fix gitlab-ci

build/composer-bedrock-8.3.yml

@@ -1,28 +0,0 @@
-composer-build:
-    stage: build
-    image: $CI_REGISTRY/ldc-web/projets/ldc-web-images-docker/ldcweb-qa-8.3:latest
-    before_script:
-        - composer config gitlab-token.lab.s-web.fr $CI_DEPLOY_USER $CI_DEPLOY_PASSWORD
-        - composer config http-basic.connect.advancedcustomfields.com $APP_ACF_USER $APP_ACF_PWD
-    cache:
-        paths:
-            - vendor/
-            - public/
-
-
-    script:
-        - composer install --no-dev --optimize-autoloader --classmap-authoritative
-    artifacts:
-      expose_as: 'composer-build'
-      paths:
-          - vendor
-          - public
-    allow_failure: false
-    dependencies:
-        - composer-security
-    needs:
-        - job: composer-security
-          optional: true
-    rules:
-        - if: $CI_COMMIT_BRANCH == "trunk" || $CI_COMMIT_BRANCH == "master" || $CI_COMMIT_BRANCH == "main"
-        - if: $CI_COMMIT_TAG != null

build/composer-bedrock.yml

@@ -24,5 +24,6 @@ composer-build:
         - job: composer-security
           optional: true
     rules:
+        - if: $CI_PIPELINE_SOURCE == "merge_request_event"
         - if: $CI_COMMIT_BRANCH == "trunk" || $CI_COMMIT_BRANCH == "master" || $CI_COMMIT_BRANCH == "main"
         - if: $CI_COMMIT_TAG != null

build/composer.yml

@@ -1,27 +1,24 @@
 composer-build:
     stage: build
-    image: composer:2.10
-    cache:
-        key:
-            files:
-                - composer.lock
-        paths:
-            - vendor/
-        policy: pull-push
+    image: $CI_REGISTRY/ldc-web/projets/ldc-web-images-docker/ldcweb-qa-8.2:latest
     before_script:
-        - composer config gitlab-token.lab.s-web.fr "${CI_DEPLOY_USER}" "${CI_DEPLOY_PASSWORD}"
-    script:
-        - composer install --ignore-platform-reqs --no-interaction --no-plugins --no-scripts --no-dev --prefer-dist
-    artifacts:
+        - composer config gitlab-token.lab.s-web.fr $CI_DEPLOY_USER $CI_DEPLOY_PASSWORD
+    cache:
         paths:
             - vendor/
-        expire_in: 1h
+    script:
+        - composer install --no-dev --optimize-autoloader --classmap-authoritative --no-scripts
+    artifacts:
+      expose_as: 'vendor'
+      paths:
+          - vendor
+    allow_failure: false
     dependencies:
         - composer-security
     needs:
         - job: composer-security
           optional: true
-    allow_failure: false
     rules:
+        - if: $CI_PIPELINE_SOURCE == "merge_request_event"
         - if: $CI_COMMIT_BRANCH == "trunk" || $CI_COMMIT_BRANCH == "master" || $CI_COMMIT_BRANCH == "main"
-        - if: $CI_COMMIT_TAG != null
+        - if: $CI_COMMIT_TAG != null

build/composer7.3.yml

@@ -1,23 +1,24 @@
 composer-build:
     stage: build
-    image: composer:2.9.7
+    image: $CI_REGISTRY/ldc-web/projets/ldc-web-images-docker/ldcweb-qa:php7.3-1.0
     before_script:
         - composer config gitlab-token.lab.s-web.fr $CI_DEPLOY_USER $CI_DEPLOY_PASSWORD
     cache:
         paths:
             - vendor/
     script:
-        - composer install --no-dev --optimize-autoloader --classmap-authoritative --no-scripts --ignore-platform-reqs
+        - composer install --no-dev --optimize-autoloader --classmap-authoritative --no-scripts
     artifacts:
       expose_as: 'vendor'
       paths:
           - vendor
-    allow_failure: true
+    allow_failure: false
     dependencies:
         - composer-security
     needs:
         - job: composer-security
           optional: true
     rules:
+        - if: $CI_PIPELINE_SOURCE == "merge_request_event"
         - if: $CI_COMMIT_BRANCH == "trunk" || $CI_COMMIT_BRANCH == "master" || $CI_COMMIT_BRANCH == "main"
-        - if: $CI_COMMIT_TAG != null
+        - if: $CI_COMMIT_TAG != null

