Commit 0c9ad514 authored by Andres Anaya Amariels's avatar Andres Anaya Amariels 🚀
Browse files

cvs grype

parent da26ae1a

capif/.gitlab-ci.yml

+1 −1
Original line number Diff line number Diff line
@@ -85,7 +85,7 @@ include: 
   file: 

#   - '/capif/templates/ci_staging.gitlab-ci.yml'

   - 'capif/templates/ci_dev.gitlab-ci.yml'

# - 'capif/templates/cd-deploy-ocf.gitlab-ci.yml'

   - 'capif/templates/cd-deploy-ocf.gitlab-ci.yml'





#ci_in_staging:

capif/templates/cd-deploy-ocf.gitlab-ci.yml

+21 −21
Original line number Diff line number Diff line
@@ -11,8 +11,8 @@ variables: 
  DOMAIN_STAGING: staging.int

  DOAMIN_DEV: developer.int

  CI_JOB_TOKEN: $CI_JOB_TOKEN

  IMAGE_TAG_DEV: "v0.0.1-$CI_COMMIT_SHA"

  IMAGE_TAG_STAGING: "v0.0.1-staging"

  IMAGE_TAG_DEV: $CI_COMMIT_REF_SLUG

  IMAGE_TAG_STAGING: $CI_COMMIT_REF_SLUG



.staging_common: &staging_common

  only:
@@ -38,10 +38,10 @@ deploy_ocf_staging: 
  rules:

    - if: $CI_COMMIT_BRANCH == "main"

      when: never

    - if: $CI_COMMIT_BRANCH

    - if: $CI_COMMIT_BRANCH == "staging"

  script:

    - echo "### git clone OCF repo ###" 

    - git clone https://oauth2:${CI_JOB_TOKEN}@labs.etsi.org/rep/ocf/capif.git

#    - echo "### git clone OCF repo ###" 

#    - git clone https://oauth2:${CI_JOB_TOKEN}@labs.etsi.org/rep/ocf/capif.git

    - echo "### install helm###"

    - curl -fsSL -o get_helm.sh https://raw.githubusercontent.com/helm/helm/main/scripts/get-helm-3

    - chmod 700 get_helm.sh
@@ -105,8 +105,8 @@ deploy_ocf_dev: 
      when: never      

    - if: $CI_COMMIT_BRANCH

  script:

    - echo "### git clone OCF repo ###" 

    - git clone https://oauth2:${CI_JOB_TOKEN}@labs.etsi.org/rep/ocf/capif.git

#    - echo "### git clone OCF repo###" 

#    - git clone https://oauth2:${CI_JOB_TOKEN}@labs.etsi.org/rep/ocf/capif.git

    - echo "### install helm###"

    - curl -fsSL -o get_helm.sh https://raw.githubusercontent.com/helm/helm/main/scripts/get-helm-3

    - chmod 700 get_helm.sh

capif/templates/ci_dev.gitlab-ci.yml

+7 −3
Original line number Diff line number Diff line 
stages:

  - dev_pulling_repo

#  - dev_pulling_repo

  - dev_secrets_in_repo

  - dev_linting_code

  - dev_linting_docker

  - dev_build_and_push



variables:

  GITLAB_API: "https://labs.etsi.org/api/v4"

  CI_JOB_TOKEN: $CI_JOB_TOKEN

  CI_DEBUG_TRACE: "false"

  CI_REGISTRY_USER: $CI_REGISTRY_USER

  CI_REGISTRY_PASSWORD: $CI_REGISTRY_PASSWORD

  CI_REGISTRY: $CI_REGISTRY

  CAPIF_DOCKER_REGISTRY: $CAPIF_DOCKER_REGISTRY
@@ -18,6 +16,12 @@ variables: 
.dev_common: &dev_common

  tags:

    - shell

  rules:

    - if: $CI_COMMIT_BRANCH == "main"

      when: never

    - if: $CI_COMMIT_BRANCH == "staging"

      when: never

    - if: $CI_COMMIT_BRANCH



#dev_pulling_repo:

#  stage: dev_pulling_repo

capif/templates/ci_staging.gitlab-ci.yml

+186 −26
Original line number Diff line number Diff line 
stages:

  - staging_pulling_repo

#  - staging_pulling_repo

  - staging_secrets_in_repo

  - staging_linting_code

  - staging_linting_docker

  - staging_cvs

  - staging_build_and_push



variables:

  GITLAB_API: "https://labs.etsi.org/api/v4"

  CI_JOB_TOKEN: $CI_JOB_TOKEN

  CI_DEBUG_TRACE: "false"

