131 lines
3.8 KiB
YAML
131 lines
3.8 KiB
YAML
image: docker:19.03.1
|
|
|
|
variables:
|
|
DOCKER_HOST: tcp://localhost:2375
|
|
DOCKER_TLS_CERTDIR: ''
|
|
DEV_CONTAINER_REGISTRY: eu.gcr.io/vnc-development/vnc-hybridauth-api:development
|
|
IMAGE_TAG: eu.gcr.io/vnc-development/vnc-hybridauth-api:development-$CI_COMMIT_SHORT_SHA
|
|
IMAGE_TAG_PROD: eu.gcr.io/vnc-dev-275609/vnc-hybridauth-api:production
|
|
IMAGE_TAG_STABLE: eu.gcr.io/vnc-stable/vnc-hybridauth-api:stable
|
|
|
|
services:
|
|
- docker:19.03.1-dind
|
|
|
|
stages:
|
|
- build_deb
|
|
- docker
|
|
- scan
|
|
- notification
|
|
|
|
deb:
|
|
image: eu.gcr.io/vnc-development/docker-vnc-deb-builder:latest
|
|
stage: build_deb
|
|
script:
|
|
- yarn cache clean
|
|
- yarn install
|
|
- echo 'Packaging deb'
|
|
- ls -la
|
|
- git fetch --tags
|
|
- makechangelog.uxf > debian/changelog && cat debian/changelog
|
|
- sed -n 1p debian/changelog | grep -oP '\(.*?\)' > version.txt
|
|
- echo '####################################################'
|
|
- cat version.txt
|
|
- echo '####################################################'
|
|
- rm config/vnc-hybrid-authenticator.js
|
|
- cp -P conf.template/vnc-hybridauth2.js config/vnc-hybrid-authenticator.js
|
|
- (cd debian; debuild --check-dirname-level 0 --no-tgz-check --no-lintian -us -uc)
|
|
- ls -la ../
|
|
- scp ../*.deb repo@newpackages.vnc.biz:/srv/repo/apt/incoming/
|
|
- ssh repo@newpackages.vnc.biz /srv/repo/bin/import-new-packages.sh
|
|
only:
|
|
- master
|
|
|
|
dev_deploy:
|
|
before_script:
|
|
- base64 -d $SA_Development | docker login -u _json_key --password-stdin https://eu.gcr.io
|
|
stage: docker
|
|
artifacts:
|
|
public: false
|
|
expire_in: 12h
|
|
paths:
|
|
- scan
|
|
script:
|
|
- docker build -t $IMAGE_TAG .
|
|
- docker push $IMAGE_TAG
|
|
- mkdir -p
|
|
- docker image save $IMAGE_TAG -o scan/hybridauth.tgz
|
|
only:
|
|
- master
|
|
|
|
dev_trivy:
|
|
image: eu.gcr.io/vnc-development/docker-vnc-runner:latest
|
|
stage: scan
|
|
script:
|
|
- apt -y update
|
|
- apt -y install wget apt-transport-https gnupg lsb-release
|
|
- wget -qO - https://aquasecurity.github.io/trivy-repo/deb/public.key | apt-key add -
|
|
- echo "deb https://aquasecurity.github.io/trivy-repo/deb $(lsb_release -sc) main" >> /etc/apt/sources.list.d/trivy.list
|
|
- apt -y update
|
|
- apt -y install trivy
|
|
- trivy image --input scan/hybridauth.tgz
|
|
only:
|
|
- master
|
|
|
|
|
|
|
|
prod_deploy:
|
|
before_script:
|
|
- base64 -d $SA_Production | docker login -u _json_key --password-stdin https://eu.gcr.io
|
|
stage: docker
|
|
script:
|
|
- echo $CI_COMMIT_TAG
|
|
- COMMIT_VERSION=$(echo $CI_COMMIT_TAG | awk -F'prod-' '{print $2}')
|
|
- echo $COMMIT_VERSION
|
|
|
|
- DEV_TAG=$DEV_CONTAINER_REGISTRY-$COMMIT_VERSION
|
|
- echo $DEV_TAG
|
|
- docker pull $DEV_TAG
|
|
- PROD_IMAGE=$IMAGE_TAG_PROD-$COMMIT_VERSION
|
|
- docker tag $DEV_TAG $PROD_IMAGE
|
|
- docker push $PROD_IMAGE
|
|
rules:
|
|
- if: $CI_COMMIT_TAG =~ /^prod-.*/
|
|
|
|
stable_deploy:
|
|
before_script:
|
|
- base64 -d $SA_Production | docker login -u _json_key --password-stdin https://eu.gcr.io
|
|
stage: docker
|
|
script:
|
|
- echo $CI_COMMIT_TAG
|
|
- COMMIT_VERSION=$(echo $CI_COMMIT_TAG | awk -F'stable-' '{print $2}')
|
|
- echo $COMMIT_VERSION
|
|
|
|
- DEV_TAG=$DEV_CONTAINER_REGISTRY-$COMMIT_VERSION
|
|
- echo $DEV_TAG
|
|
- docker pull $DEV_TAG
|
|
- STABLE_IMAGE=$IMAGE_TAG_STABLE-$COMMIT_VERSION
|
|
- docker tag $DEV_TAG $STABLE_IMAGE
|
|
- docker push $STABLE_IMAGE
|
|
rules:
|
|
- if: $CI_COMMIT_TAG =~ /^stable-.*/
|
|
|
|
successful-results:
|
|
image: eu.gcr.io/vnc-development/docker-vnc-deb-builder:latest
|
|
stage: notification
|
|
script:
|
|
- echo "SUCCESS" > result.txt
|
|
- ./tools/nagnotify.sh || echo "done"
|
|
rules:
|
|
- if: '$CI_COMMIT_BRANCH == "master"'
|
|
when: on_success
|
|
|
|
failed-results:
|
|
image: eu.gcr.io/vnc-development/docker-vnc-deb-builder:latest
|
|
stage: notification
|
|
script:
|
|
- echo "FAILURE" > result.txt
|
|
- ./tools/nagnotify.sh || echo "done"
|
|
rules:
|
|
- if: '$CI_COMMIT_BRANCH == "master"'
|
|
when: on_failure
|