ci: added gitlab templates
This commit is contained in:
+324
-11
@@ -1,13 +1,326 @@
|
||||
# You can override the included template(s) by including variable overrides
|
||||
# SAST customization: https://docs.gitlab.com/ee/user/application_security/sast/#customizing-the-sast-settings
|
||||
# Secret Detection customization: https://docs.gitlab.com/ee/user/application_security/secret_detection/#customizing-settings
|
||||
# Dependency Scanning customization: https://docs.gitlab.com/ee/user/application_security/dependency_scanning/#customizing-the-dependency-scanning-settings
|
||||
# Container Scanning customization: https://docs.gitlab.com/ee/user/application_security/container_scanning/#customizing-the-container-scanning-settings
|
||||
# Note that environment variables can be set in several places
|
||||
# See https://docs.gitlab.com/ee/ci/variables/#cicd-variable-precedence
|
||||
stages:
|
||||
- test
|
||||
sast:
|
||||
stage: test
|
||||
# - build
|
||||
- test
|
||||
- sast
|
||||
# - dast
|
||||
# - tag
|
||||
# - deploy
|
||||
|
||||
include:
|
||||
- template: Security/SAST.gitlab-ci.yml
|
||||
- template: Jobs/Container-Scanning.gitlab-ci.yml
|
||||
# - template: Jobs/Dependency-Scanning.gitlab-ci.yml
|
||||
- local: .gitlab/Dependency-Scanning.v2.gitlab-ci.yml
|
||||
- template: Jobs/SAST-IaC.gitlab-ci.yml
|
||||
- template: Jobs/SAST.gitlab-ci.yml
|
||||
- template: Jobs/Secret-Detection.gitlab-ci.yml
|
||||
|
||||
default:
|
||||
retry: 1
|
||||
|
||||
# variables:
|
||||
# BASE_IMAGE_NAME: $CI_REGISTRY_IMAGE
|
||||
# TRIVY_CACHE_DIR: .cache/trivy
|
||||
# TRIVY_NO_PROGRESS: "true"
|
||||
# TRIVY_TIMEOUT: "10m0s"
|
||||
# TRIVY_USERNAME: $CI_REGISTRY_USER
|
||||
# TRIVY_PASSWORD: $CI_REGISTRY_PASSWORD
|
||||
# TRIVY_REGISTRY: $CI_REGISTRY
|
||||
# UV_PROJECT_ENVIRONMENT: .venv
|
||||
# UV_CACHE_DIR: .cache/uv
|
||||
# BUILDAH_ISOLATION: oci
|
||||
# STORAGE_DRIVER: vfs
|
||||
# DOCKER_HOST: "tcp://docker:2375"
|
||||
# DOCKER_TLS_CERTDIR: ""
|
||||
|
||||
# cache:
|
||||
# key: "${CI_COMMIT_REF_SLUG}"
|
||||
# paths:
|
||||
# - $TRIVY_CACHE_DIR
|
||||
# - $UV_CACHE_DIR
|
||||
# - $UV_PROJECT_ENVIRONMENT
|
||||
# policy: pull-push
|
||||
|
||||
.docker-job: &docker-job
|
||||
image: docker:cli
|
||||
services:
|
||||
- docker:dind
|
||||
before_script:
|
||||
- docker login -u "$CI_REGISTRY_USER" -p "$CI_REGISTRY_PASSWORD" $CI_REGISTRY
|
||||
|
||||
.buildah-job: &buildah-job
|
||||
image: quay.io/containers/buildah:latest
|
||||
variables:
|
||||
STORAGE_DRIVER: vfs
|
||||
before_script:
|
||||
- buildah login -u "$CI_REGISTRY_USER" -p "$CI_REGISTRY_PASSWORD" $CI_REGISTRY
|
||||
|
||||
.trivy-fs-template: &trivy-fs-scan
|
||||
image:
|
||||
name: aquasec/trivy:latest
|
||||
entrypoint: [""]
|
||||
cache:
|
||||
paths:
|
||||
- $TRIVY_CACHE_DIR
|
||||
policy: pull-push
|
||||
before_script:
|
||||
- mkdir -p $TRIVY_CACHE_DIR
|
||||
script:
|
||||
- trivy filesystem --skip-files $TRIVY_CACHE_DIR --format cyclonedx --output fs-sbom.json .