  CI_REGISTRY_USER: $CI_REGISTRY_USER

  CI_REGISTRY: $CI_REGISTRY

  CAPIF_DOCKER_REGISTRY: $CAPIF_DOCKER_REGISTRY



.staging_common: &staging_common

  only:
@@ -16,43 +21,198 @@ variables: 
      - $CI_MERGE_REQUEST_TARGET_BRANCH_NAME != "staging"

  tags:

    - shell

  rules:

    - if: $CI_COMMIT_BRANCH == "main"

      when: never

    - if: $CI_COMMIT_BRANCH == "staging"



staging_pulling_repo:

  stage: staging_pulling_repo

  script:

    - git clone https://oauth2:${CI_JOB_TOKEN}@labs.etsi.org/rep/ocf/capif.git

#staging_pulling_repo:

#  stage: staging_pulling_repo

#  script:

#    - git clone https://oauth2:${CI_JOB_TOKEN}@labs.etsi.org/rep/ocf/capif.git

#  <<: *staging_common



staging_secrets_in_repo:

  stage: staging_secrets_in_repo

  script:

    - pip install trufflehog

    - trufflehog capif --exclude_paths cicd/exclusions --max_depth=5

  needs: ["staging_pulling_repo"]

#  <<: *staging_common

    - |

      pip install trufflehog

      cd ../

      trufflehog capif --exclude_paths capif/cicd/exclusions --max_depth=5

#  needs: ["staging_pulling_repo"]

  <<: *staging_common



# define the process to do linting code: Sonarque, ruff?

staging_linting_code:

  stage: staging_linting_code

  script:

    - echo "ruff checks"

    - |

      echo "###ruff checks###"

      pip install ruff

      ruff check --config cicd/ruff.toml . || true

  needs: ["staging_secrets_in_repo"]

#  <<: *staging_common

  <<: *staging_common



staging_linting_docker:

  stage: staging_linting_docker

  image: hadolint/hadolint:latest-debian

  script:

   - find . -name 'capif/services/Dockerfile*' -exec hadolint --no-fail -f gitlab_codeclimate {} + > docker-lint.json

    - hadolint services/capif-client/Dockerfile

#    - hadolint services/nginx/Dockerfile

#    - hadolint services/register/Dockerfile

  artifacts:

    name: "$CI_JOB_NAME artifacts from $CI_PROJECT_NAME on $CI_COMMIT_REF_SLUG"

    when: always

    reports:

      codequality:

        - docker-lint.json

  interruptible: true    

   - |

    # Download hadolint binary

    wget https://github.com/hadolint/hadolint/releases/download/v2.8.0/hadolint-Linux-x86_64 -O hadolint



    # Make it executable

    chmod +x hadolint

    

    # Move it to your binaries folder

    mv hadolint ../

    

    # Verify the installation

    ../hadolint --version



    #find . -name 'services/Dockerfile*' -exec hadolint --no-fail -f gitlab_codeclimate {} + > docker-lint.json



    ../hadolint services/capif-client/Dockerfile || true

    ../hadolint services/vault/Dockerfile || true



    echo "### nginx ###"

    ../hadolint services/nginx/Dockerfile || true



    echo "### register ###"

    ../hadolint services/register/Dockerfile || true



    echo "### TS29222_CAPIF_Access_Control_Policy_API ###"

    ../hadolint services/TS29222_CAPIF_Access_Control_Policy_API/Dockerfile || true



    echo "### TS29222_CAPIF_API_Invoker_Management_API ###"

    ../hadolint services/TS29222_CAPIF_API_Invoker_Management_API/Dockerfile || true



    echo "### TS29222_CAPIF_API_Provider_Management_API ###"

    ../hadolint services/TS29222_CAPIF_API_Provider_Management_API/Dockerfile || true



    echo "### TS29222_CAPIF_Auditing_API ###"

    ../hadolint services/TS29222_CAPIF_Auditing_API/Dockerfile || true



    echo "### TS29222_CAPIF_Discover_Service_API ###"

    ../hadolint services/TS29222_CAPIF_Discover_Service_API/Dockerfile || true



    echo "### TS29222_CAPIF_Events_API ###"

    ../hadolint services/TS29222_CAPIF_Events_API/Dockerfile || true



    echo "### TS29222_CAPIF_Logging_API_Invocation_API ###"

    ../hadolint services/TS29222_CAPIF_Logging_API_Invocation_API/Dockerfile || true



    echo "### TS29222_CAPIF_Publish_Service_API ###"

    ../hadolint services/TS29222_CAPIF_Publish_Service_API/Dockerfile || true



    echo "### TS29222_CAPIF_Routing_Info_API ###"

    ../hadolint services/TS29222_CAPIF_Routing_Info_API/Dockerfile || true



    echo "### TS29222_CAPIF_Security_API ###"

