diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml index edc9a3d2f5efb09cd38717de0527d50d1b8e6413..abc82fcc0a45d64fdab21e5dd0f36fea83ae085f 100644 --- a/.gitlab-ci.yml +++ b/.gitlab-ci.yml @@ -1,16 +1,20 @@ image: golang:1.15 include: + - template: Security/Dependency-Scanning.gitlab-ci.yml + - template: Security/License-Scanning.gitlab-ci.yml - template: Security/SAST.gitlab-ci.yml - - template: 'Workflows/MergeRequest-Pipelines.gitlab-ci.yml' + - template: Security/Secret-Detection.gitlab-ci.yml + - template: "Workflows/MergeRequest-Pipelines.gitlab-ci.yml" variables: REPO_NAME: gitlab.com/gitlab-org/labkit GO_SEMANTIC_RELEASE_VERSION: 2.12.0 + DS_DEFAULT_ANALYZERS: "gemnasium" stages: - build - - verify + - test - release build_1.13: @@ -32,58 +36,50 @@ build_1.15: - ./compile.sh test_1.13: - stage: verify + stage: test image: golang:1.13 script: - ./test.sh test_1.14: - stage: verify + stage: test image: golang:1.14 script: - ./test.sh test_1.15: - stage: verify + stage: test image: golang:1.15 script: - ./test.sh -# The verify step should always use the same version of Go as devs are -# likely to be developing with to avoid issues with changes in these tools -# between go versions. Since these are simply linter warnings and not -# compiler issues, we only need a single version - -sast: - stage: verify - # Ensure that all the changes are backwards compatible with GitLab Workhorse backwards_compat_workhorse: - stage: verify + stage: test script: - ./backwords_compat.sh https://gitlab.com/gitlab-org/gitlab-workhorse.git # Ensure that all the changes are backwards compatible with GitLab Workhorse backwards_compat_gitaly: - stage: verify + stage: test image: registry.gitlab.com/gitlab-org/gitlab-build-images:ruby-2.7-golang-1.15-git-2.29 script: - ./backwords_compat.sh https://gitlab.com/gitlab-org/gitaly.git # Ensure that all the changes are backwards compatible with GitLab Container Registry backwards_compat_container_registry: - stage: verify + stage: test script: - ./backwords_compat.sh https://gitlab.com/gitlab-org/container-registry.git mod tidy: - stage: verify + stage: test script: - ./tidy.sh lint: image: registry.gitlab.com/gitlab-org/gitlab-build-images:golangci-lint-alpine - stage: verify + stage: test script: - ./lint.sh artifacts: @@ -93,15 +89,31 @@ lint: - gl-code-quality-report.json commitlint: - stage: verify + stage: test image: node:14-alpine3.12 before_script: - - apk add --no-cache git - - npm install + - apk add --no-cache git + - npm install script: - - npx commitlint --from ${CI_MERGE_REQUEST_TARGET_BRANCH_SHA} --to HEAD --verbose + - npx commitlint --from ${CI_MERGE_REQUEST_TARGET_BRANCH_SHA} --to HEAD --verbose rules: - - if: $CI_MERGE_REQUEST_IID + - if: $CI_MERGE_REQUEST_IID + +# The test step should always use the same version of Go as devs are +# likely to be developing with to avoid issues with changes in these tools +# between go versions. Since these are simply linter warnings and not +# compiler issues, we only need a single version +sast: + stage: test + +dependency_scanning: + stage: test + +license_scanning: + stage: test + +secret_detection: + stage: test release: image: node:12