From e81737ba82f246a3e063b9ceb4eb57abcd56c839 Mon Sep 17 00:00:00 2001 From: Administrator Date: Fri, 17 Feb 2023 12:19:49 +0000 Subject: [PATCH] Update 8 files - /security/npm.yml - /security/composer.yml - /security/security.yml - /test/test.yml - /build/composer.yml - /build/npm.yml - /build/docker.yml - /build/build.yml --- build/build.yml | 10 ++++++++++ build/composer.yml | 20 ++++++++++++++++++++ build/docker.yml | 35 +++++++++++++++++++++++++++++++++++ build/npm.yml | 20 ++++++++++++++++++++ security/composer.yml | 14 ++++++++++++++ security/npm.yml | 16 ++++++++++++++++ security/security.yml | 7 +++++++ test/test.yml | 1 - 8 files changed, 122 insertions(+), 1 deletion(-) create mode 100644 build/build.yml create mode 100644 build/composer.yml create mode 100644 build/docker.yml create mode 100644 build/npm.yml create mode 100644 security/composer.yml create mode 100644 security/npm.yml create mode 100644 security/security.yml diff --git a/build/build.yml b/build/build.yml new file mode 100644 index 0000000..0f5c78f --- /dev/null +++ b/build/build.yml @@ -0,0 +1,10 @@ +include: + - project: 'ldc-web/shared-ci' + ref: 'main' + file: 'build/composer.yml' + - project: 'ldc-web/shared-ci' + ref: 'main' + file: 'build/npm.yml' + - project: 'ldc-web/shared-ci' + ref: 'main' + file: 'build/docker.yml' \ No newline at end of file diff --git a/build/composer.yml b/build/composer.yml new file mode 100644 index 0000000..57615ea --- /dev/null +++ b/build/composer.yml @@ -0,0 +1,20 @@ +composer-build: + stage: build + image: $CI_REGISTRY/ldc-web/projets/ldc-web-images-docker/ldcweb-qa:php8.1-1.0 + before_script: + - composer config gitlab-token.lab.s-web.fr $CI_DEPLOY_USER $CI_DEPLOY_PASSWORD + cache: + paths: + - vendor/ + script: + - composer install --no-dev --optimize-autoloader --classmap-authoritative + artifacts: + expose_as: 'vendor' + paths: + - vendor + allow_failure: false + needs: + - phpcs + rules: + - if: $CI_PIPELINE_SOURCE == "merge_request_event" + - if: $CI_COMMIT_BRANCH == "develop" \ No newline at end of file diff --git a/build/docker.yml b/build/docker.yml new file mode 100644 index 0000000..2cf1370 --- /dev/null +++ b/build/docker.yml @@ -0,0 +1,35 @@ +.docker-build: + stage: build + image: + name: gcr.io/kaniko-project/executor:v1.9.0-debug + entrypoint: [""] + script: + - /kaniko/executor + --context "${CI_PROJECT_DIR}" + --dockerfile "${CI_PROJECT_DIR}/Dockerfile" + --destination "${IMAGE_TAG}" + allow_failure: false + dependencies: + - npm-build + - composer-build + needs: + - job: npm-build + optional: true + - job: composer-build + optional: true + + +docker-build:develop: + extends: .docker-build + variables: + IMAGE_TAG: $CI_REGISTRY_IMAGE/develop:$CI_COMMIT_SHORT_SHA + rules: + - if: $CI_COMMIT_BRANCH == "develop" + + +docker-build:review: + extends: .docker-build + variables: + IMAGE_TAG: $CI_REGISTRY_IMAGE/review:$CI_MERGE_REQUEST_IID + rules: + - if: $CI_PIPELINE_SOURCE == "merge_request_event" \ No newline at end of file diff --git a/build/npm.yml b/build/npm.yml new file mode 100644 index 0000000..9af15b2 --- /dev/null +++ b/build/npm.yml @@ -0,0 +1,20 @@ +npm-build: + stage: build + image: node:17.9.1 + before_script: + - npm install + cache: + paths: + - public/build/ + script: + - npm run prod + artifacts: + expose_as: 'front-build' + paths: + - public/build + allow_failure: false + needs: + - front-build-test + rules: + - if: $CI_PIPELINE_SOURCE == "merge_request_event" + - if: $CI_COMMIT_BRANCH == "develop" diff --git a/security/composer.yml b/security/composer.yml new file mode 100644 index 0000000..80dfd4a --- /dev/null +++ b/security/composer.yml @@ -0,0 +1,14 @@ +composer-security: + stage: security + image: $CI_REGISTRY/ldc-web/projets/ldc-web-images-docker/ldcweb-qa:php8.1-1.0 + script: + - local-php-security-checker --format=json --path=./composer.lock > composer-security-checker-report.json + artifacts: + when: on_failure + expose_as: 'composer-security-checker' + paths: + - composer-security-checker-report.json + allow_failure: true + rules: + - if: $CI_PIPELINE_SOURCE == "merge_request_event" + - if: $CI_COMMIT_BRANCH == "develop" \ No newline at end of file diff --git a/security/npm.yml b/security/npm.yml new file mode 100644 index 0000000..24d5b1b --- /dev/null +++ b/security/npm.yml @@ -0,0 +1,16 @@ +npm-security: + stage: security + image: node:17.9.1 + before_script: + - npm install --location=global audit-ci@^6 + script: + - audit-ci -p npm -o json > npm-security-checker-report.json + artifacts: + when: on_failure + expose_as: 'npm-security-checker' + paths: + - npm-security-checker-report.json + allow_failure: true + rules: + - if: $CI_PIPELINE_SOURCE == "merge_request_event" + - if: $CI_COMMIT_BRANCH == "develop" \ No newline at end of file diff --git a/security/security.yml b/security/security.yml new file mode 100644 index 0000000..e23d7de --- /dev/null +++ b/security/security.yml @@ -0,0 +1,7 @@ +include: + - project: 'ldc-web/shared-ci' + ref: 'main' + file: 'security/composer.yml' + - project: 'ldc-web/shared-ci' + ref: 'main' + file: 'security/npm.yml' \ No newline at end of file diff --git a/test/test.yml b/test/test.yml index e020bb9..233f92b 100644 --- a/test/test.yml +++ b/test/test.yml @@ -1,4 +1,3 @@ include: - template: Security/Secret-Detection.gitlab-ci.yml - - template: Security/Dependency-Scanning.gitlab-ci.yml - template: Security/Container-Scanning.gitlab-ci.yml