|
||||
- trivy filesystem --skip-files $TRIVY_CACHE_DIR --format sarif --output gl-sast-fs-report.json .
|
||||
allow_failure: true
|
||||
artifacts:
|
||||
reports:
|
||||
sast: gl-sast-fs-report.json
|
||||
paths:
|
||||
- fs-sbom.json
|
||||
- gl-sast-fs-report.json
|
||||
expire_in: 1 week
|
||||
when: always
|
||||
rules:
|
||||
- if: $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH
|
||||
- if: $CI_COMMIT_TAG
|
||||
- if: $CI_PIPELINE_SOURCE == 'merge_request_event'
|
||||
- if: $SAST_DISABLED
|
||||
when: never
|
||||
|
||||
# .trivy-image-template: &trivy-image-scan
|
||||
# stage: security
|
||||
# image:
|
||||
# name: aquasec/trivy:latest
|
||||
# entrypoint: [""]
|
||||
# cache:
|
||||
# paths:
|
||||
# - $TRIVY_CACHE_DIR
|
||||
# policy: pull-push
|
||||
# before_script:
|
||||
# - mkdir -p $TRIVY_CACHE_DIR
|
||||
# script:
|
||||
# - |
|
||||
# trivy image \
|
||||
# --scanners vuln \
|
||||
# --format cyclonedx \
|
||||
# --output image-sbom-${IMAGE_TYPE}.json \
|
||||
# $IMAGE_NAME:$CI_COMMIT_SHA
|
||||
# - |
|
||||
# trivy image \
|
||||
# --format sarif \
|
||||
# --output gl-sast-image-${IMAGE_TYPE}-report.json \
|
||||
# $IMAGE_NAME:$CI_COMMIT_SHA
|
||||
# allow_failure: true
|
||||
# artifacts:
|
||||
# reports:
|
||||
# sast: gl-sast-image-${IMAGE_TYPE}-report.json
|
||||
# paths:
|
||||
# - image-sbom-${IMAGE_TYPE}.json
|
||||
# - gl-sast-image-${IMAGE_TYPE}-report.json
|
||||
# expire_in: 1 week
|
||||
# when: always
|
||||
# rules:
|
||||
# - if: $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH
|
||||
# - if: $CI_COMMIT_TAG
|
||||
# - if: $CI_PIPELINE_SOURCE == 'merge_request_event'
|
||||
# - if: $SAST_DISABLED
|
||||
# when: never
|
||||
|
||||
# .webhook-template: &webhook-config
|
||||
# image: curlimages/curl:latest
|
||||
# script:
|
||||
# - |
|
||||
# curl -sf -X POST \
|
||||
# -H "Content-Type: application/json" \
|
||||
# -H "Authorization: Bearer $WEBHOOK_SECRET_TOKEN" \
|
||||
# -H "Webhook-Identifier: $WEBHOOK_BYPASS_TOKEN" \
|
||||
# "$WEBHOOK_URL"
|
||||
# rules:
|
||||
# - if: $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH
|
||||
# when: on_success
|
||||
|
||||
.build-template: &build-config
|
||||
<<: *buildah-job
|
||||
stage: build
|
||||
script:
|
||||
- |
|
||||
buildah bud \
|
||||
--tag $IMAGE_NAME:$CI_COMMIT_SHA \
|
||||
--file $CONTAINERFILE \
|
||||
--target $BUILDTARGET \
|
||||
--layers \
|
||||
--cache-from $IMAGE_NAME-cache \
|
||||
--cache-to $IMAGE_NAME-cache \
|
||||
.
