_NAME)) # don't execute if scan is disabled
    when: never

# Nmap scan
nmap_scan:
  image: artifactory.devops.telekom.de/tdi-security-docker/net_mon-images-docker-local/docker-images/safescarf/nmap:7.92-r11
  stage: test
  variables: 
    SAFESCARF_DISABLED_NMAP: "false" # set "true" to disable Nmap scan
    SAFESCARF_DISABLED_NMAP_FOR_DEFAULT_BRANCH: "false" # set "true" to disable Nmap scan for the default branch
  artifacts:
    untracked: true # we need to send the "success" file to the notify job
  before_script:
    - echo "Checking required variables"
    - if [ -z ${SAFESCARF_TOKEN+x} ]; then echo "SAFESCARF_TOKEN is not set"; exit 1; else echo "SAFESCARF_TOKEN is set"; fi
    - if [ -z ${SAFESCARF_HOST+x} ]; then echo "SAFESCARF_HOST is not set"; exit 1; else echo "SAFESCARF_HOST is set"; fi
    - if [ -z ${SAFESCARF_ENG_ID+x} ]; then echo "SAFESCARF_ENG_ID is not set"; exit 1; else echo "SAFESCARF_ENG_ID is set"; fi
    - ci-connector --version
  script:
    - nmap -Pn -T4 -A -oX /tmp/report.xml $TARGET
  after_script:
    - ci-connector upload-scan --scanner "Nmap Scan" -e $SAFESCARF_ENG_ID -f /tmp/report.xml
    - touch $CI_PROJECT_DIR/success
  rules:
    - *common_rules
    - if: '$SAFESCARF_DISABLED_NMAP == "true" || ($SAFESCARF_DISABLED_NMAP_FOR_DEFAULT_BRANCH == "true" && ($CI_DEFAULT_BRANCH == $CI_COMMIT_REF_NAME))' # don't execute if scan is disabled
      when: never
    - if: $CI_PIPELINE_SOURCE == "merge_request_event"  # Add the job to merge request pipelines if there's an open merge request.
    - if: $CI_OPEN_MERGE_REQUESTS  # Don't add it to a *branch* pipeline if it's already in a merge request pipeline.
      when: never
    - if: $CI_COMMIT_BRANCH        # If there's no open merge request, add it to a *branch* pipeline instead.
    - if: '$TEST_IMAGE == "yes"'
  # we need the pipeline to continue all the way towards 'send_slack_notification' job
  # this job lets us know in slack about the success/failure of build
  allow_failure: true