    ../hadolint services/TS29222_CAPIF_Security_API/Dockerfile || true

#  artifacts:

#    name: "$CI_JOB_NAME artifacts from $CI_PROJECT_NAME on $CI_COMMIT_REF_SLUG"

#    when: always

#    reports:

#      codequality:

#        - docker-lint.json

#  interruptible: true    

  needs: ["staging_linting_code"]

#  <<: *staging_common
 
  <<: *staging_common





staging_cvs:

  needs: ["staging_linting_docker"]

  stage: staging_cvs

  script: 

   - curl -sSfL https://raw.githubusercontent.com/anchore/grype/main/install.sh | sh -s -- -b /usr/local/bin

   - export TMP_PWD=$PWD

   - echo "TMP_PWD=$TMP_PWD"

   - echo "### build and push capif-client image###"

   - cd services/capif-client/

   - docker login --username $CI_REGISTRY_USER --password $CAPIF_DOCKER_REGISTRY $CI_REGISTRY

   - docker build -t $CI_REGISTRY/ocf/capif/$CI_COMMIT_REF_SLUG/capif-client:$CI_COMMIT_REF_SLUG .

   - grype $CI_REGISTRY/ocf/capif/$CI_COMMIT_REF_SLUG/capif-client:$CI_COMMIT_REF_SLUG --scope all-layers

   - echo "----------------------------------------------------"



  <<: *staging_common    



staging_build_and_push:

  needs: ["staging_cvs"]

  stage: docker_login

  script:

   - export TMP_PWD=$PWD

   - echo "TMP_PWD=$TMP_PWD"

   - echo "### build and push capif-client image###"

   - cd services/capif-client/

   - docker login --username $CI_REGISTRY_USER --password $CAPIF_DOCKER_REGISTRY $CI_REGISTRY

   - docker build -t $CI_REGISTRY/ocf/capif/$CI_COMMIT_REF_SLUG/capif-client:$CI_COMMIT_REF_SLUG .

   - docker push $CI_REGISTRY/ocf/capif/$CI_COMMIT_REF_SLUG/capif-client:$CI_COMMIT_REF_SLUG

   - echo "----------------------------------------------------"

   - echo "### build and push nginx image###"

   - cd $TMP_PWD/services/nginx/

   - docker build -t $CI_REGISTRY/ocf/capif/$CI_COMMIT_REF_SLUG/nginx:$CI_COMMIT_REF_SLUG .

   - docker push $CI_REGISTRY/ocf/capif/$CI_COMMIT_REF_SLUG/nginx:$CI_COMMIT_REF_SLUG

   - echo "----------------------------------------------------"

   - echo "### build and push register image###"

   - cd $TMP_PWD/services/register/

   - docker build -t $CI_REGISTRY/ocf/capif/$CI_COMMIT_REF_SLUG/register:$CI_COMMIT_REF_SLUG .

   - docker push $CI_REGISTRY/ocf/capif/$CI_COMMIT_REF_SLUG/register:$CI_COMMIT_REF_SLUG

   - echo "----------------------------------------------------"

   - echo "### build and push TS29222_CAPIF_Access_Control_Policy_API image###"

   - cd $TMP_PWD/services/TS29222_CAPIF_Access_Control_Policy_API/

   - docker build -t $CI_REGISTRY/ocf/capif/$CI_COMMIT_REF_SLUG/ocf-access-control-policy-api:$CI_COMMIT_REF_SLUG .

   - docker push $CI_REGISTRY/ocf/capif/$CI_COMMIT_REF_SLUG/ocf-access-control-policy-api:$CI_COMMIT_REF_SLUG

   - echo "----------------------------------------------------"

   - echo "### build and push TS29222_CAPIF_API_Invoker_Management_API image###"

   - cd $TMP_PWD/services/TS29222_CAPIF_API_Invoker_Management_API/

   - docker build -t $CI_REGISTRY/ocf/capif/$CI_COMMIT_REF_SLUG/ocf-api-invoker-management-api:$CI_COMMIT_REF_SLUG .

   - docker push $CI_REGISTRY/ocf/capif/$CI_COMMIT_REF_SLUG/ocf-api-invoker-management-api:$CI_COMMIT_REF_SLUG

   - echo "----------------------------------------------------"

   - echo "### build and push TS29222_CAPIF_API_Provider_Management_API image###"

   - cd $TMP_PWD/services/TS29222_CAPIF_API_Provider_Management_API/

   - docker build -t $CI_REGISTRY/ocf/capif/$CI_COMMIT_REF_SLUG/ocf-api-provider-management-api:$CI_COMMIT_REF_SLUG .