build/docker-bedrock-multistage.yml

@@ -1,51 +0,0 @@
-.docker-build:
-    stage: build
-    image:
-        name: gcr.io/kaniko-project/executor:v1.23.2-debug
-        entrypoint: [""]
-    script:
-        - /kaniko/executor
-            --context "${CI_PROJECT_DIR}"
-            --build-arg "GITLAB_USER=${CI_DEPLOY_USER}"
-            --build-arg "GITLAB_PASSWORD=${CI_DEPLOY_PASSWORD}"
-            --build-arg "APP_ACF_USER=${APP_ACF_USER}"
-            --build-arg "APP_ACF_PWD=${APP_ACF_PWD}"
-            --dockerfile "${CI_PROJECT_DIR}/Dockerfile"
-            --destination "${IMAGE_TAG}"
-            --cache=true
-            --cache-ttl 24h
-    allow_failure: false
-    dependencies:
-        - composer-security
-        - npm-security
-    needs:
-        - job: composer-security
-          optional: true
-        - job: npm-security
-          optional: true
-
-docker-build:staging:
-    extends: .docker-build
-    variables:
-        IMAGE_TAG: "${CI_REGISTRY_IMAGE}:s-${CI_COMMIT_SHA}"
-    rules:
-        - if: $CI_COMMIT_BRANCH == "trunk"
-          allow_failure: true
-
-
-docker-build:latest:
-    extends: .docker-build
-    variables:
-        IMAGE_TAG: "${CI_REGISTRY_IMAGE}:p-${CI_COMMIT_SHA}"
-    rules:
-        - if: $CI_COMMIT_BRANCH == "main" || $CI_COMMIT_BRANCH == "master"
-          allow_failure: true
-
-
-docker-build:release:
-    extends: .docker-build
-    variables:
-        IMAGE_TAG: "${CI_REGISTRY_IMAGE}:${CI_COMMIT_TAG}"
-    rules:
-        - if: $CI_COMMIT_TAG != null
-          allow_failure: true

build/docker-bedrock.yml

@@ -15,6 +15,15 @@
         - job: composer-build
           optional: true
 
+
+docker-build:review:
+    extends: .docker-build
+    variables:
+        IMAGE_TAG: "${CI_REGISTRY_IMAGE}:review-${CI_MERGE_REQUEST_IID}"
+    rules:
+        - if: $CI_PIPELINE_SOURCE == "merge_request_event"
+
+
 docker-build:staging:
     extends: .docker-build
     variables:

build/docker-multistage.yml

@@ -1,50 +0,0 @@
-.docker-build:
-    stage: build
-    image:
-        name: gcr.io/kaniko-project/executor:v1.23.2-debug
-        entrypoint: [""]
-    script:
-        - /kaniko/executor
-            --context "${CI_PROJECT_DIR}"
-            --build-arg "GITLAB_USER=${CI_DEPLOY_USER}"
-            --build-arg "GITLAB_PASSWORD=${CI_DEPLOY_PASSWORD}"
-            --build-arg "PHP_8_5_TAG=${PHP_8_5_TAG}"
-            --dockerfile "${CI_PROJECT_DIR}/Dockerfile"
-            --destination "${IMAGE_TAG}"
-            --cache=true
-            --cache-ttl 24h
-    allow_failure: false
-    dependencies:
-        - composer-security
-        - npm-security
-    needs:
-        - job: composer-security
-          optional: true
-        - job: npm-security
-          optional: true
-
-docker-build:staging:
-    extends: .docker-build
-    variables:
-        IMAGE_TAG: "${CI_REGISTRY_IMAGE}:s-${CI_COMMIT_SHA}"
-    rules:
-        - if: $CI_COMMIT_BRANCH == "trunk"
-          allow_failure: true
-
-
-docker-build:latest:
-    extends: .docker-build
-    variables:
-        IMAGE_TAG: "${CI_REGISTRY_IMAGE}:p-${CI_COMMIT_SHA}"
-    rules:
-        - if: $CI_COMMIT_BRANCH == "main" || $CI_COMMIT_BRANCH == "master"
-          allow_failure: true
-
-
-docker-build:release:
-    extends: .docker-build
-    variables:
-        IMAGE_TAG: "${CI_REGISTRY_IMAGE}:${CI_COMMIT_TAG}"
-    rules:
-        - if: $CI_COMMIT_TAG != null
-          allow_failure: true

