From 7aea489a71dc9d07db0e5b1c5eefae6a44a7c2a0 Mon Sep 17 00:00:00 2001 From: Hector Date: Wed, 21 Jun 2023 15:13:39 +0000 Subject: [PATCH 1/3] Configure Dependency Scanning in `.gitlab-ci.yml`, creating this file if it does not already exist --- .gitlab-ci.yml | 67 ++++++++++++++++++++++++-------------------------- 1 file changed, 32 insertions(+), 35 deletions(-) diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml index a6423c6..8e54b93 100644 --- a/.gitlab-ci.yml +++ b/.gitlab-ci.yml @@ -1,70 +1,67 @@ +# You can override the included template(s) by including variable overrides +# SAST customization: https://docs.gitlab.com/ee/user/application_security/sast/#customizing-the-sast-settings +# Secret Detection customization: https://docs.gitlab.com/ee/user/application_security/secret_detection/#customizing-settings +# Dependency Scanning customization: https://docs.gitlab.com/ee/user/application_security/dependency_scanning/#customizing-the-dependency-scanning-settings +# Container Scanning customization: https://docs.gitlab.com/ee/user/application_security/container_scanning/#customizing-the-container-scanning-settings +# Note that environment variables can be set in several places +# See https://docs.gitlab.com/ee/ci/variables/#cicd-variable-precedence stages: - - test - - build - - release - -.go_template: +- test +- build +- release +".go_template": image: golang:latest - sast: stage: test - include: - template: Security/SAST.gitlab-ci.yml - +- template: Security/Dependency-Scanning.gitlab-ci.yml format: - extends: .go_template + extends: ".go_template" stage: test script: - - make check/fmt - + - make check/fmt test: - extends: .go_template + extends: ".go_template" stage: test script: - - make test - + - make test build: - extends: .go_template + extends: ".go_template" stage: build script: - - make build + - make build artifacts: paths: - - fail2ban_exporter + - fail2ban_exporter expire_in: 1 day - release: stage: release image: docker:stable services: - - docker:dind + - docker:dind variables: - DOCKER_REGISTRY: $CI_REGISTRY - DOCKER_USERNAME: $CI_REGISTRY_USER - DOCKER_PASSWORD: $CI_REGISTRY_PASSWORD + DOCKER_REGISTRY: "$CI_REGISTRY" + DOCKER_USERNAME: "$CI_REGISTRY_USER" + DOCKER_PASSWORD: "$CI_REGISTRY_PASSWORD" GIT_DEPTH: 0 rules: - - if: $CI_COMMIT_TAG =~ /^v.*$/ + - if: "$CI_COMMIT_TAG =~ /^v.*$/" script: - - docker run --rm --privileged \ - -v $PWD:/go/src/gitlab.com/hectorjsmith/fail2ban-prometheus-exporter \ - -w /go/src/gitlab.com/hectorjsmith/fail2ban-prometheus-exporter \ - -v /var/run/docker.sock:/var/run/docker.sock \ - -e DOCKER_USERNAME -e DOCKER_PASSWORD -e DOCKER_REGISTRY \ - -e GITLAB_TOKEN \ - goreleaser/goreleaser release --clean - + - docker run --rm --privileged \ -v $PWD:/go/src/gitlab.com/hectorjsmith/fail2ban-prometheus-exporter + \ -w /go/src/gitlab.com/hectorjsmith/fail2ban-prometheus-exporter \ -v /var/run/docker.sock:/var/run/docker.sock + \ -e DOCKER_USERNAME -e DOCKER_PASSWORD -e DOCKER_REGISTRY \ -e GITLAB_TOKEN + \ goreleaser/goreleaser release --clean tag images: stage: release image: docker:stable services: - - docker:dind + - docker:dind needs: - - release + - release rules: - - if: $CI_COMMIT_TAG =~ /^v\d+\.\d+\.\d+$/ + - if: "$CI_COMMIT_TAG =~ /^v\\d+\\.\\d+\\.\\d+$/" variables: IMAGE_NAME: registry.gitlab.com/hectorjsmith/fail2ban-prometheus-exporter script: - - ./.gitlab-ci/tagLatestImage.sh + - "./.gitlab-ci/tagLatestImage.sh" From f0cbc42c866d1944372865bfccde2810f153e61b Mon Sep 17 00:00:00 2001 From: Hector Date: Wed, 21 Jun 2023 17:41:16 +0000 Subject: [PATCH 2/3] Revert "Configure Dependency Scanning in `.gitlab-ci.yml`, creating this file if it does not already exist" This reverts commit 7aea489a71dc9d07db0e5b1c5eefae6a44a7c2a0 --- .gitlab-ci.yml | 67 ++++++++++++++++++++++++++------------------------ 1 file changed, 35 insertions(+), 32 deletions(-) diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml index 8e54b93..a6423c6 100644 --- a/.gitlab-ci.yml +++ b/.gitlab-ci.yml @@ -1,67 +1,70 @@ -# You can override the included template(s) by including variable overrides -# SAST customization: https://docs.gitlab.com/ee/user/application_security/sast/#customizing-the-sast-settings -# Secret Detection customization: https://docs.gitlab.com/ee/user/application_security/secret_detection/#customizing-settings -# Dependency Scanning customization: https://docs.gitlab.com/ee/user/application_security/dependency_scanning/#customizing-the-dependency-scanning-settings -# Container Scanning customization: https://docs.gitlab.com/ee/user/application_security/container_scanning/#customizing-the-container-scanning-settings -# Note that environment variables can be set in several places -# See https://docs.gitlab.com/ee/ci/variables/#cicd-variable-precedence stages: -- test -- build -- release -".go_template": + - test + - build + - release + +.go_template: image: golang:latest + sast: stage: test + include: - template: Security/SAST.gitlab-ci.yml -- template: Security/Dependency-Scanning.gitlab-ci.yml + format: - extends: ".go_template" + extends: .go_template stage: test script: - - make check/fmt + - make check/fmt + test: - extends: ".go_template" + extends: .go_template stage: test script: - - make test + - make test + build: - extends: ".go_template" + extends: .go_template stage: build script: - - make build + - make build artifacts: paths: - - fail2ban_exporter + - fail2ban_exporter expire_in: 1 day + release: stage: release image: docker:stable services: - - docker:dind + - docker:dind variables: - DOCKER_REGISTRY: "$CI_REGISTRY" - DOCKER_USERNAME: "$CI_REGISTRY_USER" - DOCKER_PASSWORD: "$CI_REGISTRY_PASSWORD" + DOCKER_REGISTRY: $CI_REGISTRY + DOCKER_USERNAME: $CI_REGISTRY_USER + DOCKER_PASSWORD: $CI_REGISTRY_PASSWORD GIT_DEPTH: 0 rules: - - if: "$CI_COMMIT_TAG =~ /^v.*$/" + - if: $CI_COMMIT_TAG =~ /^v.*$/ script: - - docker run --rm --privileged \ -v $PWD:/go/src/gitlab.com/hectorjsmith/fail2ban-prometheus-exporter - \ -w /go/src/gitlab.com/hectorjsmith/fail2ban-prometheus-exporter \ -v /var/run/docker.sock:/var/run/docker.sock - \ -e DOCKER_USERNAME -e DOCKER_PASSWORD -e DOCKER_REGISTRY \ -e GITLAB_TOKEN - \ goreleaser/goreleaser release --clean + - docker run --rm --privileged \ + -v $PWD:/go/src/gitlab.com/hectorjsmith/fail2ban-prometheus-exporter \ + -w /go/src/gitlab.com/hectorjsmith/fail2ban-prometheus-exporter \ + -v /var/run/docker.sock:/var/run/docker.sock \ + -e DOCKER_USERNAME -e DOCKER_PASSWORD -e DOCKER_REGISTRY \ + -e GITLAB_TOKEN \ + goreleaser/goreleaser release --clean + tag images: stage: release image: docker:stable services: - - docker:dind + - docker:dind needs: - - release + - release rules: - - if: "$CI_COMMIT_TAG =~ /^v\\d+\\.\\d+\\.\\d+$/" + - if: $CI_COMMIT_TAG =~ /^v\d+\.\d+\.\d+$/ variables: IMAGE_NAME: registry.gitlab.com/hectorjsmith/fail2ban-prometheus-exporter script: - - "./.gitlab-ci/tagLatestImage.sh" + - ./.gitlab-ci/tagLatestImage.sh From 98c5315ca61af436c453145f90869a970aaed4d1 Mon Sep 17 00:00:00 2001 From: Hector Date: Wed, 21 Jun 2023 17:44:18 +0000 Subject: [PATCH 3/3] add dep scan template --- .gitlab-ci.yml | 1 + 1 file changed, 1 insertion(+) diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml index a6423c6..668d3fb 100644 --- a/.gitlab-ci.yml +++ b/.gitlab-ci.yml @@ -11,6 +11,7 @@ sast: include: - template: Security/SAST.gitlab-ci.yml +- template: Security/Dependency-Scanning.gitlab-ci.yml format: extends: .go_template