ci: added build and tagging

2025-12-14 14:32:35 +03:00
parent fe355677db
commit 98ec96c8aa
3 changed files with 113 additions and 173 deletions
@@ -1,9 +1,8 @@
 stages:
-  # - build
+  - build
  - test
  - sast
-  # - dast
-  # - tag
+  - tag
  # - deploy

 include:
@@ -16,33 +15,27 @@ include:
 default:
  retry: 1

-# variables:
-#   BASE_IMAGE_NAME: $CI_REGISTRY_IMAGE
-#   TRIVY_CACHE_DIR: .cache/trivy
-#   TRIVY_NO_PROGRESS: "true"
-#   TRIVY_TIMEOUT: "10m0s"
-#   TRIVY_USERNAME: $CI_REGISTRY_USER
-#   TRIVY_PASSWORD: $CI_REGISTRY_PASSWORD
-#   TRIVY_REGISTRY: $CI_REGISTRY
-#   UV_PROJECT_ENVIRONMENT: .venv
-#   UV_CACHE_DIR: .cache/uv
-#   BUILDAH_ISOLATION: oci
-#   STORAGE_DRIVER: vfs
-#   DOCKER_HOST: "tcp://docker:2375"
-#   DOCKER_TLS_CERTDIR: ""
+variables:
+  BASE_IMAGE_NAME: $CI_REGISTRY_IMAGE
+  TRIVY_CACHE_DIR: .cache/trivy
+  TRIVY_NO_PROGRESS: "true"
+  TRIVY_TIMEOUT: "10m0s"
+  TRIVY_USERNAME: $CI_REGISTRY_USER
+  TRIVY_PASSWORD: $CI_REGISTRY_PASSWORD
+  TRIVY_REGISTRY: $CI_REGISTRY
+  DOCKER_HOST: "tcp://docker:2375"
+  DOCKER_TLS_CERTDIR: ""

-# cache:
-#   key: "${CI_COMMIT_REF_SLUG}"
-#   paths:
-#     - $TRIVY_CACHE_DIR
-#     - $UV_CACHE_DIR
-#     - $UV_PROJECT_ENVIRONMENT
-#   policy: pull-push
+cache:
+  key: "${CI_COMMIT_REF_SLUG}"
+  paths:
+    - $TRIVY_CACHE_DIR
+  policy: pull-push

 .docker-job: &docker-job
-  image: docker:cli
+  image: docker.io/docker:cli
  services:
-    - docker:dind
+    - docker.io/docker:dind
  before_script:
    - docker login -u "$CI_REGISTRY_USER" -p "$CI_REGISTRY_PASSWORD" $CI_REGISTRY

@@ -50,12 +43,13 @@ default:
  image: quay.io/containers/buildah:latest
  variables:
    STORAGE_DRIVER: vfs
+    BUILDAH_ISOLATION: oci
  before_script:
    - buildah login -u "$CI_REGISTRY_USER" -p "$CI_REGISTRY_PASSWORD" $CI_REGISTRY

 .trivy-fs-template: &trivy-fs-scan
  image:
-    name: aquasec/trivy:latest
+    name: docker.io/aquasec/trivy:latest
    entrypoint: [""]
  cache:
    paths:
@@ -82,44 +76,43 @@ default:
    - if: $SAST_DISABLED
      when: never

