mirror of
https://github.com/kasmtech/workspaces-core-images.git
synced 2026-07-18 00:45:59 +00:00
a74b289186
QA-211 increase trivy timeout and added retries Closes QA-211 See merge request kasm-technologies/internal/workspaces-core-images!335
417 lines
12 KiB
Text
417 lines
12 KiB
Text
############
|
|
# Settings #
|
|
############
|
|
image: docker:28.0.0
|
|
services:
|
|
- docker:28.0.0-dind
|
|
stages:
|
|
- readme
|
|
- revert
|
|
- build
|
|
- scan
|
|
- test
|
|
- manifest
|
|
default:
|
|
retry: 2
|
|
variables:
|
|
KASM_RELEASE: "{{ KASM_RELEASE }}"
|
|
TEST_INSTALLER: "{{ TEST_INSTALLER }}"
|
|
DOCKER_HOST: tcp://docker:2375
|
|
DOCKER_TLS_CERTDIR: ""
|
|
MIRROR_ORG_NAME: "{{ MIRROR_ORG_NAME }}"
|
|
before_script:
|
|
- docker login --username $DOCKER_HUB_USERNAME --password $DOCKER_HUB_PASSWORD
|
|
- if [ "$CI_COMMIT_REF_PROTECTED" == "true" ]; then docker login --username $QUAY_USERNAME --password $QUAY_PASSWORD quay.io; fi
|
|
- if [ "$CI_COMMIT_REF_PROTECTED" == "true" ]; then docker login --username $GHCR_USERNAME --password $GHCR_PASSWORD ghcr.io; fi
|
|
- export SANITIZED_BRANCH="$(echo ${CI_COMMIT_REF_NAME:0:64} | sed -r 's#^release/##' | sed 's/\//_/g')"
|
|
|
|
.run_rules:
|
|
rules:
|
|
- if: >
|
|
$README_USERNAME ||
|
|
$README_PASSWORD ||
|
|
$QUAY_API_KEY ||
|
|
$DOCKERHUB_REVERT ||
|
|
$REVERT_IS_ROLLING
|
|
when: never
|
|
|
|
###############################################
|
|
# Build Containers and push to cache endpoint #
|
|
###############################################
|
|
{% for IMAGE in multiImages %}
|
|
build_{{ IMAGE.name1 }}_{{ IMAGE.name2 }}:
|
|
stage: build
|
|
extends: .run_rules
|
|
rules:
|
|
- !reference [.run_rules, rules]
|
|
- if: $PARENT_PIPELINE_SOURCE == "schedule" && $RUN_SET == "schedule"
|
|
when: never
|
|
- if: $CI_COMMIT_REF_NAME == "develop" || $CI_COMMIT_REF_NAME =~ /^release\/.*$/
|
|
when: always
|
|
- if: $PARENT_PIPELINE_SOURCE == "merge_request_event"
|
|
when: always
|
|
{% if FILE_LIMITS %}- changes:
|
|
{% for FILE in files %}- {{ FILE }}
|
|
{% endfor %}{% for FILE in IMAGE.changeFiles %}- {{ FILE }}
|
|
{% endfor %}{% endif %}
|
|
- when: never
|
|
script:
|
|
- apk add bash
|
|
- bash ci-scripts/build.sh "{{ IMAGE.name1 }}" "{{ IMAGE.name2 }}" "{{ IMAGE.base }}" "{{ IMAGE.bg }}" "{{ IMAGE.distro }}" "{{ IMAGE.dockerfile }}"
|
|
tags:
|
|
- ${TAG}
|
|
retry: 1
|
|
parallel:
|
|
matrix:
|
|
- TAG: [ oci-amd-scheduled, oci-arm-scheduled ]
|
|
{% endfor %}
|
|
|
|
{% for IMAGE in singleImages %}
|
|
build_{{ IMAGE.name1 }}_{{ IMAGE.name2 }}:
|
|
stage: build
|
|
extends: .run_rules
|
|
rules:
|
|
- !reference [.run_rules, rules]
|
|
- if: $PARENT_PIPELINE_SOURCE == "schedule" && $RUN_SET == "schedule"
|
|
when: never
|
|
- if: $CI_COMMIT_REF_NAME == "develop" || $CI_COMMIT_REF_NAME =~ /^release\/.*$/
|
|
when: always
|
|
- if: $PARENT_PIPELINE_SOURCE == "merge_request_event"
|
|
when: always
|
|
{% if FILE_LIMITS %}- changes:
|
|
{% for FILE in files %}- {{ FILE }}
|
|
{% endfor %}{% for FILE in IMAGE.changeFiles %}- {{ FILE }}
|
|
{% endfor %}{% endif %}
|
|
- when: never
|
|
script:
|
|
- apk add bash
|
|
- bash ci-scripts/build.sh "{{ IMAGE.name1 }}" "{{ IMAGE.name2 }}" "{{ IMAGE.base }}" "{{ IMAGE.bg }}" "{{ IMAGE.distro }}" "{{ IMAGE.dockerfile }}"
|
|
tags:
|
|
- oci-amd-scheduled
|
|
retry: 1
|
|
{% endfor %}
|
|
|
|
######################################
|
|
# Test containers and upload results #
|
|
######################################
|
|
{% for IMAGE in multiImages %}
|
|
test_{{ IMAGE.name1 }}_{{ IMAGE.name2 }}:
|
|
stage: test
|
|
extends: .run_rules
|
|
rules:
|
|
- !reference [.run_rules, rules]
|
|
- if: $PARENT_PIPELINE_SOURCE == "schedule" && $RUN_SET == "schedule"
|
|
when: never
|
|
- if: $CI_COMMIT_REF_NAME == "develop" || $CI_COMMIT_REF_NAME =~ /^release\/.*$/
|
|
when: always
|
|
- if: $PARENT_PIPELINE_SOURCE == "merge_request_event"
|
|
when: always
|
|
{% if FILE_LIMITS %}- changes:
|
|
{% for FILE in files %}- {{ FILE }}
|
|
{% endfor %}{% for FILE in IMAGE.changeFiles %}- {{ FILE }}
|
|
{% endfor %}{% endif %}
|
|
script:
|
|
- apk add bash
|
|
- bash ci-scripts/test.sh "{{ IMAGE.name1 }}" "{{ IMAGE.name2 }}" "{{ IMAGE.base }}" "{{ IMAGE.bg }}" "{{ IMAGE.distro }}" "{{ IMAGE.dockerfile }}" "${ARCH}" "${EC2_LAUNCHER_ID}" "${EC2_LAUNCHER_SECRET}"
|
|
needs:
|
|
- build_{{ IMAGE.name1 }}_{{ IMAGE.name2 }}
|
|
tags:
|
|
- oci-amd-scheduled
|
|
retry: 1
|
|
parallel:
|
|
matrix:
|
|
- ARCH: [ "x86_64", "aarch64" ]
|
|
{% endfor %}
|
|
|
|
{% for IMAGE in singleImages %}
|
|
test_{{ IMAGE.name1 }}_{{ IMAGE.name2 }}:
|
|
stage: test
|
|
extends: .run_rules
|
|
rules:
|
|
- !reference [.run_rules, rules]
|
|
- if: $PARENT_PIPELINE_SOURCE == "schedule" && $RUN_SET == "schedule"
|
|
when: never
|
|
- if: $CI_COMMIT_REF_NAME == "develop" || $CI_COMMIT_REF_NAME =~ /^release\/.*$/
|
|
when: always
|
|
- if: $PARENT_PIPELINE_SOURCE == "merge_request_event"
|
|
when: always
|
|
{% if FILE_LIMITS %}- changes:
|
|
{% for FILE in files %}- {{ FILE }}
|
|
{% endfor %}{% for FILE in IMAGE.changeFiles %}- {{ FILE }}
|
|
{% endfor %}{% endif %}
|
|
script:
|
|
- apk add bash
|
|
- bash ci-scripts/test.sh "{{ IMAGE.name1 }}" "{{ IMAGE.name2 }}" "{{ IMAGE.base }}" "{{ IMAGE.bg }}" "{{ IMAGE.distro }}" "{{ IMAGE.dockerfile }}" "x86_64" "${EC2_LAUNCHER_ID}" "${EC2_LAUNCHER_SECRET}"
|
|
needs:
|
|
- build_{{ IMAGE.name1 }}_{{ IMAGE.name2 }}
|
|
tags:
|
|
- oci-amd-scheduled
|
|
retry: 1
|
|
{% endfor %}
|
|
|
|
######################################
|
|
# Vulnerability Scans #
|
|
######################################
|
|
{% for IMAGE in multiImages %}
|
|
scan_{{ IMAGE.name1 }}_{{ IMAGE.name2 }}:
|
|
stage: scan
|
|
rules:
|
|
- if: >
|
|
$README_USERNAME ||
|
|
$README_PASSWORD ||
|
|
$QUAY_API_KEY
|
|
when: never
|
|
- if: $PARENT_PIPELINE_SOURCE == "schedule" && $RUN_SET == "schedule"
|
|
when: never
|
|
- if: $CI_COMMIT_REF_NAME == "develop" || $CI_COMMIT_REF_NAME =~ /^release\/.*$/
|
|
when: always
|
|
- if: $PARENT_PIPELINE_SOURCE == "merge_request_event"
|
|
when: always
|
|
{% if FILE_LIMITS %}- changes:
|
|
{% for FILE in files %}- {{ FILE }}
|
|
{% endfor %}{% for FILE in IMAGE.changeFiles %}- {{ FILE }}
|
|
{% endfor %}{% endif %}
|
|
script:
|
|
- apk add bash
|
|
- (cd ci-scripts && bash download-trivy)
|
|
- bash ci-scripts/scan image ${ORG_NAME}/image-cache-private:$(arch)-core-{{ IMAGE.name1 }}-{{ IMAGE.name2 }}-${SANITIZED_BRANCH}-${CI_PIPELINE_ID}
|
|
needs:
|
|
- build_{{ IMAGE.name1 }}_{{ IMAGE.name2 }}
|
|
tags:
|
|
- oci-amd-scheduled
|
|
retry: 1
|
|
artifacts:
|
|
reports:
|
|
junit:
|
|
- $CI_PROJECT_DIR/trivy-report.xml
|
|
parallel:
|
|
matrix:
|
|
- ARCH: [ "x86_64", "aarch64" ]
|
|
{% endfor %}
|
|
|
|
{% for IMAGE in singleImages %}
|
|
scan_{{ IMAGE.name1 }}_{{ IMAGE.name2 }}:
|
|
stage: scan
|
|
rules:
|
|
- if: >
|
|
$README_USERNAME ||
|
|
$README_PASSWORD ||
|
|
$QUAY_API_KEY
|
|
when: never
|
|
- if: $PARENT_PIPELINE_SOURCE == "schedule" && $RUN_SET == "schedule"
|
|
when: never
|
|
- if: $CI_COMMIT_REF_NAME == "develop" || $CI_COMMIT_REF_NAME =~ /^release\/.*$/
|
|
when: always
|
|
- if: $PARENT_PIPELINE_SOURCE == "merge_request_event"
|
|
when: always
|
|
{% if FILE_LIMITS %}- changes:
|
|
{% for FILE in files %}- {{ FILE }}
|
|
{% endfor %}{% for FILE in IMAGE.changeFiles %}- {{ FILE }}
|
|
{% endfor %}{% endif %}
|
|
script:
|
|
- apk add bash
|
|
- (cd ci-scripts && bash download-trivy)
|
|
- bash ci-scripts/scan image ${ORG_NAME}/image-cache-private:x86_64-core-{{ IMAGE.name1 }}-{{ IMAGE.name2 }}-${SANITIZED_BRANCH}-${CI_PIPELINE_ID}
|
|
needs:
|
|
- build_{{ IMAGE.name1 }}_{{ IMAGE.name2 }}
|
|
artifacts:
|
|
reports:
|
|
junit:
|
|
- $CI_PROJECT_DIR/trivy-report.xml
|
|
tags:
|
|
- oci-amd-scheduled
|
|
retry: 1
|
|
{% endfor %}
|
|
|
|
############################################
|
|
# Manifest Containers if their test passed #
|
|
############################################
|
|
{% for IMAGE in multiImages %}
|
|
manifest_{{ IMAGE.name1 }}_{{ IMAGE.name2 }}:
|
|
stage: manifest
|
|
extends: .run_rules
|
|
rules:
|
|
- !reference [.run_rules, rules]
|
|
- if: $PARENT_PIPELINE_SOURCE == "schedule" && $RUN_SET == "schedule"
|
|
when: never
|
|
- if: $CI_COMMIT_REF_NAME == "develop" || $CI_COMMIT_REF_NAME =~ /^release\/.*$/
|
|
when: always
|
|
- if: $PARENT_PIPELINE_SOURCE == "merge_request_event"
|
|
when: always
|
|
{% if FILE_LIMITS %}- changes:
|
|
{% for FILE in files %}- {{ FILE }}
|
|
{% endfor %}{% for FILE in IMAGE.changeFiles %}- {{ FILE }}
|
|
{% endfor %}{% endif %}
|
|
variables:
|
|
SCHEDULED: "{{ SCHEDULED }}"
|
|
SCHEDULE_NAME: "{{ SCHEDULE_NAME }}"
|
|
script:
|
|
- apk add bash
|
|
- bash ci-scripts/manifest.sh "{{ IMAGE.name1 }}" "{{ IMAGE.name2 }}" "multi"
|
|
needs:
|
|
- test_{{ IMAGE.name1 }}_{{ IMAGE.name2 }}
|
|
tags:
|
|
- oci-amd-scheduled
|
|
{% endfor %}
|
|
|
|
{% for IMAGE in singleImages %}
|
|
manifest_{{ IMAGE.name1 }}_{{ IMAGE.name2 }}:
|
|
stage: manifest
|
|
extends: .run_rules
|
|
rules:
|
|
- !reference [.run_rules, rules]
|
|
- if: $PARENT_PIPELINE_SOURCE == "schedule" && $RUN_SET == "schedule"
|
|
when: never
|
|
- if: $CI_COMMIT_REF_NAME == "develop" || $CI_COMMIT_REF_NAME =~ /^release\/.*$/
|
|
when: always
|
|
- if: $PARENT_PIPELINE_SOURCE == "merge_request_event"
|
|
when: always
|
|
{% if FILE_LIMITS %}- changes:
|
|
{% for FILE in files %}- {{ FILE }}
|
|
{% endfor %}{% for FILE in IMAGE.changeFiles %}- {{ FILE }}
|
|
{% endfor %}{% endif %}
|
|
variables:
|
|
SCHEDULED: "{{ SCHEDULED }}"
|
|
SCHEDULE_NAME: "{{ SCHEDULE_NAME }}"
|
|
script:
|
|
- apk add bash
|
|
- bash ci-scripts/manifest.sh "{{ IMAGE.name1 }}" "{{ IMAGE.name2 }}" "single"
|
|
needs:
|
|
- test_{{ IMAGE.name1 }}_{{ IMAGE.name2 }}
|
|
tags:
|
|
- oci-amd-scheduled
|
|
{% endfor %}
|
|
|
|
#############################
|
|
# Manifest for Weekly Build #
|
|
#############################
|
|
|
|
{% for IMAGE in multiImages %}
|
|
manifest_weekly_{{ IMAGE.name1 }}_{{ IMAGE.name2 }}:
|
|
stage: manifest
|
|
rules:
|
|
- if: >
|
|
$README_USERNAME ||
|
|
$README_PASSWORD ||
|
|
$QUAY_API_KEY ||
|
|
$DOCKERHUB_REVERT ||
|
|
$REVERT_IS_ROLLING
|
|
when: never
|
|
- if: $PARENT_PIPELINE_SOURCE == "schedule" && $RUN_SET == "schedule"
|
|
when: always
|
|
- when: never
|
|
script:
|
|
- apk add bash tar
|
|
- bash ci-scripts/weekly-manifest.sh "{{ IMAGE.name1 }}" "{{ IMAGE.name2 }}" "multi"
|
|
retry: 1
|
|
tags:
|
|
- oci-amd-scheduled
|
|
{% endfor %}
|
|
|
|
{% for IMAGE in singleImages %}
|
|
manifest_weekly_{{ IMAGE.name1 }}_{{ IMAGE.name2 }}:
|
|
stage: manifest
|
|
rules:
|
|
- if: >
|
|
$README_USERNAME ||
|
|
$README_PASSWORD ||
|
|
$QUAY_API_KEY ||
|
|
$DOCKERHUB_REVERT ||
|
|
$REVERT_IS_ROLLING
|
|
when: never
|
|
- if: $PARENT_PIPELINE_SOURCE == "schedule" && $RUN_SET == "schedule"
|
|
when: always
|
|
- when: never
|
|
script:
|
|
- apk add bash tar
|
|
- bash ci-scripts/weekly-manifest.sh "{{ IMAGE.name1 }}" "{{ IMAGE.name2 }}" "single"
|
|
retry: 1
|
|
tags:
|
|
- oci-amd-scheduled
|
|
{% endfor %}
|
|
|
|
####################
|
|
# Helper Functions #
|
|
####################
|
|
|
|
## Update Readmes ##
|
|
{% for IMAGE in multiImages %}
|
|
update_readmes_{{ IMAGE.name1 }}_{{ IMAGE.name2 }}:
|
|
stage: readme
|
|
rules:
|
|
- if: >
|
|
$README_USERNAME &&
|
|
$README_PASSWORD
|
|
when: always
|
|
script:
|
|
- apk add bash
|
|
- bash ci-scripts/readme.sh "{{ IMAGE.name1 }}" "{{ IMAGE.name2 }}"
|
|
tags:
|
|
- oci-amd-scheduled
|
|
{% endfor %}
|
|
|
|
{% for IMAGE in singleImages %}
|
|
update_readmes_{{ IMAGE.name1 }}_{{ IMAGE.name2 }}:
|
|
stage: readme
|
|
rules:
|
|
- if: >
|
|
$README_USERNAME &&
|
|
$README_PASSWORD
|
|
when: always
|
|
script:
|
|
- apk add bash
|
|
- bash ci-scripts/readme.sh "{{ IMAGE.name1 }}" "{{ IMAGE.name2 }}"
|
|
tags:
|
|
- oci-amd-scheduled
|
|
{% endfor %}
|
|
|
|
{% for IMAGE in multiImages %}
|
|
update_quay_readmes_{{ IMAGE.name1 }}_{{ IMAGE.name2 }}:
|
|
stage: readme
|
|
rules:
|
|
- if: $QUAY_API_KEY
|
|
when: always
|
|
script:
|
|
- apk add bash
|
|
- bash ci-scripts/quay_readme.sh "{{ IMAGE.name1 }}" "{{ IMAGE.name2 }}"
|
|
tags:
|
|
- oci-amd-scheduled
|
|
{% endfor %}
|
|
|
|
{% for IMAGE in singleImages %}
|
|
update_quay_readmes_{{ IMAGE.name1 }}_{{ IMAGE.name2 }}:
|
|
stage: readme
|
|
rules:
|
|
- if: $QUAY_API_KEY
|
|
when: always
|
|
script:
|
|
- apk add bash
|
|
- bash ci-scripts/quay_readme.sh "{{ IMAGE.name1 }}" "{{ IMAGE.name2 }}"
|
|
tags:
|
|
- oci-amd-scheduled
|
|
{% endfor %}
|
|
|
|
## Revert Images to specific build id ##
|
|
{% for IMAGE in multiImages %}
|
|
dockerhub_revert_{{ IMAGE.name1 }}_{{ IMAGE.name2 }}:
|
|
stage: revert
|
|
rules:
|
|
- if: >
|
|
$DOCKERHUB_REVERT &&
|
|
$REVERT_IS_ROLLING
|
|
when: always
|
|
script:
|
|
- /bin/bash ci-scripts/manifest.sh "{{ IMAGE.name1 }}" "{{ IMAGE.name2 }}" "multi" "${DOCKERHUB_REVERT}" "${REVERT_IS_ROLLING}"
|
|
{% endfor %}
|
|
|
|
{% for IMAGE in singleImages %}
|
|
dockerhub_revert_{{ IMAGE.name1 }}_{{ IMAGE.name2 }}:
|
|
stage: revert
|
|
rules:
|
|
- if: >
|
|
$DOCKERHUB_REVERT &&
|
|
$REVERT_IS_ROLLING
|
|
when: always
|
|
script:
|
|
- /bin/bash ci-scripts/manifest.sh "{{ IMAGE.name1 }}" "{{ IMAGE.name2 }}" "single" "${DOCKERHUB_REVERT}" "${REVERT_IS_ROLLING}"
|
|
{% endfor %}
|