From 98ec96c8aa1eea532d66f4eabbeece00c6a3ea34 Mon Sep 17 00:00:00 2001 From: ITQ Date: Sun, 14 Dec 2025 14:32:35 +0300 Subject: [PATCH] ci: added build and tagging --- .gitlab-ci.yml | 217 ++++++++++++++++++++---------------------- Containerfile | 18 ++-- Containerfile.migrate | 51 ---------- 3 files changed, 113 insertions(+), 173 deletions(-) delete mode 100644 Containerfile.migrate diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml index 9617efe..f254cac 100644 --- a/.gitlab-ci.yml +++ b/.gitlab-ci.yml @@ -1,9 +1,8 @@ stages: - # - build + - build - test - sast - # - dast - # - tag + - tag # - deploy include: @@ -16,33 +15,27 @@ include: default: retry: 1 -# variables: -# BASE_IMAGE_NAME: $CI_REGISTRY_IMAGE -# TRIVY_CACHE_DIR: .cache/trivy -# TRIVY_NO_PROGRESS: "true" -# TRIVY_TIMEOUT: "10m0s" -# TRIVY_USERNAME: $CI_REGISTRY_USER -# TRIVY_PASSWORD: $CI_REGISTRY_PASSWORD -# TRIVY_REGISTRY: $CI_REGISTRY -# UV_PROJECT_ENVIRONMENT: .venv -# UV_CACHE_DIR: .cache/uv -# BUILDAH_ISOLATION: oci -# STORAGE_DRIVER: vfs -# DOCKER_HOST: "tcp://docker:2375" -# DOCKER_TLS_CERTDIR: "" +variables: + BASE_IMAGE_NAME: $CI_REGISTRY_IMAGE + TRIVY_CACHE_DIR: .cache/trivy + TRIVY_NO_PROGRESS: "true" + TRIVY_TIMEOUT: "10m0s" + TRIVY_USERNAME: $CI_REGISTRY_USER + TRIVY_PASSWORD: $CI_REGISTRY_PASSWORD + TRIVY_REGISTRY: $CI_REGISTRY + DOCKER_HOST: "tcp://docker:2375" + DOCKER_TLS_CERTDIR: "" -# cache: -# key: "${CI_COMMIT_REF_SLUG}" -# paths: -# - $TRIVY_CACHE_DIR -# - $UV_CACHE_DIR -# - $UV_PROJECT_ENVIRONMENT -# policy: pull-push +cache: + key: "${CI_COMMIT_REF_SLUG}" + paths: + - $TRIVY_CACHE_DIR + policy: pull-push .docker-job: &docker-job - image: docker:cli + image: docker.io/docker:cli services: - - docker:dind + - docker.io/docker:dind before_script: - docker login -u "$CI_REGISTRY_USER" -p "$CI_REGISTRY_PASSWORD" $CI_REGISTRY @@ -50,12 +43,13 @@ default: image: quay.io/containers/buildah:latest variables: STORAGE_DRIVER: vfs + BUILDAH_ISOLATION: oci before_script: - buildah login -u "$CI_REGISTRY_USER" -p "$CI_REGISTRY_PASSWORD" $CI_REGISTRY .trivy-fs-template: &trivy-fs-scan image: - name: aquasec/trivy:latest + name: docker.io/aquasec/trivy:latest entrypoint: [""] cache: paths: @@ -82,44 +76,43 @@ default: - if: $SAST_DISABLED when: never -# .trivy-image-template: &trivy-image-scan -# stage: security -# image: -# name: aquasec/trivy:latest -# entrypoint: [""] -# cache: -# paths: -# - $TRIVY_CACHE_DIR -# policy: pull-push -# before_script: -# - mkdir -p $TRIVY_CACHE_DIR -# script: -# - | -# trivy image \ -# --scanners vuln \ -# --format cyclonedx \ -# --output image-sbom-${IMAGE_TYPE}.json \ -# $IMAGE_NAME:$CI_COMMIT_SHA -# - | -# trivy image \ -# --format sarif \ -# --output gl-sast-image-${IMAGE_TYPE}-report.json \ -# $IMAGE_NAME:$CI_COMMIT_SHA -# allow_failure: true -# artifacts: -# reports: -# sast: gl-sast-image-${IMAGE_TYPE}-report.json -# paths: -# - image-sbom-${IMAGE_TYPE}.json -# - gl-sast-image-${IMAGE_TYPE}-report.json -# expire_in: 1 week -# when: always -# rules: -# - if: $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH -# - if: $CI_COMMIT_TAG -# - if: $CI_PIPELINE_SOURCE == 'merge_request_event' -# - if: $SAST_DISABLED -# when: never +.trivy-image-template: &trivy-image-scan + image: + name: docker.io/aquasec/trivy:latest + entrypoint: [""] + cache: + paths: + - $TRIVY_CACHE_DIR + policy: pull-push + before_script: + - mkdir -p $TRIVY_CACHE_DIR + script: + - | + trivy image \ + --scanners vuln \ + --format cyclonedx \ + --output image-sbom-${IMAGE_TYPE}.json \ + $IMAGE_NAME:$CI_COMMIT_SHA + - | + trivy image \ + --format sarif \ + --output gl-sast-image-${IMAGE_TYPE}-report.json \ + $IMAGE_NAME:$CI_COMMIT_SHA + allow_failure: true + artifacts: + reports: + sast: gl-sast-image-${IMAGE_TYPE}-report.json + paths: + - image-sbom-${IMAGE_TYPE}.json + - gl-sast-image-${IMAGE_TYPE}-report.json + expire_in: 1 week + when: always + rules: + - if: $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH + - if: $CI_COMMIT_TAG + - if: $CI_PIPELINE_SOURCE == 'merge_request_event' + - if: $SAST_DISABLED + when: never # .webhook-template: &webhook-config # image: curlimages/curl:latest @@ -143,6 +136,7 @@ default: --tag $IMAGE_NAME:$CI_COMMIT_SHA \ --file $CONTAINERFILE \ --target $BUILDTARGET \ + --build-arg SERVICE_NAME=${SERVICE_NAME} \ --layers \ --cache-from $IMAGE_NAME-cache \ --cache-to $IMAGE_NAME-cache \ @@ -187,48 +181,39 @@ default: when: manual allow_failure: true -# build-runtime: -# <<: *build-config -# variables: -# IMAGE_NAME: $BASE_IMAGE_NAME/backend -# CONTAINERFILE: Containerfile -# BUILDTARGET: runtime +build-server: + <<: *build-config + variables: + IMAGE_NAME: $BASE_IMAGE_NAME/server + CONTAINERFILE: Containerfile + BUILDTARGET: runtime + SERVICE_NAME: server -# build-tests: -# <<: *build-config -# variables: -# IMAGE_NAME: $BASE_IMAGE_NAME/backend-tests -# CONTAINERFILE: Containerfile -# BUILDTARGET: tests +build-migrate: + <<: *build-config + variables: + IMAGE_NAME: $BASE_IMAGE_NAME/migrate + CONTAINERFILE: Containerfile + BUILDTARGET: runtime + SERVICE_NAME: migrate -# build-migrations: -# <<: *build-config -# variables: -# IMAGE_NAME: $BASE_IMAGE_NAME/backend-migrations -# CONTAINERFILE: Containerfile -# BUILDTARGET: migrations - -# build-ml: -# <<: *build-config -# when: manual -# variables: -# IMAGE_NAME: $BASE_IMAGE_NAME/ml -# CONTAINERFILE: Containerfile -# BUILDTARGET: ml - -# lint: -# <<: *uv-job -# stage: test -# script: -# - source $HOME/.local/bin/env -# - uv sync --group linters --frozen -# - source $UV_PROJECT_ENVIRONMENT/bin/activate -# - just lint -# allow_failure: true -# rules: -# - if: $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH -# - if: $CI_PIPELINE_SOURCE == 'merge_request_event' -# - if: $CI_COMMIT_TAG +golangci-lint: + stage: test + image: docker.io/golangci/golangci-lint:latest-alpine + variables: + GOLANGCI_LINT_CACHE: $CI_PROJECT_DIR/.cache/golangci-lint + cache: + key: golangci-lint + paths: + - .cache/golangci-lint + - /go/pkg/mod + script: + - golangci-lint run -c .golangci.yaml ./... + allow_failure: true + rules: + - if: $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH + - if: $CI_PIPELINE_SOURCE == 'merge_request_event' + - if: $CI_COMMIT_TAG # test: # <<: *docker-job @@ -292,18 +277,18 @@ default: sast-filesystem: <<: *trivy-fs-scan -# sast-image-: -# <<: *trivy-image-scan -# variables: -# IMAGE_NAME: $BASE_IMAGE_NAME/backend -# IMAGE_TYPE: runtime -# dependencies: -# - build-runtime +sast-image-server: + <<: *trivy-image-scan + variables: + IMAGE_NAME: $BASE_IMAGE_NAME/server + IMAGE_TYPE: runtime + dependencies: + - build-server -# tag-backend: -# <<: *tag-config -# variables: -# IMAGE_NAME: $BASE_IMAGE_NAME/backend +tag-server: + <<: *tag-config + variables: + IMAGE_NAME: $BASE_IMAGE_NAME/server # webhook-backend-deploy: # <<: *webhook-config diff --git a/Containerfile b/Containerfile index 2be6827..bfa239b 100644 --- a/Containerfile +++ b/Containerfile @@ -1,8 +1,8 @@ ARG GOARCH=amd64 ARG GOOS=linux ARG CGO_ENABLED=0 -ARG VERSION=1.0.0 ARG BUILD_TIME=unknown +ARG SERVICE # Stage 1: Build FROM docker.io/golang:1.24-alpine AS build @@ -12,32 +12,38 @@ ARG GOARCH ARG CGO_ENABLED ARG VERSION ARG BUILD_TIME +ARG SERVICE WORKDIR /src COPY go.mod go.sum ./ -RUN go mod download +RUN --mount=type=cache,target=/root/.cache/go-build \ + --mount=type=cache,target=/go/pkg/mod \ + go mod download COPY . . -RUN CGO_ENABLED=${CGO_ENABLED} \ +RUN --mount=type=cache,target=/root/.cache/go-build \ + --mount=type=cache,target=/go/pkg/mod \ + CGO_ENABLED=${CGO_ENABLED} \ GOOS=${GOOS} \ GOARCH=${GOARCH} \ go build -trimpath \ - -ldflags="-s -w -X 'main.Version=${VERSION}' -X 'main.BuildTime=${BUILD_TIME}'" \ - -o /bin/app ./cmd/server + -ldflags="-s -w -X 'main.BuildTime=${BUILD_TIME}'" \ + -o /bin/${SERVICE} ./cmd/${SERVICE} # Stage 2: Runtime FROM docker.io/alpine:3.22 AS runtime ARG VERSION ARG BUILD_TIME +ARG SERVICE RUN addgroup -S app && adduser -S -G app app WORKDIR /app -COPY --from=build /bin/app /app/bin +COPY --from=build /bin/${SERVICE} /app/bin RUN chown app:app /app/bin && chmod +x /app/bin diff --git a/Containerfile.migrate b/Containerfile.migrate deleted file mode 100644 index 60219db..0000000 --- a/Containerfile.migrate +++ /dev/null @@ -1,51 +0,0 @@ -ARG GOARCH=amd64 -ARG GOOS=linux -ARG CGO_ENABLED=0 -ARG VERSION=1.0.0 -ARG BUILD_TIME=unknown - -# Stage 1: Build -FROM docker.io/golang:1.24-alpine AS build - -ARG GOOS -ARG GOARCH -ARG CGO_ENABLED -ARG VERSION -ARG BUILD_TIME - -WORKDIR /src - -COPY go.mod go.sum ./ -RUN go mod download - -COPY . . - -RUN CGO_ENABLED=${CGO_ENABLED} \ - GOOS=${GOOS} \ - GOARCH=${GOARCH} \ - go build -trimpath \ - -ldflags="-s -w -X 'main.Version=${VERSION}' -X 'main.BuildTime=${BUILD_TIME}'" \ - -o /bin/app ./cmd/migrate - -# Stage 2: Runtime -FROM docker.io/alpine:3.22 AS runtime - -ARG VERSION -ARG BUILD_TIME - -RUN addgroup -S app && adduser -S -G app app - -WORKDIR /app - -COPY --from=build /bin/app /app/bin - -RUN chown app:app /app/bin && chmod +x /app/bin - -USER app - -LABEL org.opencontainers.image.version=${VERSION} -LABEL org.opencontainers.image.created=${BUILD_TIME} - -ENTRYPOINT ["/app/bin"] - -CMD [""]