ITQ/Datarush
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
Files
276bd2182abf5a27225998152cc6bf1b9c0a76a6
Datarush/.gitlab-ci.yml
T
ITQ 154e0b0779 ci: added jobs for new service
2025-12-17 18:36:27 +03:00

338 lines
8.0 KiB
YAML
Raw Blame History

stages:
- build
- lint
- test
- sast
- tag
# - deploy
include:
- template: Jobs/SAST-IaC.gitlab-ci.yml
- template: Jobs/SAST.gitlab-ci.yml
- template: Jobs/Secret-Detection.gitlab-ci.yml
default:
retry: 1
variables:
BASE_IMAGE_NAME: $CI_REGISTRY_IMAGE
TRIVY_CACHE_DIR: .cache/trivy
TRIVY_NO_PROGRESS: "true"
TRIVY_TIMEOUT: "10m0s"
TRIVY_USERNAME: $CI_REGISTRY_USER
TRIVY_PASSWORD: $CI_REGISTRY_PASSWORD
TRIVY_REGISTRY: $CI_REGISTRY
DOCKER_HOST: "tcp://docker:2375"
DOCKER_TLS_CERTDIR: ""
cache:
key: "${CI_COMMIT_REF_SLUG}"
paths:
- $TRIVY_CACHE_DIR
policy: pull-push
.docker-job: &docker-job
image: docker.io/docker:cli
tags:
- k8s
services:
- docker.io/docker:dind
before_script:
- echo $CI_REGISTRY_PASSWORD | docker login -u "$CI_REGISTRY_USER" --password-stdin $CI_REGISTRY
.buildah-job: &buildah-job
image: quay.io/containers/buildah:latest
tags:
- k8s
variables:
STORAGE_DRIVER: vfs
BUILDAH_FORMAT: oci
BUILDAH_ISOLATION: chroot
before_script:
- buildah login -u "$CI_REGISTRY_USER" -p "$CI_REGISTRY_PASSWORD" $CI_REGISTRY
.trivy-fs-template: &trivy-fs-scan
image:
name: docker.io/aquasec/trivy:latest
entrypoint: [""]
cache:
paths:
- $TRIVY_CACHE_DIR
policy: pull-push
before_script:
- mkdir -p $TRIVY_CACHE_DIR
script:
- trivy filesystem --skip-files $TRIVY_CACHE_DIR --format cyclonedx --output fs-sbom.json .
- trivy filesystem --skip-files $TRIVY_CACHE_DIR --format sarif --output gl-sast-fs-report.json .
allow_failure: true
artifacts:
reports:
sast: gl-sast-fs-report.json
paths:
- fs-sbom.json
- gl-sast-fs-report.json
expire_in: 1 week
when: always
rules:
- if: $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH
- if: $CI_COMMIT_TAG
- if: $CI_PIPELINE_SOURCE == 'merge_request_event'
- if: $SAST_DISABLED
when: never
.trivy-image-template: &trivy-image-scan
image:
name: docker.io/aquasec/trivy:latest
entrypoint: [""]
cache:
paths:
- $TRIVY_CACHE_DIR
policy: pull-push
before_script:
- mkdir -p $TRIVY_CACHE_DIR
script:
- |
trivy image \
--scanners vuln \
--format cyclonedx \
--output image-sbom-${IMAGE_TYPE}.json \
$IMAGE_NAME:$CI_COMMIT_SHA
- |
trivy image \
--format sarif \
--output gl-sast-image-${IMAGE_TYPE}-report.json \
$IMAGE_NAME:$CI_COMMIT_SHA
allow_failure: true
artifacts:
reports:
sast: gl-sast-image-${IMAGE_TYPE}-report.json
paths:
- image-sbom-${IMAGE_TYPE}.json
- gl-sast-image-${IMAGE_TYPE}-report.json
expire_in: 1 week
when: always
rules:
- if: $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH
- if: $CI_COMMIT_TAG
- if: $CI_PIPELINE_SOURCE == 'merge_request_event'
- if: $SAST_DISABLED
when: never
# .webhook-template: &webhook-config
# image: curlimages/curl:latest
# script:
# - |
# curl -sf -X POST \
# -H "Content-Type: application/json" \
# -H "Authorization: Bearer $WEBHOOK_SECRET_TOKEN" \
# -H "Webhook-Identifier: $WEBHOOK_BYPASS_TOKEN" \
# "$WEBHOOK_URL"
# rules:
# - if: $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH
# when: on_success
.build-template: &build-config
<<: *buildah-job
stage: build
script:
- |
buildah bud \
--tag $IMAGE_NAME:$CI_COMMIT_SHA \
--file $CONTAINERFILE \
--target $BUILDTARGET \
--build-arg SERVICE=${SERVICE_NAME} \
--layers \
--cache-from $IMAGE_NAME-cache \
--cache-to $IMAGE_NAME-cache \
.