-# .trivy-image-template: &trivy-image-scan
-#   stage: security
-#   image:
-#     name: aquasec/trivy:latest
-#     entrypoint: [""]
-#   cache:
-#     paths:
-#       - $TRIVY_CACHE_DIR
-#     policy: pull-push
-#   before_script:
-#     - mkdir -p $TRIVY_CACHE_DIR
-#   script:
-#     - |
-#       trivy image \
-#         --scanners vuln \
-#         --format cyclonedx \
-#         --output image-sbom-${IMAGE_TYPE}.json \
-#         $IMAGE_NAME:$CI_COMMIT_SHA
-#     - |
-#       trivy image \
-#         --format sarif \
-#         --output gl-sast-image-${IMAGE_TYPE}-report.json \
-#         $IMAGE_NAME:$CI_COMMIT_SHA
-#   allow_failure: true
-#   artifacts:
-#     reports:
-#       sast: gl-sast-image-${IMAGE_TYPE}-report.json
-#     paths:
-#       - image-sbom-${IMAGE_TYPE}.json
-#       - gl-sast-image-${IMAGE_TYPE}-report.json
-#     expire_in: 1 week
-#     when: always
-#   rules:
-#     - if: $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH
-#     - if: $CI_COMMIT_TAG
-#     - if: $CI_PIPELINE_SOURCE == 'merge_request_event'
-#     - if: $SAST_DISABLED
-#       when: never
+.trivy-image-template: &trivy-image-scan
+  image:
+    name: docker.io/aquasec/trivy:latest
+    entrypoint: [""]
+  cache:
+    paths:
+      - $TRIVY_CACHE_DIR
+    policy: pull-push
+  before_script:
+    - mkdir -p $TRIVY_CACHE_DIR
+  script:
+    - |
+      trivy image \
+        --scanners vuln \
+        --format cyclonedx \
+        --output image-sbom-${IMAGE_TYPE}.json \
+        $IMAGE_NAME:$CI_COMMIT_SHA
+    - |
+      trivy image \
+        --format sarif \
+        --output gl-sast-image-${IMAGE_TYPE}-report.json \
+        $IMAGE_NAME:$CI_COMMIT_SHA
+  allow_failure: true
+  artifacts:
+    reports:
+      sast: gl-sast-image-${IMAGE_TYPE}-report.json
+    paths:
+      - image-sbom-${IMAGE_TYPE}.json
+      - gl-sast-image-${IMAGE_TYPE}-report.json
+    expire_in: 1 week
+    when: always
+  rules:
+    - if: $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH
+    - if: $CI_COMMIT_TAG
+    - if: $CI_PIPELINE_SOURCE == 'merge_request_event'
+    - if: $SAST_DISABLED
+      when: never

 # .webhook-template: &webhook-config
 #   image: curlimages/curl:latest
@@ -143,6 +136,7 @@ default:
        --tag $IMAGE_NAME:$CI_COMMIT_SHA \
        --file $CONTAINERFILE \
        --target $BUILDTARGET \
+        --build-arg SERVICE_NAME=${SERVICE_NAME} \
        --layers \
        --cache-from $IMAGE_NAME-cache \
        --cache-to $IMAGE_NAME-cache \
@@ -187,48 +181,39 @@ default:
      when: manual
      allow_failure: true

-# build-runtime:
-#   <<: *build-config
-#   variables:
-#     IMAGE_NAME: $BASE_IMAGE_NAME/backend
-#     CONTAINERFILE: Containerfile
-#     BUILDTARGET: runtime
+build-server:
+  <<: *build-config
+  variables:
+    IMAGE_NAME: $BASE_IMAGE_NAME/server
+    CONTAINERFILE: Containerfile
+    BUILDTARGET: runtime
+    SERVICE_NAME: server

-# build-tests:
-#   <<: *build-config
-#   variables:
-#     IMAGE_NAME: $BASE_IMAGE_NAME/backend-tests
-#     CONTAINERFILE: Containerfile
-#     BUILDTARGET: tests
+build-migrate:
+  <<: *build-config
+  variables:
+    IMAGE_NAME: $BASE_IMAGE_NAME/migrate
+    CONTAINERFILE: Containerfile
+    BUILDTARGET: runtime
+    SERVICE_NAME: migrate

-# build-migrations:
-#   <<: *build-config
-#   variables:
-#     IMAGE_NAME: $BASE_IMAGE_NAME/backend-migrations
-#     CONTAINERFILE: Containerfile
-#     BUILDTARGET: migrations
-
-# build-ml:
-#   <<: *build-config
-#   when: manual
-#   variables:
-#     IMAGE_NAME: $BASE_IMAGE_NAME/ml
-#     CONTAINERFILE: Containerfile
-#     BUILDTARGET: ml
-
-# lint:
-#   <<: *uv-job
-#   stage: test
-#   script:
-#     - source $HOME/.local/bin/env
-#     - uv sync --group linters --frozen
-#     - source $UV_PROJECT_ENVIRONMENT/bin/activate
-#     - just lint
-#   allow_failure: true
-#   rules:
-#     - if: $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH
-#     - if: $CI_PIPELINE_SOURCE == 'merge_request_event'
-#     - if: $CI_COMMIT_TAG
+golangci-lint:
+  stage: test
+  image: docker.io/golangci/golangci-lint:latest-alpine
+  variables:
+    GOLANGCI_LINT_CACHE: $CI_PROJECT_DIR/.cache/golangci-lint
+  cache:
+    key: golangci-lint
+    paths:
+      - .cache/golangci-lint
+      - /go/pkg/mod
+  script:
+    - golangci-lint run -c .golangci.yaml ./...
+  allow_failure: true
+  rules:
+    - if: $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH
+    - if: $CI_PIPELINE_SOURCE == 'merge_request_event'
+    - if: $CI_COMMIT_TAG

