fastapi-dls/.gitlab-ci.yml

397 lines
14 KiB
YAML
Raw Normal View History

2023-02-14 14:59:12 +03:00
include:
- template: Jobs/Code-Quality.gitlab-ci.yml
2023-02-14 15:55:49 +03:00
- template: Jobs/Secret-Detection.gitlab-ci.yml
2023-02-14 16:50:21 +03:00
- template: Jobs/SAST.gitlab-ci.yml
2023-02-14 17:14:19 +03:00
- template: Jobs/Container-Scanning.gitlab-ci.yml
2023-02-14 17:32:32 +03:00
- template: Jobs/Dependency-Scanning.gitlab-ci.yml
2023-02-14 14:59:12 +03:00
2022-12-16 15:55:17 +03:00
cache:
key: one-key-to-rule-them-all
2023-07-04 18:47:10 +03:00
variables:
DOCKER_BUILDX_PLATFORM: "linux/amd64,linux/arm64"
2022-12-28 13:54:01 +03:00
build:docker:
image: docker:dind
interruptible: true
stage: build
rules:
2022-12-29 14:26:05 +03:00
- if: $CI_COMMIT_BRANCH && $CI_COMMIT_BRANCH != $CI_DEFAULT_BRANCH
2022-12-29 14:30:23 +03:00
changes:
- app/**/*
- Dockerfile
2022-12-29 14:26:05 +03:00
- if: $CI_PIPELINE_SOURCE == 'merge_request_event'
2022-12-28 13:54:01 +03:00
tags: [ docker ]
before_script:
2023-03-23 10:11:57 +03:00
- docker buildx inspect
2023-03-23 13:46:17 +03:00
- docker buildx create --use
2022-12-28 13:54:01 +03:00
script:
- docker login -u $CI_REGISTRY_USER -p $CI_REGISTRY_PASSWORD $CI_REGISTRY
- IMAGE=$CI_REGISTRY/$CI_PROJECT_PATH/$CI_COMMIT_REF_NAME:$CI_COMMIT_SHA
2023-07-04 18:47:10 +03:00
- docker buildx build --progress=plain --platform $DOCKER_BUILDX_PLATFORM --build-arg VERSION=$CI_COMMIT_REF_NAME --build-arg COMMIT=$CI_COMMIT_SHA --tag $IMAGE --push .
2023-03-24 11:07:49 +03:00
- docker buildx imagetools inspect $IMAGE
2023-03-20 10:07:24 +03:00
- echo "CS_IMAGE=$IMAGE" > container_scanning.env
artifacts:
reports:
dotenv: container_scanning.env
2022-12-28 13:54:01 +03:00
2022-12-28 17:24:04 +03:00
build:apt:
2022-12-29 09:32:12 +03:00
image: debian:bookworm-slim
interruptible: true
stage: build
2022-12-29 09:32:12 +03:00
rules:
2023-03-20 10:07:24 +03:00
- if: $CI_COMMIT_TAG
2023-03-20 10:35:06 +03:00
variables:
VERSION: $CI_COMMIT_REF_NAME
2022-12-29 14:30:23 +03:00
- if: $CI_COMMIT_BRANCH && $CI_COMMIT_BRANCH != $CI_DEFAULT_BRANCH
changes:
- app/**/*
- .DEBIAN/**/*
2023-03-20 12:09:50 +03:00
- .gitlab-ci.yml
2023-03-20 10:35:06 +03:00
variables:
VERSION: "0.0.1"
2022-12-29 14:26:05 +03:00
- if: $CI_PIPELINE_SOURCE == 'merge_request_event'
2023-03-20 10:35:06 +03:00
variables:
VERSION: "0.0.1"
before_script:
2023-03-20 10:35:06 +03:00
- echo -e "VERSION=$VERSION\nCOMMIT=$CI_COMMIT_SHA" > version.env
2022-12-29 09:32:12 +03:00
# install build dependencies
- apt-get update -qq && apt-get install -qq -y build-essential