- buildah push $IMAGE_NAME:$CI_COMMIT_SHA
rules:
- if: $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH
when: always
- if: $CI_COMMIT_TAG
when: always
- if: $CI_PIPELINE_SOURCE == 'merge_request_event'
when: manual
allow_failure: true
.tag-template: &tag-config
<<: *buildah-job
stage: tag
script:
- |
set -euo pipefail
buildah pull $IMAGE_NAME:$CI_COMMIT_SHA
if [ -n "${CI_COMMIT_TAG:-}" ]; then
buildah tag $IMAGE_NAME:$CI_COMMIT_SHA $IMAGE_NAME:$CI_COMMIT_TAG
buildah push $IMAGE_NAME:$CI_COMMIT_TAG
fi
if [ -n "${CI_COMMIT_BRANCH:-}" ]; then
buildah tag $IMAGE_NAME:$CI_COMMIT_SHA $IMAGE_NAME:$CI_COMMIT_REF_SLUG
buildah push $IMAGE_NAME:$CI_COMMIT_REF_SLUG
if [ "$CI_COMMIT_BRANCH" = "$CI_DEFAULT_BRANCH" ]; then
buildah tag $IMAGE_NAME:$CI_COMMIT_SHA $IMAGE_NAME:latest
buildah push $IMAGE_NAME:latest
fi
fi
rules:
- if: $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH
- if: $CI_COMMIT_TAG
- if: $CI_PIPELINE_SOURCE == 'merge_request_event'
when: manual
allow_failure: true
build-migrate:
<<: *build-config
variables:
IMAGE_NAME: $BASE_IMAGE_NAME/migrate
CONTAINERFILE: Containerfile
BUILDTARGET: runtime
SERVICE_NAME: migrate
build-gw:
<<: *build-config
variables:
IMAGE_NAME: $BASE_IMAGE_NAME/gw
CONTAINERFILE: Containerfile
BUILDTARGET: runtime
SERVICE_NAME: gw
build-auth:
<<: *build-config
variables:
IMAGE_NAME: $BASE_IMAGE_NAME/auth
CONTAINERFILE: Containerfile
BUILDTARGET: runtime
SERVICE_NAME: auth
build-competition:
<<: *build-config
variables:
IMAGE_NAME: $BASE_IMAGE_NAME/competition
CONTAINERFILE: Containerfile
BUILDTARGET: runtime
SERVICE_NAME: competition
golangci-lint:
stage: lint
image: docker.io/golangci/golangci-lint:latest-alpine
variables:
GOLANGCI_LINT_CACHE: $CI_PROJECT_DIR/.cache/golangci-lint
cache:
key: golangci-lint
paths:
- .cache/golangci-lint
- /go/pkg/mod
script:
- golangci-lint run -c .golangci.yaml ./...
allow_failure: true
rules:
- if: $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH
- if: $CI_PIPELINE_SOURCE == 'merge_request_event'
- if: $CI_COMMIT_TAG
go-test:
stage: test
image: docker.io/library/golang:1.24-alpine
variables:
CGO_ENABLED: "0"
cache:
key: "${CI_COMMIT_REF_SLUG}-go-mod"
paths:
- /go/pkg/mod
- /root/.cache/go-build
script:
- apk add --no-cache git
- go test ./... -coverprofile=coverage.out
- go tool cover -func=coverage.out | tee coverage-func.txt
- TOTAL=$(go tool cover -func=coverage.out | awk '/total:/ {print $3}' | sed 's/%//')
- |
echo "Total coverage: $TOTAL"
echo "$TOTAL" | awk -v threshold=30 '{ if ($1+0 < threshold) { print "Coverage below threshold: " $1 "%"; exit 1 } }'
allow_failure: true
artifacts:
paths:
- coverage.out
- coverage-func.txt
expire_in: 1 week
when: always
coverage: '/TOTAL.+ ([0-9]{1,3}%)/'
sast-filesystem:
<<: *trivy-fs-scan
sast-image-migrate:
<<: *trivy-image-scan
variables:
IMAGE_NAME: $BASE_IMAGE_NAME/migrate
IMAGE_TYPE: migrate
dependencies:
- build-migrate
sast-image-gw:
<<: *trivy-image-scan
variables:
IMAGE_NAME: $BASE_IMAGE_NAME/gw
IMAGE_TYPE: gw
dependencies:
- build-gw
sast-image-auth:
<<: *trivy-image-scan
variables:
IMAGE_NAME: $BASE_IMAGE_NAME/auth
IMAGE_TYPE: auth
dependencies:
- build-auth
sast-image-competition:
<<: *trivy-image-scan
variables:
IMAGE_NAME: $BASE_IMAGE_NAME/competition
IMAGE_TYPE: competition
dependencies:
- build-competition
tag-migrate:
<<: *tag-config
variables:
IMAGE_NAME: $BASE_IMAGE_NAME/migrate
tag-gw:
<<: *tag-config
variables:
IMAGE_NAME: $BASE_IMAGE_NAME/gw
tag-auth:
<<: *tag-config
variables:
IMAGE_NAME: $BASE_IMAGE_NAME/auth
tag-competition:
<<: *tag-config
variables:
IMAGE_NAME: $BASE_IMAGE_NAME/competition
# webhook-backend-deploy:
# <<: *webhook-config
# stage: deploy
# variables:
# WEBHOOK_URL: $WEBHOOK_URL_BACKEND
# environment:
# name: staging
# url: https://datarush.itqdev.xyz
# resource_group: staging
# dependencies:
# - build-runtime
# - sast-image-runtime
workflow:
rules:
- if: $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH
- if: $CI_PIPELINE_SOURCE == "merge_request_event"
- if: $CI_COMMIT_TAG
Reference in New Issue View Git Blame Copy Permalink