Commit fb6b0662 authored by Dmitriy Safronov's avatar Dmitriy Safronov
Browse files

ci basic 



Signed-off-by: default avatarDmitriy Safronov <zimniy@cyberbrain.pw>
parent 4c2106f6

.gitlab-ci.yml

0 → 100644
+250 −0
Original line number Diff line number Diff line 
# Heavily inspired by:

# https://gitlab.com/gitlab-org/gitlab/-/blob/master/lib/gitlab/ci/templates/Security/Secure-Binaries.gitlab-ci.yml



variables:

  # Setting this variable will affect all Security templates

  # (SAST, Dependency Scanning, ...)

  CLUSTER_INTEGRATION_PREFIX: "$CI_TEMPLATE_REGISTRY_HOST/security-products"

  CLUSTER_INTEGRATION_COMPONENTS: >-

    bandit, brakeman, gosec, spotbugs, flawfinder, phpcs-security-audit, security-code-scan, nodejs-scan, eslint, secrets, sobelow, pmd-apex, kics, kubesec, semgrep, gemnasium, gemnasium-maven, gemnasium-python,

    license-finder,

    dast, dast-runner-validation, api-security



  CLUSTER_INTEGRATION_DOWNLOAD_IMAGES: "true"

  CLUSTER_INTEGRATION_PUSH_IMAGES: "true"

  CLUSTER_INTEGRATION_SAVE_ARTIFACTS: "false"



  CLUSTER_INTEGRATION_COMPONENT_VERSION: "2"



.download_images:

  allow_failure: true

  image: docker:stable

  only:

    refs:

      - branches

  variables:

    DOCKER_DRIVER: overlay2

    DOCKER_TLS_CERTDIR: ""

  services:

    - docker:dind

  script:

    - docker info

    - env

    - if [ -z "$CLUSTER_INTEGRATION_IMAGE" ]; then export CLUSTER_INTEGRATION_IMAGE=${CLUSTER_INTEGRATION_IMAGE:-"${CLUSTER_INTEGRATION_PREFIX}/${CI_JOB_NAME}:${CLUSTER_INTEGRATION_COMPONENT_VERSION}"}; fi

    - docker pull --quiet ${CLUSTER_INTEGRATION_IMAGE}

    - mkdir -p output/$(dirname ${CI_JOB_NAME})

    - |

      if [ "$CLUSTER_INTEGRATION_SAVE_ARTIFACTS" = "true" ]; then

        docker save ${CLUSTER_INTEGRATION_IMAGE} | gzip > output/${CI_JOB_NAME}_${CLUSTER_INTEGRATION_COMPONENT_VERSION}.tar.gz

        sha256sum output/${CI_JOB_NAME}_${CLUSTER_INTEGRATION_COMPONENT_VERSION}.tar.gz > output/${CI_JOB_NAME}_${CLUSTER_INTEGRATION_COMPONENT_VERSION}.tar.gz.sha256sum

      fi

    - |

      if [ "$CLUSTER_INTEGRATION_PUSH_IMAGES" = "true" ]; then

        docker login -u gitlab-ci-token -p $CI_JOB_TOKEN $CI_REGISTRY

        docker tag ${CLUSTER_INTEGRATION_IMAGE} ${CI_REGISTRY_IMAGE}/${CI_JOB_NAME}:${CLUSTER_INTEGRATION_COMPONENT_VERSION}

        docker push ${CI_REGISTRY_IMAGE}/${CI_JOB_NAME}:${CLUSTER_INTEGRATION_COMPONENT_VERSION}

      fi



  artifacts:

    paths:

      - output/



#

# SAST jobs

#



bandit:

  extends: .download_images

  variables:

    CLUSTER_INTEGRATION_COMPONENT_VERSION: "2"

  only:

    variables:

      - $CLUSTER_INTEGRATION_DOWNLOAD_IMAGES == "true" &&

          $CLUSTER_INTEGRATION_COMPONENTS =~ /\bbandit\b/



brakeman:

  extends: .download_images

  variables:

    CLUSTER_INTEGRATION_COMPONENT_VERSION: "3"

  only:

    variables:

      - $CLUSTER_INTEGRATION_DOWNLOAD_IMAGES == "true" &&

          $CLUSTER_INTEGRATION_COMPONENTS =~ /\bbrakeman\b/



gosec:

  extends: .download_images

  variables:

    CLUSTER_INTEGRATION_COMPONENT_VERSION: "3"

  only:

    variables:

      - $CLUSTER_INTEGRATION_DOWNLOAD_IMAGES == "true" &&

          $CLUSTER_INTEGRATION_COMPONENTS =~ /\bgosec\b/



spotbugs:

  extends: .download_images

  variables:

    CLUSTER_INTEGRATION_COMPONENT_VERSION: "3"

  only:

    variables:

      - $CLUSTER_INTEGRATION_DOWNLOAD_IMAGES == "true" &&

          $CLUSTER_INTEGRATION_COMPONENTS =~ /\bspotbugs\b/



flawfinder:

  extends: .download_images

  variables:

    CLUSTER_INTEGRATION_COMPONENT_VERSION: "3"

  only:

    variables:

      - $CLUSTER_INTEGRATION_DOWNLOAD_IMAGES == "true" &&

          $CLUSTER_INTEGRATION_COMPONENTS =~ /\bflawfinder\b/



phpcs-security-audit:

  extends: .download_images

  variables:

    CLUSTER_INTEGRATION_COMPONENT_VERSION: "3"

  only:

    variables:

