staging pipeline (633c2cf8) · Commits · OCF / pipeline-scripts

capif/.gitlab-ci.yml

+23 −45

Original line number	Diff line number	Diff line
		stages:
		- main_cancel_previous_action
		- merge_request_staging_into_main
		- test
		- main_sast
		- main_container_scanning
		@@ -7,11 +8,9 @@ stages:
		- deploy_ocf_main
		- main_rf_testing
		- delete_ocf_main
		- staging_cancel_previous_action
		- merge_request_staging_into_main
		- staging_pre_pipeline
		- staging_secrets_in_repo
		- staging_linting_code
		- staging_linting_docker
		- staging_linting
		- staging_unit_tests
		- staging_security
		- staging_build_and_push
		@@ -123,26 +122,27 @@ main_cancel_previous_action:
		fi
		<<: *main_common

		staging_cancel_previous_action:
		stage: staging_cancel_previous_action
		merge_request_staging_into_main:
		stage: merge_request_staging_into_main
		script:
		- \|
		if [[ -n "$CI_JOB_TOKEN" ]]; then
		echo "Checking for running jobs in the same pipeline..."
		jobs=$(curl --header "PRIVATE-TOKEN: $CI_JOB_TOKEN" "$GITLAB_API/projects/$CI_PROJECT_ID/pipelines/$CI_PIPELINE_ID/jobs")
		for job in $(echo "$jobs" \| jq -r '.[] \| @base64'); do
		_jq() {
		echo ${job} \| base64 --decode \| jq -r ${1}
		}
		status=$(_jq '.status')
		id=$(_jq '.id')
		if [[ "$status" == "running" ]] && [[ "$id" != "$CI_JOB_ID" ]]; then
		echo "Cancelling job $id"
		curl --request POST --header "PRIVATE-TOKEN: $CI_JOB_TOKEN" "$GITLAB_API/projects/$CI_PROJECT_ID/jobs/$id/cancel"
		fi
		done
		- >
		if [ "$CI_COMMIT_REF_NAME" == "staging" ]; then
		# Variables
		SOURCE_BRANCH="staging"
		TARGET_BRANCH="main"
		TITLE="Merge staging into main created by GitLab CICD"

		# Create Merge Request
		curl --request POST --header "PRIVATE-TOKEN: $CI_JOB_TOKEN" \
		--data "source_branch=$SOURCE_BRANCH&target_branch=$TARGET_BRANCH&title=$TITLE" \
		"$GITLAB_API/projects/$PROJECT_ID/merge_requests"
		else
		echo "Nothing to do"
		fi
		<<: *staging_common
		only:
		- staging
		tags:
		- shell

		#dev_cancel_previous_action:
		# stage: dev_pre_pipeline
		@@ -182,28 +182,6 @@ include:
		- 'capif/templates/cd-deploy-ocf.gitlab-ci.yml'
		# - 'capif/templates/ci_main.gitlab-ci.yml'



		merge_request_staging_into_main:
		stage: merge_request_staging_into_main
		script:
		- >
		if [ "$CI_COMMIT_REF_NAME" == "staging" ]; then
		# Variables
		SOURCE_BRANCH="staging"
		TARGET_BRANCH="main"
		TITLE="Merge staging into main created by GitLab CICD"

		# Create Merge Request
		curl --request POST --header "PRIVATE-TOKEN: $CI_JOB_TOKEN" \
		--data "source_branch=$SOURCE_BRANCH&target_branch=$TARGET_BRANCH&title=$TITLE" \
		"$GITLAB_API/projects/$PROJECT_ID/merge_requests"
		else
		echo "Nothing to do"
		fi
		only:
		- staging

		#sast:
		# variables:
		# SAST_DEFAULT_ANALYZERS: "bandit" # to sast

capif/templates/ci_staging.gitlab-ci.yml

+45 −9

Original line number	Diff line number	Diff line
		stages:
		# - staging_pulling_repo
		- test # to Security and Compliance gitLab
		- staging_pre_pipeline
		- staging_secrets_in_repo
		- staging_linting_code
		- staging_linting_docker
		- staging_linting
		- staging_unit_tests
		- staging_security
		- staging_build_and_push

		@@ -40,6 +41,27 @@ variables:
		# - git clone https://oauth2:${CI_JOB_TOKEN}@labs.etsi.org/rep/ocf/capif.git
		# <<: *staging_common

		staging_cancel_previous_action:
		stage: staging_pre_pipeline
		script:
		- \|
		if [[ -n "$CI_JOB_TOKEN" ]]; then
		echo "Checking for running jobs in the same pipeline..."
		jobs=$(curl --header "PRIVATE-TOKEN: $CI_JOB_TOKEN" "$GITLAB_API/projects/$CI_PROJECT_ID/pipelines/$CI_PIPELINE_ID/jobs")
		for job in $(echo "$jobs" \| jq -r '.[] \| @base64'); do
		_jq() {
		echo ${job} \| base64 --decode \| jq -r ${1}
		}
		status=$(_jq '.status')
		id=$(_jq '.id')
		if [[ "$status" == "running" ]] && [[ "$id" != "$CI_JOB_ID" ]]; then
		echo "Cancelling job $id"
		curl --request POST --header "PRIVATE-TOKEN: $CI_JOB_TOKEN" "$GITLAB_API/projects/$CI_PROJECT_ID/jobs/$id/cancel"
		fi
		done
		fi
		<<: *staging_common

		staging_secrets_in_repo:
		stage: staging_secrets_in_repo
		script:
		@@ -47,12 +69,13 @@ staging_secrets_in_repo:
		pip install trufflehog
		cd ../
		trufflehog capif --exclude_paths capif/cicd/exclusions --max_depth=5
		# needs: ["staging_pulling_repo"]
		needs:
		- staging_cancel_previous_action
		<<: *staging_common

		# define the process to do linting code: Sonarque, ruff?
		staging_linting_code:
		stage: staging_linting_code
		stage: staging_linting
		script:
		- \|
		echo "###ruff checks###"
		@@ -62,7 +85,7 @@ staging_linting_code:
		<<: *staging_common

		staging_linting_docker:
		stage: staging_linting_docker
		stage: staging_linting
		script:
		- \|
		# Download hadolint binary
		@@ -104,9 +127,17 @@ staging_linting_docker:
		needs: ["staging_linting_code"]
		<<: *staging_common

		staging_unit_tests:
		stage: staging_unit_tests
		script:
		- \|
		echo "------- Unit Tests -------"
		<<: *staging_common


		staging_grype_cvs:
		needs: ["staging_linting_docker"]
		needs:
		- staging_unit_tests
		stage: staging_security
		script:
		- \|
		@@ -179,7 +210,8 @@ semgrep-sast:
		- when: never

		staging_semgrep_sast:
		needs: ["staging_linting_docker"]
		needs:
		- staging_unit_tests
		stage: staging_security
		extends: semgrep-sast
		variables:
		@@ -197,7 +229,8 @@ gemnasium-python-dependency_scanning:
		- when: never

		staging_gemnasium_python_sca:
		needs: ["staging_linting_docker"]
		needs:
		- staging_unit_tests
		stage: staging_security
		extends: gemnasium-python-dependency_scanning
		variables:
		@@ -205,7 +238,10 @@ staging_gemnasium_python_sca:
		<<: *staging_dnd

		staging_build_and_push:
		needs: ["staging_gemnasium_python_sca"]
		needs:
		- staging_gemnasium_python_sca
		- staging_semgrep_sast
		- staging_grype_cvs
		stage: staging_build_and_push
		script:
		- export TMP_PWD=$PWD