|
||||
- buildah push $IMAGE_NAME:$CI_COMMIT_SHA
|
||||
rules:
|
||||
- if: $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH
|
||||
when: always
|
||||
- if: $CI_COMMIT_TAG
|
||||
when: always
|
||||
- if: $CI_PIPELINE_SOURCE == 'merge_request_event'
|
||||
when: manual
|
||||
allow_failure: true
|
||||
|
||||
.tag-template: &tag-config
|
||||
<<: *buildah-job
|
||||
stage: tag
|
||||
script:
|
||||
- |
|
||||
set -euo pipefail
|
||||
|
||||
buildah pull $IMAGE_NAME:$CI_COMMIT_SHA
|
||||
|
||||
if [ -n "${CI_COMMIT_TAG:-}" ]; then
|
||||
buildah tag $IMAGE_NAME:$CI_COMMIT_SHA $IMAGE_NAME:$CI_COMMIT_TAG
|
||||
buildah push $IMAGE_NAME:$CI_COMMIT_TAG
|
||||
fi
|
||||
|
||||
if [ -n "${CI_COMMIT_BRANCH:-}" ]; then
|
||||
buildah tag $IMAGE_NAME:$CI_COMMIT_SHA $IMAGE_NAME:$CI_COMMIT_REF_SLUG
|
||||
buildah push $IMAGE_NAME:$CI_COMMIT_REF_SLUG
|
||||
|
||||
if [ "$CI_COMMIT_BRANCH" = "$CI_DEFAULT_BRANCH" ]; then
|
||||
buildah tag $IMAGE_NAME:$CI_COMMIT_SHA $IMAGE_NAME:latest
|
||||
buildah push $IMAGE_NAME:latest
|
||||
fi
|
||||
fi
|
||||
rules:
|
||||
- if: $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH
|
||||
- if: $CI_COMMIT_TAG
|
||||
- if: $CI_PIPELINE_SOURCE == 'merge_request_event'