build/docker.yml

@@ -18,14 +18,21 @@
         - job: composer-build
           optional: true
 
+
+docker-build:review:
+    extends: .docker-build
+    variables:
+        IMAGE_TAG: "${CI_REGISTRY_IMAGE}:review-${CI_MERGE_REQUEST_IID}"
+    rules:
+        - if: $CI_PIPELINE_SOURCE == "merge_request_event"
+
+
 docker-build:staging:
     extends: .docker-build
     variables:
         IMAGE_TAG: "${CI_REGISTRY_IMAGE}:s-${CI_COMMIT_SHA}"
     rules:
         - if: $CI_COMMIT_BRANCH == "trunk"
-          when: manual
-          allow_failure: true
 
 
 docker-build:latest:
@@ -34,8 +41,6 @@ docker-build:latest:
         IMAGE_TAG: "${CI_REGISTRY_IMAGE}:p-${CI_COMMIT_SHA}"
     rules:
         - if: $CI_COMMIT_BRANCH == "main" || $CI_COMMIT_BRANCH == "master"
-          when: manual
-          allow_failure: true
 
 
 docker-build:release:
@@ -43,6 +48,4 @@ docker-build:release:
     variables:
         IMAGE_TAG: "${CI_REGISTRY_IMAGE}:${CI_COMMIT_TAG}"
     rules:
-        - if: $CI_COMMIT_TAG != null
-          when: manual
-          allow_failure: true
+        - if: $CI_COMMIT_TAG != null

build/npm.yml

@@ -1,11 +1,9 @@
 npm-build:
     stage: build
-    image: node:24
+    image: node:18
     before_script:
         - npm config set @ldc-web:registry https://${CI_SERVER_HOST}/api/v4/packages/npm/
         - npm config set -- '//${CI_SERVER_HOST}/api/v4/packages/npm/:_authToken' "${CI_DEPLOY_PASSWORD}"
-        - npm config set @uwil:registry=https://lab.s-web.fr/api/v4/groups/ldc-web/-/packages/npm/
-        - npm config set -- '//${CI_SERVER_HOST}/api/v4/groups/ldc-web/-/packages/npm/:_authToken' "${CI_DEPLOY_PASSWORD}"
         - npm install
     cache:
         paths:
@@ -23,5 +21,6 @@ npm-build:
         - job: npm-security
           optional: true
     rules:
+        - if: $CI_PIPELINE_SOURCE == "merge_request_event"
         - if: $CI_COMMIT_BRANCH == "trunk" || $CI_COMMIT_BRANCH == "master" || $CI_COMMIT_BRANCH == "main"
         - if: $CI_COMMIT_TAG != null

deploy/kubernetes.yml

@@ -1,17 +1,11 @@
-variables:
-    KUBERNETES_CLUSTER_NAME: prod-k8s-ldc-web
-    KUBERNETES_VERSION: 1.29.2
-
 .kubernetes:
     stage: deploy
     image:
-        name: "alpine/k8s:${KUBERNETES_VERSION}"
+        name: alpine/k8s:1.26.0
         entrypoint: ['']
     variables:
-        KUBE_CONTEXT: "ldc-web/cluster-k8s:${KUBERNETES_CLUSTER_NAME}"
+        KUBE_CONTEXT: ldc-web/cluster-k8s:k8s-ldc-web
         KUBE_NAMESPACE: default
-        CRT_TLS_NAME: "wildcard-k8s-ldc"
-        REDIRECT:
     before_script:
         - kubectl config use-context ${KUBE_CONTEXT}
     script:
@@ -25,31 +19,34 @@ variables:
     environment:
         action: stop
 
