Additional Python dependencies added.

Configure SAST in `.gitlab-ci.yml`, creating this file if it does not already exist

See merge request fager/deployment-helper!3

.gitlab-ci.yml

@@ -1,20 +1,21 @@
 # You can override the included template(s) by including variable overrides
 # SAST customization: https://docs.gitlab.com/ee/user/application_security/sast/#customizing-the-sast-settings
 # Secret Detection customization: https://docs.gitlab.com/ee/user/application_security/secret_detection/#customizing-settings
+# Dependency Scanning customization: https://docs.gitlab.com/ee/user/application_security/dependency_scanning/#customizing-the-dependency-scanning-settings
+# Container Scanning customization: https://docs.gitlab.com/ee/user/application_security/container_scanning/#customizing-the-container-scanning-settings
 # Note that environment variables can be set in several places
 # See https://docs.gitlab.com/ee/ci/variables/#cicd-variable-precedence
-image: docker:19.03
+image: docker:git
 services:
-- docker:19.03-dind
+- docker:dind
 variables:
   DOCKER_HOST: tcp://docker:2376
   DOCKER_TLS_CERTDIR: "/certs"
-
 stages:
+- commit
 - build
 - test
 - deploy
-
 build:
   stage: build
   before_script:
@@ -22,28 +23,27 @@ build:
   script:
   - docker build --tag $CI_REGISTRY_IMAGE:job-$CI_PIPELINE_ID .
   - docker push $CI_REGISTRY_IMAGE:job-$CI_PIPELINE_ID
-
 test:
   stage: test
-  image: $CI_REGISTRY_IMAGE:job-$CI_PIPELINE_ID
+  image: "$CI_REGISTRY_IMAGE:job-$CI_PIPELINE_ID"
   script:
   - python --version
   - nikola --version
   - pip --version
   - pip freeze
-
 deploy:
   stage: deploy
   before_script:
-    - docker login -u $CI_REGISTRY_USER -p $CI_REGISTRY_PASSWORD $CI_REGISTRY
+  - docker login -u $CI_REGISTRY_USER -p $CI_REGISTRY_PASSWORD $CI_REGISTRY
   script:
-    - docker pull $CI_REGISTRY_IMAGE:job-$CI_PIPELINE_ID
+  - docker pull $CI_REGISTRY_IMAGE:job-$CI_PIPELINE_ID
-    - docker tag $CI_REGISTRY_IMAGE:job-$CI_PIPELINE_ID $CI_REGISTRY_IMAGE:latest
+  - docker tag $CI_REGISTRY_IMAGE:job-$CI_PIPELINE_ID $CI_REGISTRY_IMAGE:latest
-    - docker push $CI_REGISTRY_IMAGE:latest
+  - docker push $CI_REGISTRY_IMAGE:latest
-
-
-sast:
-  stage: test
-
 include:
 - template: Security/SAST.gitlab-ci.yml
+- template: Security/Container-Scanning.gitlab-ci.yml
+container_scanning:
+  variables:
+    CS_IMAGE: "$CI_REGISTRY_IMAGE:job-$CI_PIPELINE_ID"
+sast:
+  stage: test

Dockerfile

@@ -4,10 +4,10 @@ RUN apk --no-cache add sshpass openssh-client lftp; mkdir -p /opt/app
 WORKDIR /opt/app
 ADD requirements.txt /root/
 ADD Dockerfile /root/
-ADD bin/deploy.sh /usr/local/bin/deploy.sh
+ADD bin/*.sh /usr/local/bin/
 
 # ignore "Running pip as root" warning
 ENV PIP_ROOT_USER_ACTION=ignore
 
-RUN chmod 755 /usr/local/bin/deploy.sh && pip install -r /root/requirements.txt && pip freeze && rm -Rf "$(pip cache dir)"
+RUN chmod 755 /usr/local/bin/*.sh && pip install -r /root/requirements.txt && pip freeze && rm -Rf "$(pip cache dir)"
 

bin/build.sh

@@ -0,0 +1,18 @@
+#!/bin/sh
+
+if ! test -d website
+then
+    echo "Website directory not found"
+    exit 1
+fi
+
+if ! command -v nikola >/dev/null 2>&1
+then
+    echo "nikola command not found"
+    exit 1
+fi
+
+cd website
+
+nikola build
+exit "$?"

requirements.txt

@@ -5,3 +5,8 @@ Jinja2
 aiohttp
 watchdog
 python-dotenv
+rstcheck
+docutils
+esbonio
+pytz
+certifi-linux