296 lines
7.2 KiB
YAML
296 lines
7.2 KiB
YAML
stages:
|
|
- build
|
|
- lint
|
|
- test
|
|
- sast
|
|
- tag
|
|
# - deploy
|
|
|
|
include:
|
|
- template: Jobs/SAST-IaC.gitlab-ci.yml
|
|
- template: Jobs/SAST.gitlab-ci.yml
|
|
- template: Jobs/Secret-Detection.gitlab-ci.yml
|
|
|
|
default:
|
|
retry: 1
|
|
|
|
variables:
|
|
BASE_IMAGE_NAME: $CI_REGISTRY_IMAGE
|
|
TRIVY_CACHE_DIR: .cache/trivy
|
|
TRIVY_NO_PROGRESS: "true"
|
|
TRIVY_TIMEOUT: "10m0s"
|
|
TRIVY_USERNAME: $CI_REGISTRY_USER
|
|
TRIVY_PASSWORD: $CI_REGISTRY_PASSWORD
|
|
TRIVY_REGISTRY: $CI_REGISTRY
|
|
DOCKER_HOST: "tcp://docker:2375"
|
|
DOCKER_TLS_CERTDIR: ""
|
|
|
|
cache:
|
|
key: "${CI_COMMIT_REF_SLUG}"
|
|
paths:
|
|
- $TRIVY_CACHE_DIR
|
|
policy: pull-push
|
|
|
|
.docker-job: &docker-job
|
|
image: docker.io/docker:cli
|
|
tags:
|
|
- k8s
|
|
services:
|
|
- docker.io/docker:dind
|
|
before_script:
|
|
- echo $CI_REGISTRY_PASSWORD | docker login -u "$CI_REGISTRY_USER" --password-stdin $CI_REGISTRY
|
|
|
|
.buildah-job: &buildah-job
|
|
image: quay.io/containers/buildah:latest
|
|
tags:
|
|
- k8s
|
|
variables:
|
|
STORAGE_DRIVER: vfs
|
|
BUILDAH_FORMAT: oci
|
|
BUILDAH_ISOLATION: chroot
|
|
before_script:
|
|
- buildah login -u "$CI_REGISTRY_USER" -p "$CI_REGISTRY_PASSWORD" $CI_REGISTRY
|
|
|
|
.trivy-fs-template: &trivy-fs-scan
|
|
image:
|
|
name: docker.io/aquasec/trivy:latest
|
|
entrypoint: [""]
|
|
cache:
|
|
paths:
|
|
- $TRIVY_CACHE_DIR
|
|
policy: pull-push
|
|
before_script:
|
|
- mkdir -p $TRIVY_CACHE_DIR
|
|
script:
|
|
- trivy filesystem --skip-files $TRIVY_CACHE_DIR --format cyclonedx --output fs-sbom.json .
|
|
- trivy filesystem --skip-files $TRIVY_CACHE_DIR --format sarif --output gl-sast-fs-report.json .