+kubernetes:review:
+    extends: .kubernetes
+    variables:
+        KUBE_NAMESPACE: review
+        IMAGE_TAG: "${CI_REGISTRY_IMAGE}:review-${CI_MERGE_REQUEST_IID}"
+    needs:
+        - job: docker-build:review
+    rules:
+        - if: $CI_PIPELINE_SOURCE == "merge_request_event"
+    when: manual
+    environment:
+        name: review/${CI_MERGE_REQUEST_IID}
+        url: https://${DOMAIN}
+        on_stop: kubernetes_stop:review
 
-# kubernetes:review:
-#    extends: .kubernetes
-#    variables:
-#        KUBE_NAMESPACE: review
-#        IMAGE_TAG: "${CI_REGISTRY_IMAGE}:review-${CI_MERGE_REQUEST_IID}"
-#    needs:
-#        - job: docker-build:review
-#    rules:
-#        - if: $CI_PIPELINE_SOURCE == "merge_request_event"
-#    when: manual
-#    environment:
-#        name: review/${CI_MERGE_REQUEST_IID}
-#        url: https://${DOMAIN}
-#        on_stop: kubernetes_stop:review
-
-# kubernetes_stop:review:
-#    extends: .kubernetes_stop
-#    variables:
-#        KUBE_NAMESPACE: review
-#    rules:
-#        - if: $CI_PIPELINE_SOURCE == "merge_request_event"
-#    environment:
-#        name: review/${CI_MERGE_REQUEST_IID}
+kubernetes_upgrade:review:
+    extends: kubernetes:review
+    script:
+        - envsubst < manifest.yaml | kubectl set image --namespace ${KUBE_NAMESPACE} -f - ${CI_REGISTRY_IMAGE}=${IMAGE_TAG}
 
+kubernetes_stop:review:
+    extends: .kubernetes_stop
+    variables:
+        KUBE_NAMESPACE: review
+    rules:
+        - if: $CI_PIPELINE_SOURCE == "merge_request_event"
+    environment:
+        name: review/${CI_MERGE_REQUEST_IID}
 
 kubernetes:staging:
     extends: .kubernetes
@@ -60,15 +57,17 @@ kubernetes:staging:
         - job: docker-build:staging
     rules:
         - if: $CI_COMMIT_BRANCH == "trunk"
-    script:
-        - envsubst < manifest.yaml | kubectl apply --namespace ${KUBE_NAMESPACE} -f -
-        - envsubst < staging-resources.yaml | kubectl apply --namespace ${KUBE_NAMESPACE} -f -
     when: manual
     environment:
         name: staging
         url: https://${DOMAIN}
         on_stop: kubernetes_stop:staging
 
+kubernetes_upgrade:staging:
+    extends: kubernetes:staging
+    script:
+        - envsubst < manifest.yaml | kubectl set image --namespace ${KUBE_NAMESPACE} -f - ${CI_REGISTRY_IMAGE}=${IMAGE_TAG}
+
 kubernetes_stop:staging:
     extends: .kubernetes_stop
     variables:
@@ -78,21 +77,15 @@ kubernetes_stop:staging:
     environment:
         name: staging
 