# create build directory for .deb sources
- mkdir build
# copy install instructions
2022-12-28 23:40:26 +03:00
- cp -r .DEBIAN build/DEBIAN
2022-12-29 00:02:12 +03:00
- chmod -R 0775 build/DEBIAN
# copy app into "/usr/share/fastapi-dls" as "/usr/share/fastapi-dls/app" & copy README.md and version.env
2022-12-28 10:25:31 +03:00
- mkdir -p build/usr/share/fastapi-dls
- cp -r app build/usr/share/fastapi-dls
- cp README.md version.env build/usr/share/fastapi-dls
2022-12-27 12:04:26 +03:00
# create conf file
2022-12-27 12:05:52 +03:00
- mkdir -p build/etc/fastapi-dls
2023-01-04 13:02:54 +03:00
- cp .DEBIAN/env.default build/etc/fastapi-dls/env
# create service file
- mkdir -p build/etc/systemd/system
2023-01-04 20:27:57 +03:00
- cp .DEBIAN/fastapi-dls.service build/etc/systemd/system/fastapi-dls.service
2022-12-27 12:16:04 +03:00
# cd into "build/"
- cd build/
script:
# set version based on value in "$CI_COMMIT_REF_NAME"
2023-03-20 12:09:50 +03:00
- sed -i -E 's/(Version\:\s)0.0/\1'"$VERSION"'/g' DEBIAN/control
2022-12-29 14:15:05 +03:00
# build
2022-12-27 12:16:04 +03:00
- dpkg -b . build.deb
2022-12-29 12:49:14 +03:00
- dpkg -I build.deb
artifacts:
expire_in: 1 week
paths:
2022-12-27 12:19:35 +03:00
- build/build.deb
2022-12-28 23:52:19 +03:00
build:pacman:
2022-12-28 17:24:04 +03:00
image: archlinux:base-devel
2022-12-29 09:32:12 +03:00
interruptible: true
2022-12-28 17:24:04 +03:00
stage: build
2022-12-29 09:32:12 +03:00
rules:
2023-03-20 10:35:06 +03:00
- if: $CI_COMMIT_TAG
variables:
VERSION: $CI_COMMIT_REF_NAME
2022-12-29 14:30:23 +03:00
- if: $CI_COMMIT_BRANCH && $CI_COMMIT_BRANCH != $CI_DEFAULT_BRANCH
changes:
- app/**/*
- .PKGBUILD/**/*
2023-03-20 12:09:50 +03:00
- .gitlab-ci.yml
2023-03-20 10:35:06 +03:00
variables:
VERSION: "0.0.1"
2022-12-29 14:26:05 +03:00
- if: $CI_PIPELINE_SOURCE == 'merge_request_event'
2023-03-20 10:35:06 +03:00
variables:
VERSION: "0.0.1"
2022-12-28 17:57:55 +03:00
before_script:
2023-03-20 12:09:50 +03:00
#- echo -e "VERSION=$VERSION\nCOMMIT=$CI_COMMIT_SHA" > version.env
2022-12-29 09:32:12 +03:00
# install build dependencies
2022-12-28 23:15:32 +03:00
- pacman -Syu --noconfirm git
2022-12-29 09:32:12 +03:00
# create a build-user because "makepkg" don't like root user
2022-12-28 17:57:55 +03:00
- useradd --no-create-home --shell=/bin/false build && usermod -L build
- 'echo "build ALL=(ALL) NOPASSWD: ALL" >> /etc/sudoers'
- 'echo "root ALL=(ALL) NOPASSWD: ALL" >> /etc/sudoers'
- chown -R build:build .
2022-12-28 23:20:19 +03:00
# move .PKGBUILD contents to root directory
- mv .PKGBUILD/* .
