Дмитрий Соловьев
133 lines
2.8 KiB
YAML
133 lines
2.8 KiB
YAML
stages:
|
|
- build
|
|
- verify
|
|
- push
|
|
|
|
default:
|
|
image: repo.nstart.cloud/nstart/node:24-trixie-slim
|
|
cache:
|
|
paths:
|
|
- .npm/
|
|
|
|
install:
|
|
stage: build
|
|
script:
|
|
- npm ci --cache .npm --prefer-offline
|
|
artifacts:
|
|
expire_in: 1h
|
|
paths:
|
|
- node_modules/
|
|
|
|
oci:
|
|
stage: build
|
|
image: repo.nstart.cloud/nstart/docker-cli-buildx:1.0.0
|
|
services:
|
|
- name: repo.nstart.cloud/library/docker:29.1.2-dind
|
|
alias: docker
|
|
command: ["--tls=false"]
|
|
variables:
|
|
DOCKER_HOST: tcp://docker:2375
|
|
DOCKER_TLS_CERTDIR: ""
|
|
script:
|
|
- |
|
|
export VERSION=$(jq -r '.version' package.json)
|
|
export IMAGE_NAME=$CI_PROJECT_NAME
|
|
|
|
docker bake save
|
|
|
|
docker bake app --print \
|
|
| jq -r '.target.app.tags[]' \
|
|
> dist/tags.txt
|
|
artifacts:
|
|
paths:
|
|
- dist/
|
|
expire_in: 1 day
|
|
|
|
trivy:
|
|
stage: verify
|
|
image:
|
|
name: repo.nstart.cloud/aquasec/trivy:0.69.3
|
|
entrypoint: [""]
|
|
needs:
|
|
- job: oci
|
|
artifacts: true
|
|
variables:
|
|
TRIVY_CACHE_DIR: .trivycache
|
|
cache:
|
|
paths:
|
|
- .trivycache/
|
|
script:
|
|
- |
|
|
mkdir -p dist/oci-layout
|
|
OCI_TAR="$(find dist -maxdepth 1 -type f -name '*.tar' -print -quit)"
|
|
|
|
tar -xf "$OCI_TAR" -C dist/oci-layout
|
|
|
|
trivy image --input "dist/oci-layout" \
|
|
--format table \
|
|
--table-mode detailed \
|
|
--scanners vuln,secret,misconfig \
|
|
--image-config-scanners misconfig,secret \
|
|
--pkg-types os,library \
|
|
--severity HIGH,CRITICAL \
|
|
--ignore-unfixed \
|
|
--exit-code 1
|
|
|
|
build:
|
|
stage: verify
|
|
needs: ["install"]
|
|
script:
|
|
- npm run build
|
|
|
|
semgrep:
|
|
stage: verify
|
|
image: repo.nstart.cloud/semgrep/semgrep:1.160.0
|
|
script:
|
|
- semgrep scan --config auto --error .
|
|
|
|
.push_oci:
|
|
image:
|
|
name: repo.nstart.cloud/skopeo/stable:latest
|
|
entrypoint: [""]
|
|
script:
|
|
- |
|
|
skopeo login "$REGISTRY" -u "$REGISTRY_USER" -p "$REGISTRY_PASSWORD"
|
|
|
|
OCI_TAR="$(find dist -maxdepth 1 -type f -name '*.tar' -print -quit)"
|
|
|
|
while IFS= read -r DEST_TAG; do
|
|
[ -n "$DEST_TAG" ] || continue
|
|
|
|
skopeo copy --dest-tls-verify=false \
|
|
"oci-archive:${OCI_TAR}:latest" \
|
|
"docker://${DEST_TAG}"
|
|
done < dist/tags.txt
|
|
|
|
manual:
|
|
stage: push
|
|
extends: .push_oci
|
|
needs:
|
|
- job: oci
|
|
artifacts: true
|
|
rules:
|
|
- if: $CI_COMMIT_TAG
|
|
when: manual
|
|
allow_failure: true
|
|
- if: $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH
|
|
when: manual
|
|
allow_failure: true
|
|
- when: never
|
|
manual_confirmation: "Вы уверены, что хотите запустить push в registry?"
|
|
|
|
auto:
|
|
stage: push
|
|
extends: .push_oci
|
|
needs:
|
|
- job: oci
|
|
artifacts: true
|
|
- job: trivy
|
|
rules:
|
|
- if: $CI_COMMIT_TAG
|
|
- if: $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH
|
|
- when: never
|