security-scripts/.gitlab-ci.yml at master · PeterMosmans/security-scripts · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
---
# Pipeline template

### Variables used throughout the pipeline

variables:
  # Tool-specific: Image versions
  DIVE_VERSION: v0.11
  DOCKLE_VERSION: v0.4.13
  HADOLINT_VERSION: v2.12.0-debian
  TOOLS_VERSION: 1.7.0
  # Tool-specific: Configuration
  # Don't mind the container being run as root
  DOCKLE_PARMS: "--ignore CIS-DI-0001"
  # Generic information
  DOCKER_DRIVER: overlay2
  IMAGE_NAMESPACE: gofwd
  IMAGE_REPOSITORY: ${IMAGE_NAMESPACE}/analyze_hosts
  IMAGE_TAG: ${CI_COMMIT_SHORT_SHA}
  IMAGE_TAR: ${IMAGE_TAG}.tgz
  JOB_FINGERPRINT: $CI_COMMIT_SHORT_SHA-$CI_PIPELINE_ID

### Include several jobs

include:
  # .pre
  - .gitlab/secrets.gitlab-ci.yml
  # sast
  - .gitlab/dockerfile-lint.gitlab-ci.yml
  # sast
  - .gitlab/code-sonarqube.gitlab-ci.yml
  # build
  - .gitlab/docker-build.gitlab-ci.yml
  # security
  - .gitlab/dependency-track.gitlab-ci.yml
  # security
  - .gitlab/image-analyze.gitlab-ci.yml
  # security
  - .gitlab/image-lint.gitlab-ci.yml
  # test
  - .gitlab/test.gitlab-ci.yml

### Pipeline stages

stages:
  # Security checks over source code, can be performed parallel to building
  - sast
  # Build the artifact
  - build
  # (Dynamic) security checks using / over build artifact
  - security
  # Test the artifact
  - test

### Jobs

# All jobs that start with a dot are templates and can be extended
# This facilitates directed acyclic graph pipelines
# The needs keyword requires a job name

.sast:
  stage: sast
  needs:
    - secret_detection

.build:
  stage: build
  needs:
    - secret_detection

.dast:
  stage: dast
  needs:
    - build

.security:
  stage: security
  needs:
    - build

.test:
  stage: test
  needs:
    - build