2022-12-28 17:24:04 +03:00
script:
2022-12-28 23:20:19 +03:00
- pwd
2022-12-28 23:14:14 +03:00
# download dependencies
- source PKGBUILD && pacman -Syu --noconfirm --needed --asdeps "${makedepends[@]}" "${depends[@]}"
# build
2023-03-20 12:09:50 +03:00
- sudo --preserve-env -u build makepkg -s
2022-12-28 23:20:19 +03:00
artifacts:
expire_in: 1 week
paths:
- "*.pkg.tar.zst"
2022-12-28 17:24:04 +03:00
2022-12-23 15:48:48 +03:00
test:
2023-11-03 16:03:48 +03:00
image: python:3.11-slim-bookworm
2022-12-23 15:48:48 +03:00
stage: test
2024-01-18 15:10:12 +03:00
interruptible: true
2022-12-29 09:32:12 +03:00
rules:
- if: $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH
2023-03-20 10:07:24 +03:00
- if: $CI_COMMIT_TAG
2022-12-29 09:32:12 +03:00
- if: $CI_PIPELINE_SOURCE == "merge_request_event"
- if: $CI_COMMIT_BRANCH && $CI_COMMIT_BRANCH != $CI_DEFAULT_BRANCH
changes:
- app/**/*
- test/**/*
2022-12-23 13:24:40 +03:00
variables:
DATABASE: sqlite:///../app/db.sqlite
parallel:
matrix:
- REQUIREMENTS:
- requirements.txt
- .DEBIAN/requirements-bookworm-12.txt
- .DEBIAN/requirements-ubuntu-23.10.txt
2022-12-23 15:48:48 +03:00
before_script:
2023-11-03 13:41:44 +03:00
- apt-get update && apt-get install -y python3-dev gcc
- pip install -r $REQUIREMENTS
2022-12-23 15:48:48 +03:00
- pip install pytest httpx
- mkdir -p app/cert
- openssl genrsa -out app/cert/instance.private.pem 2048
- openssl rsa -in app/cert/instance.private.pem -outform PEM -pubout -out app/cert/instance.public.pem
- cd test
script:
2023-02-14 17:14:19 +03:00
- python -m pytest main.py --junitxml=report.xml
2023-01-16 12:23:58 +03:00
artifacts:
reports:
dotenv: version.env
2023-02-14 17:14:19 +03:00
junit: ['**/report.xml']
2022-12-23 15:48:48 +03:00
.test:linux:
2022-12-16 15:55:17 +03:00
stage: test
2022-12-29 10:00:34 +03:00
rules:
2022-12-29 14:30:23 +03:00
- if: $CI_COMMIT_BRANCH && $CI_COMMIT_BRANCH != $CI_DEFAULT_BRANCH
changes:
2022-12-29 10:00:34 +03:00
- app/**/*
2022-12-29 14:30:23 +03:00
- .DEBIAN/**/*
- if: $CI_PIPELINE_SOURCE == 'merge_request_event'
needs:
2022-12-28 17:24:04 +03:00
- job: build:apt
artifacts: true
variables:
DEBIAN_FRONTEND: noninteractive
before_script:
2022-12-29 09:32:12 +03:00
- apt-get update -qq && apt-get install -qq -y jq curl
2022-12-16 15:55:17 +03:00
script:
# test installation
2022-12-27 12:23:51 +03:00
- apt-get install -q -y ./build/build.deb --fix-missing
2022-12-29 09:43:16 +03:00
- openssl req -x509 -newkey rsa:2048 -nodes -out /etc/fastapi-dls/webserver.crt -keyout /etc/fastapi-dls/webserver.key -days 7 -subj "/C=DE/O=GitLab-CI/OU=Test/CN=localhost"
2022-12-27 14:40:33 +03:00
# copy example config from GitLab-CI-Variables
#- cat ${EXAMPLE_CONFIG} > /etc/fastapi-dls/env
# start service in background
2022-12-29 09:32:12 +03:00
- cd /usr/share/fastapi-dls/app
2022-12-29 09:43:16 +03:00
- uvicorn main:app
--host 127.0.0.1 --port 443
2022-12-27 14:35:07 +03:00
--app-dir /usr/share/fastapi-dls/app
--ssl-keyfile /etc/fastapi-dls/webserver.key
2022-12-29 09:43:16 +03:00
--ssl-certfile /etc/fastapi-dls/webserver.crt
2022-12-27 14:32:40 +03:00
--proxy-headers &
- FASTAPI_DLS_PID=$!