   - docker push $CI_REGISTRY/ocf/capif/$CI_COMMIT_REF_SLUG/ocf-api-provider-management-api:$CI_COMMIT_REF_SLUG

   - echo "----------------------------------------------------"

   - echo "### build and push TS29222_CAPIF_Auditing_API image###"

   - cd $TMP_PWD/services/TS29222_CAPIF_Auditing_API/

   - docker build -t $CI_REGISTRY/ocf/capif/$CI_COMMIT_REF_SLUG/ocf-auditing-api:$CI_COMMIT_REF_SLUG .

   - docker push $CI_REGISTRY/ocf/capif/$CI_COMMIT_REF_SLUG/ocf-auditing-api:$CI_COMMIT_REF_SLUG

   - echo "----------------------------------------------------"

   - echo "### build and push TS29222_CAPIF_Discover_Service_API image###"

   - cd $TMP_PWD/services/TS29222_CAPIF_Discover_Service_API/

   - docker build -t $CI_REGISTRY/ocf/capif/$CI_COMMIT_REF_SLUG/ocf-discover-service-api:$CI_COMMIT_REF_SLUG .

   - docker push $CI_REGISTRY/ocf/capif/$CI_COMMIT_REF_SLUG/ocf-discover-service-api:$CI_COMMIT_REF_SLUG

   - echo "----------------------------------------------------"

   - echo "### build and push TS29222_CAPIF_Events_API image###"

   - cd $TMP_PWD/services/TS29222_CAPIF_Events_API/

   - docker build -t $CI_REGISTRY/ocf/capif/$CI_COMMIT_REF_SLUG/ocf-events-api:$CI_COMMIT_REF_SLUG .

   - docker push $CI_REGISTRY/ocf/capif/$CI_COMMIT_REF_SLUG/ocf-events-api:$CI_COMMIT_REF_SLUG

   - echo "----------------------------------------------------"

   - echo "### build and push TS29222_CAPIF_Logging_API_Invocation_API image###"

   - cd $TMP_PWD/services/TS29222_CAPIF_Logging_API_Invocation_API/

   - docker build -t $CI_REGISTRY/ocf/capif/$CI_COMMIT_REF_SLUG/ocf-logging-api-invocation-api:$CI_COMMIT_REF_SLUG .

   - docker push $CI_REGISTRY/ocf/capif/$CI_COMMIT_REF_SLUG/ocf-logging-api-invocation-api:$CI_COMMIT_REF_SLUG

   - echo "----------------------------------------------------"

   - echo "### build and push TS29222_CAPIF_Publish_Service_API image###"

   - cd $TMP_PWD/services/TS29222_CAPIF_Publish_Service_API/

   - docker build -t $CI_REGISTRY/ocf/capif/$CI_COMMIT_REF_SLUG/ocf-publish-service-api:$CI_COMMIT_REF_SLUG .

   - docker push $CI_REGISTRY/ocf/capif/$CI_COMMIT_REF_SLUG/ocf-publish-service-api:$CI_COMMIT_REF_SLUG

   - echo "----------------------------------------------------"

   - echo "### build and push TS29222_CAPIF_Routing_Info_API image###"

   - cd $TMP_PWD/services/TS29222_CAPIF_Routing_Info_API/

   - docker build -t $CI_REGISTRY/ocf/capif/$CI_COMMIT_REF_SLUG/ocf-routing-info-api:$CI_COMMIT_REF_SLUG .

   - docker push $CI_REGISTRY/ocf/capif/$CI_COMMIT_REF_SLUG/ocf-routing-info-api:$CI_COMMIT_REF_SLUG

   - echo "----------------------------------------------------"

   - echo "### build and push TS29222_CAPIF_Security_API image###"

   - cd $TMP_PWD/services/TS29222_CAPIF_Security_API/

   - docker build -t $CI_REGISTRY/ocf/capif/$CI_COMMIT_REF_SLUG/ocf-security-api:$CI_COMMIT_REF_SLUG .

   - docker push $CI_REGISTRY/ocf/capif/$CI_COMMIT_REF_SLUG/ocf-security-api:$CI_COMMIT_REF_SLUG

   - echo "----------------------------------------------------"

   - echo "### build and push vault image###"

   - cd $TMP_PWD/services/vault/

   - docker build -t $CI_REGISTRY/ocf/capif/$CI_COMMIT_REF_SLUG/vault:$CI_COMMIT_REF_SLUG .

   - docker push $CI_REGISTRY/ocf/capif/$CI_COMMIT_REF_SLUG/vault:$CI_COMMIT_REF_SLUG

   - echo "----------------------------------------------------"

   - docker logout $CI_REGISTRY



  <<: *staging_common