variables:
  ENDURA_LOG_FILE: "${CI_PROJECT_DIR}/endura-sensor.log"
  ENDURA_TEAM_SERVER: "https://team-server.example.com"

default:
  image: ubuntu:26.04
  tags:
    - saas-linux-small-amd64

  before_script:
    # Install Runtime Sensor prerequisites.
    - apt-get update -qq
    - DEBIAN_FRONTEND=noninteractive apt-get install -y -qq curl ca-certificates

    # Install Endura.
    - curl -sSf https://repo.endurasecurity.com/install/endura-sensor/testing.sh | sh

    # Mount the kernel filesystems required by the Runtime Sensor.
    - |
      mkdir -p /sys/fs/bpf
      if ! mountpoint -q /sys/fs/bpf; then
        mount -t bpf bpf /sys/fs/bpf
      fi

      mkdir -p /sys/kernel/security
      if ! mountpoint -q /sys/kernel/security; then
        mount -t securityfs securityfs /sys/kernel/security
      fi

    # Start the Runtime Sensor and protected job in the main shell.
    - |
      cleanup_endura() {
        build_rc=$?
        trap - EXIT
        set +e

        endura job stop
        job_stop_rc=$?
        endura sensor stop
        sensor_stop_rc=$?

        if [ "${build_rc}" -ne 0 ]; then
          exit "${build_rc}"
        fi
        if [ "${job_stop_rc}" -ne 0 ]; then
          exit "${job_stop_rc}"
        fi
        exit "${sensor_stop_rc}"
      }

      trap cleanup_endura EXIT

      endura sensor start -d
      unset ENDURA_LICENSE_KEY ENDURA_SENSOR_TOKEN
      endura sensor status
      endura sensor hooks

      ENDURA_JOB_ID=$(endura job start --workspace "${CI_PROJECT_DIR}")
      echo "started endura job with id ${ENDURA_JOB_ID}"

stages:
  - build

build:
  stage: build
  script:
    - apt-get update -qq
    - DEBIAN_FRONTEND=noninteractive apt-get install -y -qq make nodejs npm
    - make build
  artifacts:
    when: always
    paths:
      - endura-sensor.log

pipeline {
    // Select a Sensor-enabled build agent.
    agent { label 'endura' }

    // Defer source checkout until protection starts.
    options {
        skipDefaultCheckout(true)
    }

    // Map branch metadata for build detection.
    environment {
        BUILD_BRANCH = "${env.BRANCH_NAME}"
    }

    stages {
        // Start protection before source checkout.
        stage('Start Endura Job') {
            steps {
                sh '''
                    ENDURA_JOB_ID=$(endura job start)
                    echo "started endura job with id ${ENDURA_JOB_ID}"
                '''
            }
        }

        // Check out protected source code.
        stage('Checkout') {
            steps {
                checkout scm
            }
        }

        // Run the protected project build.
        stage('Build') {
            steps {
                sh 'make build'
            }
        }
    }

    // Stop protection after every pipeline outcome.
    post {
        always {
            sh 'endura job stop'
        }
    }
}

version: 2
plan:
  project-key: PROJ
  key: BUILD
  name: Example Build
stages:
  - Build:
      jobs:
        - Build
Build:
  tasks:
    - script:
        description: Start Endura Job
        interpreter: SHELL
        scripts:
          - |
            # Map Bamboo metadata for build detection.
            export BUILD_BRANCH="${bamboo.planRepository.branchName}"
            export BUILD_TRIGGERED_BY="${bamboo.ManualBuildTriggerReason.userName}"

            # Start protection before source checkout.
            ENDURA_JOB_ID=$(endura job start)
            echo "started endura job with id ${ENDURA_JOB_ID}"
    # Run existing protected build tasks here.
  final-tasks:
    - script:
        description: Stop Endura Job
        interpreter: SHELL
        scripts:
          - endura job stop