|
|
allow_failure: true
|
|
artifacts:
|
|
reports:
|
|
sast: gl-sast-fs-report.json
|
|
paths:
|
|
- fs-sbom.json
|
|
- gl-sast-fs-report.json
|
|
expire_in: 1 week
|
|
when: always
|
|
rules:
|
|
- if: $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH
|
|
- if: $CI_COMMIT_TAG
|
|
- if: $CI_PIPELINE_SOURCE == 'merge_request_event'
|
|
- if: $SAST_DISABLED
|
|
when: never
|
|
|
|
.trivy-image-template: &trivy-image-scan
|
|
image:
|
|
name: docker.io/aquasec/trivy:latest
|
|
entrypoint: [""]
|
|
cache:
|
|
paths:
|
|
- $TRIVY_CACHE_DIR
|
|
policy: pull-push
|
|
before_script:
|
|
- mkdir -p $TRIVY_CACHE_DIR
|
|
script:
|
|
- |
|
|
trivy image \
|
|
--scanners vuln \
|
|
--format cyclonedx \
|
|
--output image-sbom-${IMAGE_TYPE}.json \
|
|
$IMAGE_NAME:$CI_COMMIT_SHA
|
|
- |
|
|
trivy image \
|
|
--format sarif \
|
|
--output gl-sast-image-${IMAGE_TYPE}-report.json \
|
|
$IMAGE_NAME:$CI_COMMIT_SHA
|
|
allow_failure: true
|
|
artifacts:
|
|
reports:
|
|
sast: gl-sast-image-${IMAGE_TYPE}-report.json
|
|
paths:
|
|
- image-sbom-${IMAGE_TYPE}.json
|
|
- gl-sast-image-${IMAGE_TYPE}-report.json
|
|
expire_in: 1 week
|
|
when: always
|
|
rules:
|
|
- if: $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH
|
|
- if: $CI_COMMIT_TAG
|
|
- if: $CI_PIPELINE_SOURCE == 'merge_request_event'
|
|
- if: $SAST_DISABLED
|
|
when: never
|
|
|
|
# .webhook-template: &webhook-config
|
|
# image: curlimages/curl:latest
|
|
# script:
|
|
# - |
|
|
# curl -sf -X POST \
|
|
# -H "Content-Type: application/json" \
|
|
# -H "Authorization: Bearer $WEBHOOK_SECRET_TOKEN" \
|
|
# -H "Webhook-Identifier: $WEBHOOK_BYPASS_TOKEN" \
|
|
# "$WEBHOOK_URL"
|
|
# rules:
|
|
# - if: $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH
|
|
# when: on_success
|
|
|
|
.build-template: &build-config
|
|
<<: *buildah-job
|
|
stage: build
|
|
script:
|
|
- |
|
|
buildah bud \
|
|
--tag $IMAGE_NAME:$CI_COMMIT_SHA \
|
|
--file $CONTAINERFILE \
|
|
--target $BUILDTARGET \
|
|
--build-arg SERVICE=${SERVICE_NAME} \
|
|
--layers \
|
|
--cache-from $IMAGE_NAME-cache \
|
|
--cache-to $IMAGE_NAME-cache \
|
|
.
|
|
- buildah push $IMAGE_NAME:$CI_COMMIT_SHA
|
|
rules:
|
|
- if: $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH
|
|
when: always
|
|
- if: $CI_COMMIT_TAG
|
|
when: always
|
|
- if: $CI_PIPELINE_SOURCE == 'merge_request_event'
|
|
when: manual
|
|
allow_failure: true
|
|
|
|
.tag-template: &tag-config
|
|
<<: *buildah-job
|
|
stage: tag
|
|
script:
|
|
- |
|
|
set -euo pipefail
|
|
|
|
buildah pull $IMAGE_NAME:$CI_COMMIT_SHA
|
|
|
|
if [ -n "${CI_COMMIT_TAG:-}" ]; then
|
|
buildah tag $IMAGE_NAME:$CI_COMMIT_SHA $IMAGE_NAME:$CI_COMMIT_TAG
|
|
buildah push $IMAGE_NAME:$CI_COMMIT_TAG
|
|
fi
|
|
|
|
if [ -n "${CI_COMMIT_BRANCH:-}" ]; then
|
|
buildah tag $IMAGE_NAME:$CI_COMMIT_SHA $IMAGE_NAME:$CI_COMMIT_REF_SLUG
|
|
buildah push $IMAGE_NAME:$CI_COMMIT_REF_SLUG
|
|
|
|
if [ "$CI_COMMIT_BRANCH" = "$CI_DEFAULT_BRANCH" ]; then
|
|
buildah tag $IMAGE_NAME:$CI_COMMIT_SHA $IMAGE_NAME:latest
|
|
buildah push $IMAGE_NAME:latest
|
|
fi
|
|
fi
|
|
rules:
|
|
- if: $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH
|
|
- if: $CI_COMMIT_TAG
|
|
- if: $CI_PIPELINE_SOURCE == 'merge_request_event'
|
|
when: manual
|
|
allow_failure: true
|
|
|
|
build-auth:
|
|
<<: *build-config
|
|
variables:
|
|
IMAGE_NAME: $BASE_IMAGE_NAME/auth
|
|
CONTAINERFILE: Containerfile
|
|
BUILDTARGET: runtime
|
|
SERVICE_NAME: auth
|
|
|
|
build-migrate:
|
|
<<: *build-config
|
|
variables:
|
|
IMAGE_NAME: $BASE_IMAGE_NAME/migrate
|
|
CONTAINERFILE: Containerfile
|
|
BUILDTARGET: runtime
|
|
SERVICE_NAME: migrate
|
|
|
|
golangci-lint:
|
|
stage: lint
|
|
image: docker.io/golangci/golangci-lint:latest-alpine
|
|
variables:
|
|
GOLANGCI_LINT_CACHE: $CI_PROJECT_DIR/.cache/golangci-lint
|
|
cache:
|
|
key: golangci-lint
|
|
paths:
|
|
- .cache/golangci-lint
|
|
- /go/pkg/mod
|
|
script:
|
|
- golangci-lint run -c .golangci.yaml ./...