-
 kubernetes:prod:
     extends: .kubernetes
     variables:
         KUBE_NAMESPACE: production
         IMAGE_TAG: "${CI_REGISTRY_IMAGE}:p-${CI_COMMIT_SHA}"
-        CRT_TLS_NAME: "${APP_DOMAIN}"
-        REDIRECT: "www."
     needs:
         - job: docker-build:latest
     rules:
         - if: $CI_COMMIT_BRANCH == "main" || $CI_COMMIT_BRANCH == "master"
-    script:
-        - envsubst < manifest.yaml | kubectl apply --namespace ${KUBE_NAMESPACE} -f -
-        - envsubst < production-resources.yaml | kubectl apply --namespace ${KUBE_NAMESPACE} -f -
     when: manual
     environment:
         name: production
@@ -107,3 +100,8 @@ kubernetes:prod:
 #        - if: $CI_COMMIT_BRANCH == "main" || $CI_COMMIT_BRANCH == "master"
 #    environment:
 #        name: production
+
+kubernetes_upgrade:prod:
+    extends: kubernetes:prod
+    script:
+        - envsubst < manifest.yaml | kubectl set image --namespace ${KUBE_NAMESPACE} -f - ${CI_REGISTRY_IMAGE}=${IMAGE_TAG}

lint/eslint.yml

@@ -1,11 +1,9 @@
 eslint:
     stage: lint
-    image: node:24
+    image: node:18
     before_script:
         - npm config set @ldc-web:registry https://${CI_SERVER_HOST}/api/v4/packages/npm/
         - npm config set -- '//${CI_SERVER_HOST}/api/v4/packages/npm/:_authToken' "${CI_DEPLOY_PASSWORD}"
-        - npm config set @uwil:registry=https://lab.s-web.fr/api/v4/groups/ldc-web/-/packages/npm/
-        - npm config set -- '//${CI_SERVER_HOST}/api/v4/groups/ldc-web/-/packages/npm/:_authToken' "${CI_DEPLOY_PASSWORD}"
         - npm install
     cache:
         paths:

lint/lint.yml

@@ -1,22 +1,3 @@
-spec:
-  inputs:
-    larastan_bootstrap:
-      default: false
-      type: boolean
-    db_connection:
-      default: "sqlite"
-    db_database:
-      default: ":memory:"
-    cache_store:
-      default: "array"
-    session_driver:
-      default: "array"
-    enable_rector:
-      default: false
-      type: boolean
-
----
-
 include:
   - project: 'ldc-web/shared-ci'
     ref: 'main'
@@ -24,17 +5,6 @@ include:
   - project: 'ldc-web/shared-ci'
     ref: 'main'
     file: 'lint/phpstan.yml'
-    inputs:
-      larastan_bootstrap: $[[ inputs.larastan_bootstrap ]]
-      db_connection: $[[ inputs.db_connection ]]
-      db_database: $[[ inputs.db_database ]]
-      cache_store: $[[ inputs.cache_store ]]
-      session_driver: $[[ inputs.session_driver ]]
-  - project: "ldc-web/shared-ci"
-    ref: "main"
-    file: "lint/rector.yml"
-    inputs:
-      enable_rector: $[[ inputs.enable_rector ]]
   - project: 'ldc-web/shared-ci'
     ref: 'main'
     file: 'lint/eslint.yml'

lint/phpcs.yml

@@ -1,6 +1,6 @@
 phpcs:
     stage: lint
-    image: composer:2.10
+    image: $CI_REGISTRY/ldc-web/projets/ldc-web-images-docker/ldcweb-qa-8.2:latest
     before_script:
         - composer config gitlab-token.lab.s-web.fr $CI_DEPLOY_USER $CI_DEPLOY_PASSWORD
         - composer install --no-scripts

