89 lines
1.9 KiB
YAML
89 lines
1.9 KiB
YAML
include:
|
|
- template: Security/Dependency-Scanning.gitlab-ci.yml
|
|
- template: Security/SAST.gitlab-ci.yml
|
|
- template: Security/Secret-Detection.gitlab-ci.yml
|
|
- template: Security/Container-Scanning.gitlab-ci.yml
|
|
|
|
variables:
|
|
# Use TLS https://docs.gitlab.com/ee/ci/docker/using_docker_build.html#tls-enabled
|
|
DOCKER_HOST: tcp://docker:2376
|
|
DOCKER_TLS_CERTDIR: "/certs"
|
|
CONTAINER_TEST_IMAGE: $CI_REGISTRY_IMAGE:$CI_COMMIT_REF_SLUG
|
|
CONTAINER_RELEASE_IMAGE: $CI_REGISTRY_IMAGE:latest
|
|
|
|
container_scanning:
|
|
variables:
|
|
CS_DEFAULT_BRANCH_IMAGE: $CI_REGISTRY_IMAGE/$CI_DEFAULT_BRANCH:$CI_COMMIT_SHA
|
|
|
|
image: golang:latest
|
|
|
|
stages:
|
|
- test
|
|
- build
|
|
- release
|
|
|
|
go:format:
|
|
stage: test
|
|
script:
|
|
- go fmt $(go list ./...)
|
|
|
|
go:vet:
|
|
stage: test
|
|
script:
|
|
- go vet $(go list ./...)
|
|
|
|
go:test:
|
|
stage: test
|
|
script:
|
|
- go test -race $(go list ./...)
|
|
|
|
nix:test:
|
|
stage: test
|
|
image: nixos/nix
|
|
script:
|
|
- echo "experimental-features = nix-command flakes" >> /etc/nix/nix.conf
|
|
- nix flake check --all-systems
|
|
|
|
sast:
|
|
stage: test
|
|
|
|
nix:build:
|
|
stage: build
|
|
image: nixos/nix
|
|
script:
|
|
- echo "experimental-features = nix-command flakes" >> /etc/nix/nix.conf
|
|
- nix build
|
|
|
|
go:build:
|
|
stage: build
|
|
script:
|
|
- mkdir -p bin
|
|
- go build -v -o bin ./...
|
|
artifacts:
|
|
paths:
|
|
- bin
|
|
|
|
docker:build:
|
|
stage: build
|
|
image: docker:stable
|
|
services:
|
|
- docker:stable-dind
|
|
script:
|
|
- docker login -u $CI_REGISTRY_USER -p $CI_REGISTRY_PASSWORD $CI_REGISTRY
|
|
- docker build --pull -t $CONTAINER_TEST_IMAGE .
|
|
- docker push $CONTAINER_TEST_IMAGE
|
|
|
|
release:
|
|
stage: release
|
|
image: docker:stable
|
|
services:
|
|
- docker:stable-dind
|
|
script:
|
|
- docker login -u $CI_REGISTRY_USER -p $CI_REGISTRY_PASSWORD $CI_REGISTRY
|
|
- docker pull $CONTAINER_TEST_IMAGE
|
|
- docker tag $CONTAINER_TEST_IMAGE $CONTAINER_RELEASE_IMAGE
|
|
- docker push $CONTAINER_RELEASE_IMAGE
|
|
only:
|
|
- main
|
|
|