|
|
allow_failure: true
|
|
rules:
|
|
- if: $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH
|
|
- if: $CI_PIPELINE_SOURCE == 'merge_request_event'
|
|
- if: $CI_COMMIT_TAG
|
|
|
|
go-test:
|
|
stage: test
|
|
image: docker.io/library/golang:1.24-alpine
|
|
variables:
|
|
CGO_ENABLED: "0"
|
|
cache:
|
|
key: "${CI_COMMIT_REF_SLUG}-go-mod"
|
|
paths:
|
|
- /go/pkg/mod
|
|
- /root/.cache/go-build
|
|
script:
|
|
- apk add --no-cache git
|
|
- go test ./... -coverprofile=coverage.out
|
|
- go tool cover -func=coverage.out | tee coverage-func.txt
|
|
- TOTAL=$(go tool cover -func=coverage.out | awk '/total:/ {print $3}' | sed 's/%//')
|
|
- |
|
|
echo "Total coverage: $TOTAL"
|
|
echo "$TOTAL" | awk -v threshold=30 '{ if ($1+0 < threshold) { print "Coverage below threshold: " $1 "%"; exit 1 } }'
|
|
allow_failure: true
|
|
artifacts:
|
|
paths:
|
|
- coverage.out
|
|
- coverage-func.txt
|
|
expire_in: 1 week
|
|
when: always
|
|
coverage: '/TOTAL.+ ([0-9]{1,3}%)/'
|
|
|
|
sast-filesystem:
|
|
<<: *trivy-fs-scan
|
|
|
|
sast-image-auth:
|
|
<<: *trivy-image-scan
|
|
variables:
|
|
IMAGE_NAME: $BASE_IMAGE_NAME/auth
|
|
IMAGE_TYPE: auth
|
|
dependencies:
|
|
- build-auth
|
|
|
|
sast-image-migrate:
|
|
<<: *trivy-image-scan
|
|
variables:
|
|
IMAGE_NAME: $BASE_IMAGE_NAME/migrate
|
|
IMAGE_TYPE: migrate
|
|
dependencies:
|
|
- build-migrate
|
|
|
|
tag-auth:
|
|
<<: *tag-config
|
|
variables:
|
|
IMAGE_NAME: $BASE_IMAGE_NAME/auth
|
|
|
|
tag-migrate:
|
|
<<: *tag-config
|
|
variables:
|
|
IMAGE_NAME: $BASE_IMAGE_NAME/migrate
|
|
|
|
# webhook-backend-deploy:
|
|
# <<: *webhook-config
|
|
# stage: deploy
|
|
# variables:
|
|
# WEBHOOK_URL: $WEBHOOK_URL_BACKEND
|
|
# environment:
|
|
# name: staging
|
|
# url: https://datarush.itqdev.xyz
|
|
# resource_group: staging
|
|
# dependencies:
|
|
# - build-runtime
|
|
# - sast-image-runtime
|
|
|
|
workflow:
|
|
rules:
|
|
- if: $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH
|
|
- if: $CI_PIPELINE_SOURCE == "merge_request_event"
|
|
- if: $CI_COMMIT_TAG
|