2022-12-27 14:35:07 +03:00
- echo "Started service with pid $FASTAPI_DLS_PID"
2023-01-04 13:02:54 +03:00
- cat /etc/fastapi-dls/env
2022-12-27 14:40:33 +03:00
# testing service
- if [ "`curl --insecure -s https://127.0.0.1/-/health | jq .status`" != "up" ]; then echo "Success"; else "Error"; fi
2022-12-27 14:40:33 +03:00
# cleanup
2022-12-27 14:32:40 +03:00
- kill $FASTAPI_DLS_PID
- apt-get purge -qq -y fastapi-dls
- apt-get autoremove -qq -y && apt-get clean -qq
2022-12-16 15:55:17 +03:00
test:debian:
extends: .test:linux
image: debian:bookworm-slim
test:ubuntu:
extends: .test:linux
image: ubuntu:23.10
2022-12-28 23:52:19 +03:00
test:archlinux:
image: archlinux:base
2022-12-29 09:43:16 +03:00
rules:
2022-12-29 14:30:23 +03:00
- if: $CI_COMMIT_BRANCH && $CI_COMMIT_BRANCH != $CI_DEFAULT_BRANCH
changes:
2022-12-29 09:43:16 +03:00
- app/**/*
2022-12-29 14:30:23 +03:00
- .PKGBUILD/**/*
- if: $CI_PIPELINE_SOURCE == 'merge_request_event'
2022-12-29 09:32:12 +03:00
needs:
- job: build:pacman
artifacts: true
2022-12-28 23:52:19 +03:00
script:
2022-12-29 09:32:12 +03:00
- pacman -Sy
2022-12-29 12:40:34 +03:00
- pacman -U --noconfirm *.pkg.tar.zst
2022-12-28 23:52:19 +03:00
2023-02-14 14:59:12 +03:00
code_quality:
variables:
SOURCE_CODE: app
2023-02-14 14:59:12 +03:00
rules:
- if: $CODE_QUALITY_DISABLED
when: never
- if: $CI_PIPELINE_SOURCE == "merge_request_event"
- if: $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH
2023-02-14 14:59:12 +03:00
2023-02-14 15:55:49 +03:00
secret_detection:
rules:
- if: $SECRET_DETECTION_DISABLED
when: never
- if: $CI_PIPELINE_SOURCE == "merge_request_event"
2023-03-24 12:00:25 +03:00
before_script:
- git config --global --add safe.directory $CI_PROJECT_DIR
2023-02-14 15:55:49 +03:00
2023-02-14 16:50:21 +03:00
semgrep-sast:
rules:
- if: $SAST_DISABLED
when: never
- if: $CI_PIPELINE_SOURCE == "merge_request_event"
- if: $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH
2023-02-14 16:50:21 +03:00
2023-02-14 14:59:12 +03:00
test_coverage:
2024-01-18 01:05:57 +03:00
# extends: test
image: python:3.11-slim-bookworm
2023-02-14 15:37:25 +03:00
allow_failure: true
2024-01-18 01:05:57 +03:00
stage: test
2023-02-14 14:59:12 +03:00
rules:
- if: $CI_PIPELINE_SOURCE == "merge_request_event"
2024-01-18 01:05:57 +03:00
variables:
DATABASE: sqlite:///../app/db.sqlite
before_script:
- apt-get update && apt-get install -y python3-dev gcc
- pip install -r requirements.txt
- pip install pytest httpx
- mkdir -p app/cert
- openssl genrsa -out app/cert/instance.private.pem 2048
- openssl rsa -in app/cert/instance.private.pem -outform PEM -pubout -out app/cert/instance.public.pem
- cd test
2023-02-14 14:59:12 +03:00
script:
- pip install pytest pytest-cov
2023-02-14 15:37:25 +03:00
- coverage run -m pytest main.py
2023-02-14 14:59:12 +03:00
- coverage report
- coverage xml
coverage: '/(?i)total.*? (100(?:\.0+)?\%|[1-9]?\d(?:\.\d+)?\%)$/'
artifacts:
reports:
coverage_report:
coverage_format: cobertura