|
||||
when: manual
|
||||
allow_failure: true
|
||||
|
||||
# build-runtime:
|
||||
# <<: *build-config
|
||||
# variables:
|
||||
# IMAGE_NAME: $BASE_IMAGE_NAME/backend
|
||||
# CONTAINERFILE: Containerfile
|
||||
# BUILDTARGET: runtime
|
||||
|
||||
# build-tests:
|
||||
# <<: *build-config
|
||||
# variables:
|
||||
# IMAGE_NAME: $BASE_IMAGE_NAME/backend-tests
|
||||
# CONTAINERFILE: Containerfile
|
||||
# BUILDTARGET: tests
|
||||
|
||||
# build-migrations:
|
||||
# <<: *build-config
|
||||
# variables:
|
||||
# IMAGE_NAME: $BASE_IMAGE_NAME/backend-migrations
|
||||
# CONTAINERFILE: Containerfile
|
||||
# BUILDTARGET: migrations
|
||||
|
||||
# build-ml:
|
||||
# <<: *build-config
|
||||
# when: manual
|
||||
# variables:
|
||||
# IMAGE_NAME: $BASE_IMAGE_NAME/ml
|
||||
# CONTAINERFILE: Containerfile
|
||||
# BUILDTARGET: ml
|
||||
|
||||
# lint:
|
||||
# <<: *uv-job
|
||||
# stage: test
|
||||
# script:
|
||||
# - source $HOME/.local/bin/env
|
||||
# - uv sync --group linters --frozen
|
||||
# - source $UV_PROJECT_ENVIRONMENT/bin/activate
|
||||
# - just lint
|
||||
# allow_failure: true
|
||||
# rules:
|
||||
# - if: $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH
|
||||
# - if: $CI_PIPELINE_SOURCE == 'merge_request_event'
|
||||
# - if: $CI_COMMIT_TAG
|
||||
|
||||
# test:
|
||||
# <<: *docker-job
|
||||
# stage: test
|
||||
# tags:
|
||||
# - beta
|
||||
# variables:
|
||||
# COMPOSE_PROFILES: |
|
||||
# --profile migrations
|
||||
# --profile tests
|
||||
# --profile ml
|
||||
# script:
|
||||
# - apk add --no-cache docker-compose
|
||||
# - export PROFILES="$(printf '%s ' $COMPOSE_PROFILES)"
|
||||
# - cp "$TEST_STAGE_FIREBASE_CONF" ./infrastructure/configs/backend/firebase.json
|
||||
# - |
|
||||
# (
|
||||
# while true; do
|
||||
# docker compose -f compose.yaml $PROFILES logs -f 2>&1
|
||||
# sleep 1
|
||||
# done
|
||||
# ) | tee -a compose.log &
|
||||
# - LOGS_PID=$!
|
||||
# - |
|
||||
# REGISTRY_PREFIX=$CI_REGISTRY_IMAGE IMAGE_TAG=$CI_COMMIT_SHA \
|
||||
# docker compose -f compose.yaml -f compose.prod.yaml \
|
||||
# $PROFILES up -d --quiet-pull --quiet-build 2>&1 | tee compose.log
|
||||
# - |
|
||||
# TEST_CONTAINER_ID=$(docker compose -f compose.yaml $PROFILES ps -q tests -a)
|
||||
# timeout 600 docker wait $TEST_CONTAINER_ID
|
||||
# TEST_EXIT_CODE=$(docker inspect --format "{{.State.ExitCode}}" $TEST_CONTAINER_ID)
|
||||
|
||||
# if [ $TEST_EXIT_CODE -eq 0 ]; then
|
||||
# echo "Tests passed."
|
||||
# else
|
||||
# echo "Tests failed with exit code $TEST_EXIT_CODE."
|
||||
# exit 1
|
||||
# fi
|
||||
# - |
|
||||
# docker compose -f compose.yaml $PROFILES down
|
||||
# - cat .cov/coverage.txt
|
||||
# artifacts:
|
||||
# paths:
|
||||
# - ./.cov
|
||||
# - ./compose.log
|
||||
# reports:
|
||||
# coverage_report:
|
||||
# coverage_format: cobertura
|
||||
# path: .cov/coverage.xml
|
||||
# expire_in: 1 week
|
||||
# when: always
|
||||
# coverage: /TOTAL.*? (100(?:\.0+)?\%|[1-9]?\d(?:\.\d+)?\%)$/
|
||||
# rules:
|
||||
# - if: $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH
|
||||
# - if: $CI_PIPELINE_SOURCE == 'merge_request_event'
|
||||
# dependencies:
|
||||
# - build-runtime
|
||||
# - build-tests
|
||||
# - build-migrations
|
||||
|
||||
sast-filesystem:
|
||||
<<: *trivy-fs-scan
|
||||
|
||||
# sast-image-:
|
||||
# <<: *trivy-image-scan
|
||||
# variables:
|
||||
# IMAGE_NAME: $BASE_IMAGE_NAME/backend
|
||||
# IMAGE_TYPE: runtime
|
||||
# dependencies:
|
||||
# - build-runtime
|
||||
|
||||
# tag-backend:
|
||||
# <<: *tag-config
|
||||
# variables:
|
||||
# IMAGE_NAME: $BASE_IMAGE_NAME/backend
|
||||
|
||||
# webhook-backend-deploy:
|
||||
# <<: *webhook-config
|
||||
# stage: deploy
|
||||
# variables:
|
||||
# WEBHOOK_URL: $WEBHOOK_URL_BACKEND
|
||||
# environment:
|
||||
# name: staging
|
||||
# url: https://datarush.itqdev.xyz
|
||||
# resource_group: staging
|
||||
# dependencies:
|
||||
# - build-runtime
|
||||
# - sast-image-runtime
|
||||
|
||||
workflow:
|
||||
rules:
|
||||
- if: $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH
|
||||
- if: $CI_PIPELINE_SOURCE == "merge_request_event"
|
||||
- if: $CI_COMMIT_TAG
|
||||
|
||||
Reference in New Issue
Block a user