      - $CLUSTER_INTEGRATION_DOWNLOAD_IMAGES == "true" &&

          $CLUSTER_INTEGRATION_COMPONENTS =~ /\bphpcs-security-audit\b/



security-code-scan:

  extends: .download_images

  variables:

    CLUSTER_INTEGRATION_COMPONENT_VERSION: "3"

  only:

    variables:

      - $CLUSTER_INTEGRATION_DOWNLOAD_IMAGES == "true" &&

          $CLUSTER_INTEGRATION_COMPONENTS =~ /\bsecurity-code-scan\b/



nodejs-scan:

  extends: .download_images

  variables:

    CLUSTER_INTEGRATION_COMPONENT_VERSION: "3"

  only:

    variables:

      - $CLUSTER_INTEGRATION_DOWNLOAD_IMAGES == "true" &&

          $CLUSTER_INTEGRATION_COMPONENTS =~ /\bnodejs-scan\b/



eslint:

  extends: .download_images

  variables:

    CLUSTER_INTEGRATION_COMPONENT_VERSION: "2"

  only:

    variables:

      - $CLUSTER_INTEGRATION_DOWNLOAD_IMAGES == "true" &&

          $CLUSTER_INTEGRATION_COMPONENTS =~ /\beslint\b/



secrets:

  extends: .download_images

  only:

    variables:

      - $CLUSTER_INTEGRATION_DOWNLOAD_IMAGES == "true" &&

          $CLUSTER_INTEGRATION_COMPONENTS =~ /\bsecrets\b/

  variables:

    CLUSTER_INTEGRATION_COMPONENT_VERSION: "4"



semgrep:

  extends: .download_images

  variables:

    CLUSTER_INTEGRATION_COMPONENT_VERSION: "3"

  only:

    variables:

      - $CLUSTER_INTEGRATION_DOWNLOAD_IMAGES == "true" &&

          $CLUSTER_INTEGRATION_COMPONENTS =~ /\bsemgrep\b/



sobelow:

  extends: .download_images

  variables:

    CLUSTER_INTEGRATION_COMPONENT_VERSION: "3"

  only:

    variables:

      - $CLUSTER_INTEGRATION_DOWNLOAD_IMAGES == "true" &&

          $CLUSTER_INTEGRATION_COMPONENTS =~ /\bsobelow\b/



pmd-apex:

  extends: .download_images

  variables:

    CLUSTER_INTEGRATION_COMPONENT_VERSION: "3"

  only:

    variables:

      - $CLUSTER_INTEGRATION_DOWNLOAD_IMAGES == "true" &&

          $CLUSTER_INTEGRATION_COMPONENTS =~ /\bsecrets\b/



kubesec:

  extends: .download_images

  variables:

    CLUSTER_INTEGRATION_COMPONENT_VERSION: "3"

  only:

    variables:

      - $CLUSTER_INTEGRATION_DOWNLOAD_IMAGES == "true" &&

          $CLUSTER_INTEGRATION_COMPONENTS =~ /\bkubesec\b/



#

# Dependency Scanning jobs

#



gemnasium:

  extends: .download_images

  only:

    variables:

      - $CLUSTER_INTEGRATION_DOWNLOAD_IMAGES == "true" &&

          $CLUSTER_INTEGRATION_COMPONENTS =~ /\bgemnasium\b/



gemnasium-maven:

  extends: .download_images

  only:

    variables:

      - $CLUSTER_INTEGRATION_DOWNLOAD_IMAGES == "true" &&

          $CLUSTER_INTEGRATION_COMPONENTS =~ /\bgemnasium-maven\b/



gemnasium-python:

  extends: .download_images

  only:

    variables:

      - $CLUSTER_INTEGRATION_DOWNLOAD_IMAGES == "true" &&

          $CLUSTER_INTEGRATION_COMPONENTS =~ /\bgemnasium-python\b/



#

# License Scanning

#



license-finder:

  extends: .download_images

  variables:

    CLUSTER_INTEGRATION_COMPONENT_VERSION: "3"

  only:

    variables:

      - $CLUSTER_INTEGRATION_DOWNLOAD_IMAGES == "true" &&

          $CLUSTER_INTEGRATION_COMPONENTS =~ /\blicense-finder\b/



#

# DAST

#



dast:

  extends: .download_images

  variables:

    CLUSTER_INTEGRATION_COMPONENT_VERSION: "2"

  only:

    variables:

      - $CLUSTER_INTEGRATION_DOWNLOAD_IMAGES == "true" &&

          $CLUSTER_INTEGRATION_COMPONENTS =~ /\bdast\b/



dast-runner-validation:

  extends: .download_images

  variables:

    CLUSTER_INTEGRATION_COMPONENT_VERSION: "1"

    CLUSTER_INTEGRATION_IMAGE: "${CI_TEMPLATE_REGISTRY_HOST}/security-products/${CI_JOB_NAME}:${CLUSTER_INTEGRATION_COMPONENT_VERSION}"

  only:

    variables:

      - $CLUSTER_INTEGRATION_DOWNLOAD_IMAGES == "true" &&

          $CLUSTER_INTEGRATION_COMPONENTS =~ /\bdast-runner-validation\b/



api-security:

  extends: .download_images

  variables:

    CLUSTER_INTEGRATION_COMPONENT_VERSION: "3"

  only:

    variables:

      - $CLUSTER_INTEGRATION_DOWNLOAD_IMAGES == "true" &&

          $CLUSTER_INTEGRATION_COMPONENTS =~ /\bapi-security\b/