 # test:
 #   <<: *docker-job
@@ -292,18 +277,18 @@ default:
 sast-filesystem:
  <<: *trivy-fs-scan

-# sast-image-:
-#   <<: *trivy-image-scan
-#   variables:
-#     IMAGE_NAME: $BASE_IMAGE_NAME/backend
-#     IMAGE_TYPE: runtime
-#   dependencies:
-#     - build-runtime
+sast-image-server:
+  <<: *trivy-image-scan
+  variables:
+    IMAGE_NAME: $BASE_IMAGE_NAME/server
+    IMAGE_TYPE: runtime
+  dependencies:
+    - build-server

-# tag-backend:
-#   <<: *tag-config
-#   variables:
-#     IMAGE_NAME: $BASE_IMAGE_NAME/backend
+tag-server:
+  <<: *tag-config
+  variables:
+    IMAGE_NAME: $BASE_IMAGE_NAME/server

 # webhook-backend-deploy:
 #   <<: *webhook-config
@@ -1,8 +1,8 @@
 ARG GOARCH=amd64
 ARG GOOS=linux
 ARG CGO_ENABLED=0
-ARG VERSION=1.0.0
 ARG BUILD_TIME=unknown
+ARG SERVICE

 # Stage 1: Build
 FROM docker.io/golang:1.24-alpine AS build
@@ -12,32 +12,38 @@ ARG GOARCH
 ARG CGO_ENABLED
 ARG VERSION
 ARG BUILD_TIME
+ARG SERVICE

 WORKDIR /src

 COPY go.mod go.sum ./
-RUN go mod download
+RUN --mount=type=cache,target=/root/.cache/go-build \
+    --mount=type=cache,target=/go/pkg/mod \
+    go mod download

 COPY . .

-RUN CGO_ENABLED=${CGO_ENABLED} \
+RUN --mount=type=cache,target=/root/.cache/go-build \
+    --mount=type=cache,target=/go/pkg/mod \
+    CGO_ENABLED=${CGO_ENABLED} \
    GOOS=${GOOS} \
    GOARCH=${GOARCH} \
    go build -trimpath \
-    -ldflags="-s -w -X 'main.Version=${VERSION}' -X 'main.BuildTime=${BUILD_TIME}'" \
-    -o /bin/app ./cmd/server
+    -ldflags="-s -w -X 'main.BuildTime=${BUILD_TIME}'" \
+    -o /bin/${SERVICE} ./cmd/${SERVICE}

 # Stage 2: Runtime
 FROM docker.io/alpine:3.22 AS runtime

 ARG VERSION
 ARG BUILD_TIME
+ARG SERVICE

 RUN addgroup -S app && adduser -S -G app app

 WORKDIR /app

-COPY --from=build /bin/app /app/bin
+COPY --from=build /bin/${SERVICE} /app/bin

 RUN chown app:app /app/bin && chmod +x /app/bin

@@ -1,51 +0,0 @@
-ARG GOARCH=amd64
-ARG GOOS=linux
-ARG CGO_ENABLED=0
-ARG VERSION=1.0.0
-ARG BUILD_TIME=unknown
-
-# Stage 1: Build
-FROM docker.io/golang:1.24-alpine AS build
-
-ARG GOOS
-ARG GOARCH
-ARG CGO_ENABLED
-ARG VERSION
-ARG BUILD_TIME
-
-WORKDIR /src
-
-COPY go.mod go.sum ./
-RUN go mod download
-
-COPY . .
-
-RUN CGO_ENABLED=${CGO_ENABLED} \
-    GOOS=${GOOS} \
-    GOARCH=${GOARCH} \
-    go build -trimpath \
-    -ldflags="-s -w -X 'main.Version=${VERSION}' -X 'main.BuildTime=${BUILD_TIME}'" \
-    -o /bin/app ./cmd/migrate
-
-# Stage 2: Runtime
-FROM docker.io/alpine:3.22 AS runtime
-
-ARG VERSION
-ARG BUILD_TIME
-
-RUN addgroup -S app && adduser -S -G app app
-
-WORKDIR /app
-
-COPY --from=build /bin/app /app/bin
-
-RUN chown app:app /app/bin && chmod +x /app/bin
-
-USER app
-
-LABEL org.opencontainers.image.version=${VERSION}
-LABEL org.opencontainers.image.created=${BUILD_TIME}
-
-ENTRYPOINT ["/app/bin"]
-
-CMD [""]