Phil/goshorly
1
0
Fork 0
Code Issues Pull requests Projects Releases 1 Packages 1 Wiki Activity Actions

Configure SAST in .gitlab-ci.yml, creating this file if it does not already exist

Browse source
This commit is contained in:
Phil 2022-01-07 20:25:28 +01:00
parent 6c69d3aae7
commit 33a4a36ee4
1 changed files with 45 additions and 42 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

87
.gitlab-ci.yml
View file

@ -1,68 +1,71 @@
# You can override the included template(s) by including variable overrides
# SAST customization: https://docs.gitlab.com/ee/user/application_security/sast/#customizing-the-sast-settings
# Secret Detection customization: https://docs.gitlab.com/ee/user/application_security/secret_detection/#customizing-settings
# Dependency Scanning customization: https://docs.gitlab.com/ee/user/application_security/dependency_scanning/#customizing-the-dependency-scanning-settings
# Note that environment variables can be set in several places
# See https://docs.gitlab.com/ee/ci/variables/#cicd-variable-precedence
variables: variables:
REPO_NAME: git.ucode.space/Phil/goshorly REPO_NAME: git.ucode.space/Phil/goshorly
DOCKER_BUILDKIT: 1 DOCKER_BUILDKIT: 1
stages: stages:
- test - test
- build - build
format: format:
image: golang:latest image: golang:latest
stage: test stage: test
before_script: before_script:
- mkdir -p $GOPATH/src/$(dirname $REPO_NAME) - mkdir -p $GOPATH/src/$(dirname $REPO_NAME)
- ln -svf $CI_PROJECT_DIR $GOPATH/src/$REPO_NAME - ln -svf $CI_PROJECT_DIR $GOPATH/src/$REPO_NAME
- cd $GOPATH/src/$REPO_NAME - cd $GOPATH/src/$REPO_NAME
script: script:
- go fmt $(go list ./... | grep -v /vendor/) - go fmt $(go list ./... | grep -v /vendor/)
- go vet $(go list ./... | grep -v /vendor/) - go vet $(go list ./... | grep -v /vendor/)
- go test -race $(go list ./... | grep -v /vendor/) - go test -race $(go list ./... | grep -v /vendor/)
gosec: gosec:
image: golang:latest image: golang:latest
before_script: before_script:
- mkdir -p $GOPATH/src/$(dirname $REPO_NAME) - mkdir -p $GOPATH/src/$(dirname $REPO_NAME)
- ln -svf $CI_PROJECT_DIR $GOPATH/src/$REPO_NAME - ln -svf $CI_PROJECT_DIR $GOPATH/src/$REPO_NAME
- cd $GOPATH/src/$REPO_NAME - cd $GOPATH/src/$REPO_NAME
script: script:
- go install github.com/securego/gosec/v2/cmd/gosec@latest - go install github.com/securego/gosec/v2/cmd/gosec@latest
- go get -v -d . - go get -v -d .
- gosec ./... - gosec ./...
docker-build-prod-latest: docker-build-prod-latest:
image: ezkrg/buildx image: ezkrg/buildx
stage: build stage: build
services: services:
- docker:dind - docker:dind
before_script: before_script:
- docker buildx create --use - docker buildx create --use
- docker login -u "$CI_REGISTRY_USER" -p "$CI_REGISTRY_PASSWORD" $CI_REGISTRY - docker login -u "$CI_REGISTRY_USER" -p "$CI_REGISTRY_PASSWORD" $CI_REGISTRY
script: script:
- | - |
docker buildx build \ docker buildx build \
--platform linux/amd64,linux/arm64,linux/arm/v7,linux/arm/v6 \ --platform linux/amd64,linux/arm64,linux/arm/v7,linux/arm/v6 \
--push \ --push \
--tag $CI_REGISTRY_IMAGE:latest \ --tag $CI_REGISTRY_IMAGE:latest \
. .
only: only:
- main - main
docker-build-MR-dry-run: docker-build-MR-dry-run:
image: docker:latest image: docker:latest
stage: build stage: build
services: services:
- docker:dind - docker:dind
script: script:
- | - |
if [[ "$CI_COMMIT_BRANCH" == "$CI_DEFAULT_BRANCH" ]]; then if [[ "$CI_COMMIT_BRANCH" == "$CI_DEFAULT_BRANCH" ]]; then
tag="" tag=""
echo "Running on default branch '$CI_DEFAULT_BRANCH': tag = 'latest'" echo "Running on default branch '$CI_DEFAULT_BRANCH': tag = 'latest'"
else else
tag=":$CI_COMMIT_REF_SLUG" tag=":$CI_COMMIT_REF_SLUG"
echo "Running on branch '$CI_COMMIT_BRANCH': tag = $tag" echo "Running on branch '$CI_COMMIT_BRANCH': tag = $tag"
fi fi
- docker build --pull -t "$CI_REGISTRY_IMAGE${tag}" . - docker build --pull -t "$CI_REGISTRY_IMAGE${tag}" .
only: only:
- merge_requests - merge_requests
sast:
stage: test
include:
- template: Security/SAST.gitlab-ci.yml