path: '**/coverage.xml'
2023-02-14 17:14:19 +03:00
container_scanning:
dependencies: [ build:docker ]
rules:
- if: $CONTAINER_SCANNING_DISABLED
when: never
- if: $CI_PIPELINE_SOURCE == "merge_request_event"
2023-02-14 17:48:49 +03:00
gemnasium-python-dependency_scanning:
2023-02-14 17:32:32 +03:00
rules:
2023-02-14 17:48:49 +03:00
- if: $DEPENDENCY_SCANNING_DISABLED
2023-02-14 17:32:32 +03:00
when: never
- if: $CI_PIPELINE_SOURCE == "merge_request_event"
- if: $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH
2023-02-14 17:32:32 +03:00
2022-12-29 12:44:39 +03:00
.deploy:
2022-12-16 15:55:17 +03:00
rules:
2022-12-29 12:44:39 +03:00
- if: $CI_COMMIT_TAG
deploy:docker:
extends: .deploy
2023-07-04 19:58:13 +03:00
image: docker:dind
2022-12-29 12:44:39 +03:00
stage: deploy
2023-07-04 19:58:13 +03:00
tags: [ docker ]
before_script:
- echo "Building docker image for commit $CI_COMMIT_SHA with version $CI_COMMIT_REF_NAME"
2023-07-04 19:58:13 +03:00
- docker buildx inspect
- docker buildx create --use
2022-12-16 15:55:17 +03:00
script:
- echo "========== GitLab-Registry =========="
- docker login -u $CI_REGISTRY_USER -p $CI_REGISTRY_PASSWORD $CI_REGISTRY
- IMAGE=$CI_REGISTRY/$CI_PROJECT_PATH
2023-07-04 18:47:10 +03:00
- docker buildx build --progress=plain --platform $DOCKER_BUILDX_PLATFORM --build-arg VERSION=$CI_COMMIT_REF_NAME --build-arg COMMIT=$CI_COMMIT_SHA --tag $IMAGE:$CI_COMMIT_REF_NAME --push .
- docker buildx build --progress=plain --platform $DOCKER_BUILDX_PLATFORM --build-arg VERSION=$CI_COMMIT_REF_NAME --build-arg COMMIT=$CI_COMMIT_SHA --tag $IMAGE:latest --push .
- echo "========== Docker-Hub =========="
- docker login -u $PUBLIC_REGISTRY_USER -p $PUBLIC_REGISTRY_TOKEN
- IMAGE=$PUBLIC_REGISTRY_USER/$CI_PROJECT_NAME
2023-07-04 18:47:10 +03:00
- docker buildx build --progress=plain --platform $DOCKER_BUILDX_PLATFORM --build-arg VERSION=$CI_COMMIT_REF_NAME --build-arg COMMIT=$CI_COMMIT_SHA --tag $IMAGE:$CI_COMMIT_REF_NAME --push .
- docker buildx build --progress=plain --platform $DOCKER_BUILDX_PLATFORM --build-arg VERSION=$CI_COMMIT_REF_NAME --build-arg COMMIT=$CI_COMMIT_SHA --tag $IMAGE:latest --push .
2022-12-28 19:05:59 +03:00
deploy:apt:
# doc: https://git.collinwebdesigns.de/help/user/packages/debian_repository/index.md#install-a-package
2022-12-29 12:44:39 +03:00
extends: .deploy
image: debian:bookworm-slim
stage: deploy
needs:
2022-12-28 17:24:04 +03:00
- job: build:apt
artifacts: true
before_script:
- apt-get update -qq && apt-get install -qq -y curl lsb-release
# create distribution initial
- CODENAME=`lsb_release -cs`
# create repo if not exists
- 'if [ "`curl -s -o /dev/null -w "%{http_code}" --header "JOB-TOKEN: $CI_JOB_TOKEN" -s ${CI_API_V4_URL}/projects/${CI_PROJECT_ID}/debian_distributions/${CODENAME}/key.asc`" != "200" ]; then curl --request POST --header "JOB-TOKEN: $CI_JOB_TOKEN" "${CI_API_V4_URL}/projects/${CI_PROJECT_ID}/debian_distributions?codename=${CODENAME}"; fi'
script:
# Naming format: <name>_<version>-<release>_<arch>.deb
# Version is the version number of the app being packaged
# Release number is the version number of the *packaging* itself.
# The release number might increment if the package maintainer
# updated the packaging, while the version number of the application
# being packaged did not change.
2022-12-27 14:56:46 +03:00
- BUILD_NAME=build/build.deb # inherited by build-stage
- PACKAGE_NAME=`dpkg -I ${BUILD_NAME} | grep "Package:" | awk '{ print $2 }'`
- PACKAGE_VERSION=`dpkg -I ${BUILD_NAME} | grep "Version:" | awk '{ print $2 }'`
- PACKAGE_ARCH=amd64
2022-12-27 16:52:17 +03:00
#- EXPORT_NAME="${PACKAGE_NAME}_${PACKAGE_VERSION}-0_${PACKAGE_ARCH}.deb"
- EXPORT_NAME="${PACKAGE_NAME}_${PACKAGE_VERSION}_${PACKAGE_ARCH}.deb"
- mv ${BUILD_NAME} ${EXPORT_NAME}
- 'echo "PACKAGE_NAME: ${PACKAGE_NAME}"'
- 'echo "PACKAGE_VERSION: ${PACKAGE_VERSION}"'
- 'echo "PACKAGE_ARCH: ${PACKAGE_ARCH}"'
- 'echo "EXPORT_NAME: ${EXPORT_NAME}"'
# https://docs.gitlab.com/14.3/ee/user/packages/debian_repository/index.html
- URL="${CI_API_V4_URL}/projects/${CI_PROJECT_ID}/packages/debian/${EXPORT_NAME}"
- 'echo "URL: ${URL}"'
#- 'curl --request PUT --header "JOB-TOKEN: $CI_JOB_TOKEN" --upload-file ${EXPORT_NAME} ${URL}'
# using generic-package-registry until debian-registry is GA
# https://docs.gitlab.com/ee/user/packages/generic_packages/index.html#publish-a-generic-package-by-using-cicd
- 'curl --header "JOB-TOKEN: $CI_JOB_TOKEN" --upload-file ${EXPORT_NAME} "${CI_API_V4_URL}/projects/${CI_PROJECT_ID}/packages/generic/${PACKAGE_NAME}/${PACKAGE_VERSION}/${EXPORT_NAME}"'
2022-12-28 23:52:19 +03:00
deploy:pacman:
2022-12-29 12:44:39 +03:00
extends: .deploy
2022-12-28 23:52:19 +03:00
image: archlinux:base-devel
stage: deploy
needs:
- job: build:pacman
artifacts: true
script:
- source .PKGBUILD/PKGBUILD
# fastapi-dls-1.0-1-any.pkg.tar.zst
- BUILD_NAME=${pkgname}-${CI_COMMIT_REF_NAME}-${pkgrel}-any.pkg.tar.zst
2022-12-28 23:52:19 +03:00
- PACKAGE_NAME=${pkgname}
- PACKAGE_VERSION=${CI_COMMIT_REF_NAME}
2022-12-28 23:52:19 +03:00
- PACKAGE_ARCH=any
- EXPORT_NAME=${BUILD_NAME}
- 'echo "PACKAGE_NAME: ${PACKAGE_NAME}"'
- 'echo "PACKAGE_VERSION: ${PACKAGE_VERSION}"'
- 'echo "PACKAGE_ARCH: ${PACKAGE_ARCH}"'
- 'echo "EXPORT_NAME: ${EXPORT_NAME}"'
- 'curl --header "JOB-TOKEN: $CI_JOB_TOKEN" --upload-file ${EXPORT_NAME} "${CI_API_V4_URL}/projects/${CI_PROJECT_ID}/packages/generic/${PACKAGE_NAME}/${PACKAGE_VERSION}/${EXPORT_NAME}"'
2022-12-29 14:47:51 +03:00
release:
image: registry.gitlab.com/gitlab-org/release-cli:latest
stage: .post
2023-03-20 10:07:24 +03:00
needs: [ test ]
2022-12-29 14:47:51 +03:00
rules:
- if: $CI_COMMIT_TAG
script:
2023-03-20 10:07:24 +03:00
- echo "Running release-job for $CI_COMMIT_TAG"
2022-12-29 14:47:51 +03:00
release:
2023-03-20 10:07:24 +03:00
name: $CI_PROJECT_TITLE $CI_COMMIT_TAG
description: Release of $CI_PROJECT_TITLE version $CI_COMMIT_TAG
tag_name: $CI_COMMIT_TAG
2022-12-29 14:47:51 +03:00
ref: $CI_COMMIT_SHA
assets:
links:
- name: 'Package Registry'
url: 'https://git.collinwebdesigns.de/oscar.krause/fastapi-dls/-/packages'
- name: 'Container Registry'
url: 'https://git.collinwebdesigns.de/oscar.krause/fastapi-dls/container_registry/40'