diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml index 751067f..a5f09de 100644 --- a/.gitlab-ci.yml +++ b/.gitlab-ci.yml @@ -1,20 +1,21 @@ # You can override the included template(s) by including variable overrides # SAST customization: https://docs.gitlab.com/ee/user/application_security/sast/#customizing-the-sast-settings # Secret Detection customization: https://docs.gitlab.com/ee/user/application_security/secret_detection/#customizing-settings +# Dependency Scanning customization: https://docs.gitlab.com/ee/user/application_security/dependency_scanning/#customizing-the-dependency-scanning-settings +# Container Scanning customization: https://docs.gitlab.com/ee/user/application_security/container_scanning/#customizing-the-container-scanning-settings # Note that environment variables can be set in several places # See https://docs.gitlab.com/ee/ci/variables/#cicd-variable-precedence -image: docker:19.03 +image: docker:git services: -- docker:19.03-dind +- docker:dind variables: DOCKER_HOST: tcp://docker:2376 DOCKER_TLS_CERTDIR: "/certs" - stages: +- commit - build - test - deploy - build: stage: build before_script: @@ -22,28 +23,27 @@ build: script: - docker build --tag $CI_REGISTRY_IMAGE:job-$CI_PIPELINE_ID . - docker push $CI_REGISTRY_IMAGE:job-$CI_PIPELINE_ID - test: stage: test - image: $CI_REGISTRY_IMAGE:job-$CI_PIPELINE_ID + image: "$CI_REGISTRY_IMAGE:job-$CI_PIPELINE_ID" script: - python --version - nikola --version - pip --version - pip freeze - deploy: stage: deploy before_script: - - docker login -u $CI_REGISTRY_USER -p $CI_REGISTRY_PASSWORD $CI_REGISTRY + - docker login -u $CI_REGISTRY_USER -p $CI_REGISTRY_PASSWORD $CI_REGISTRY script: - - docker pull $CI_REGISTRY_IMAGE:job-$CI_PIPELINE_ID - - docker tag $CI_REGISTRY_IMAGE:job-$CI_PIPELINE_ID $CI_REGISTRY_IMAGE:latest - - docker push $CI_REGISTRY_IMAGE:latest - - -sast: - stage: test - + - docker pull $CI_REGISTRY_IMAGE:job-$CI_PIPELINE_ID + - docker tag $CI_REGISTRY_IMAGE:job-$CI_PIPELINE_ID $CI_REGISTRY_IMAGE:latest + - docker push $CI_REGISTRY_IMAGE:latest include: - template: Security/SAST.gitlab-ci.yml +- template: Security/Container-Scanning.gitlab-ci.yml +container_scanning: + variables: + CS_IMAGE: "$CI_REGISTRY_IMAGE:job-$CI_PIPELINE_ID" +sast: + stage: test diff --git a/Dockerfile b/Dockerfile index e775e3d..74bd758 100644 --- a/Dockerfile +++ b/Dockerfile @@ -4,10 +4,10 @@ RUN apk --no-cache add sshpass openssh-client lftp; mkdir -p /opt/app WORKDIR /opt/app ADD requirements.txt /root/ ADD Dockerfile /root/ -ADD bin/deploy.sh /usr/local/bin/deploy.sh +ADD bin/*.sh /usr/local/bin/ # ignore "Running pip as root" warning ENV PIP_ROOT_USER_ACTION=ignore -RUN chmod 755 /usr/local/bin/deploy.sh && pip install -r /root/requirements.txt && pip freeze && rm -Rf "$(pip cache dir)" +RUN chmod 755 /usr/local/bin/*.sh && pip install -r /root/requirements.txt && pip freeze && rm -Rf "$(pip cache dir)" diff --git a/bin/build.sh b/bin/build.sh new file mode 100644 index 0000000..727aa8f --- /dev/null +++ b/bin/build.sh @@ -0,0 +1,18 @@ +#!/bin/sh + +if ! test -d website +then + echo "Website directory not found" + exit 1 +fi + +if ! command -v nikola >/dev/null 2>&1 +then + echo "nikola command not found" + exit 1 +fi + +cd website + +nikola build +exit "$?" diff --git a/requirements.txt b/requirements.txt index ca82f01..7516d19 100644 --- a/requirements.txt +++ b/requirements.txt @@ -5,3 +5,8 @@ Jinja2 aiohttp watchdog python-dotenv +rstcheck +docutils +esbonio +pytz +certifi-linux \ No newline at end of file