lint/phpstan.yml

@@ -1,40 +1,9 @@
-spec:
-  inputs:
-    larastan_bootstrap:
-      default: false
-      type: boolean
-    db_connection:
-      default: "sqlite"
-    db_database:
-      default: ":memory:"
-    cache_store:
-      default: "array"
-    session_driver:
-      default: "array"
-
----
-
 phpstan:
     stage: lint
-    image: composer:2.10
-    cache:
-      key: phpstan-cache-${CI_COMMIT_REF_SLUG}
-      paths:
-          - vendor/
-          - .phpstan-cache/
-    variables:
-        DB_CONNECTION: "$[[ inputs.db_connection ]]"
-        DB_DATABASE: "$[[ inputs.db_database ]]"
-        CACHE_STORE: "$[[ inputs.cache_store ]]"
-        SESSION_DRIVER: "$[[ inputs.session_driver ]]"
+    image: $CI_REGISTRY/ldc-web/projets/ldc-web-images-docker/ldcweb-qa-8.2:latest
     before_script:
         - composer config gitlab-token.lab.s-web.fr $CI_DEPLOY_USER $CI_DEPLOY_PASSWORD
-        - composer install --no-scripts --no-interaction
-        - |
-          if [ "$[[ inputs.larastan_bootstrap ]]" = "true" ]; then
-            cp .env.example .env
-            php artisan key:generate
-          fi
+        - composer install --no-scripts
     script:
         - vendor/bin/phpstan --error-format=junit > phpstan-report.xml
     artifacts:

lint/rector.yml

@@ -1,31 +0,0 @@
-spec:
-  inputs:
-    enable_rector:
-      default: false
-      type: boolean
-
----
-
-rector:
-    stage: lint
-    image: composer:2.10
-    cache:
-      key: rector-cache-$CI_COMMIT_REF_SLUG
-      paths:
-        - vendor/
-        - .rector-cache/
-    before_script:
-        - composer config gitlab-token.lab.s-web.fr $CI_DEPLOY_USER $CI_DEPLOY_PASSWORD
-        - composer install --no-scripts --no-interaction
-    script:
-        - vendor/bin/rector process --dry-run --no-progress-bar --output-format=junit > rector-report.xml
-    artifacts:
-      when: always
-      expose_as: 'rector'
-      paths:
-          - rector-report.xml
-      reports:
-        junit: rector-report.xml
-    allow_failure: true
-    rules:
-        - if: '$CI_PIPELINE_SOURCE == "merge_request_event" && "$[[ inputs.enable_rector ]]" == "true"'

lint/stylelint.yml

@@ -1,11 +1,9 @@
 stylelint:
     stage: lint
-    image: node:24
+    image: node:18
     before_script:
         - npm config set @ldc-web:registry https://${CI_SERVER_HOST}/api/v4/packages/npm/
         - npm config set -- '//${CI_SERVER_HOST}/api/v4/packages/npm/:_authToken' "${CI_DEPLOY_PASSWORD}"
-        - npm config set @uwil:registry=https://lab.s-web.fr/api/v4/groups/ldc-web/-/packages/npm/
-        - npm config set -- '//${CI_SERVER_HOST}/api/v4/groups/ldc-web/-/packages/npm/:_authToken' "${CI_DEPLOY_PASSWORD}"
         - npm install
     cache:
         paths:
@@ -20,4 +18,4 @@ stylelint:
     allow_failure: false
     rules:
         - if: $CI_PIPELINE_SOURCE == "merge_request_event"
-        - if: $CI_COMMIT_BRANCH == "develop"
+        - if: $CI_COMMIT_BRANCH == "develop"

security/composer.yml

@@ -1,10 +1,8 @@
 composer-security:
     stage: security
-    image: composer:2.10
-    before_script:
-        - composer config gitlab-token.lab.s-web.fr $CI_DEPLOY_USER $CI_DEPLOY_PASSWORD
+    image: $CI_REGISTRY/ldc-web/projets/ldc-web-images-docker/ldcweb-qa-8.2:latest
     script:
-        - composer audit --locked --format=json > composer-security-checker-report.json || true
+        - local-php-security-checker --format=json --path=./composer.lock > composer-security-checker-report.json
     artifacts:
         when: on_failure
         expose_as: 'composer-security-checker'

security/npm.yml

@@ -1,6 +1,6 @@
 npm-security:
     stage: security
-    image: node:24
+    image: node:17.9.1
     before_script: 
         - npm install --location=global audit-ci@^6
     script: