Compare commits
1 Commits
master
...
gitea-rele
| Author | SHA1 | Date | |
|---|---|---|---|
| ab34f326d3 |
9
Makefile
9
Makefile
@ -4,10 +4,6 @@ LIGHTHOUSE_COMMAND ?=
|
||||
LIGHTHOUSE_URL ?=
|
||||
PA11Y_URL ?=
|
||||
PA11Y_REPORTER ?=
|
||||
PA11Y_USERNAME ?=
|
||||
PA11Y_PASSWORD ?=
|
||||
PA11Y_STANDARD ?=
|
||||
PA11Y_COOKIE ?=
|
||||
|
||||
image-w3af:
|
||||
docker build \
|
||||
@ -77,11 +73,6 @@ pa11y:
|
||||
-e https_proxy=$(https_proxy) \
|
||||
-e PA11Y_URL='$(PA11Y_URL)' \
|
||||
-e PA11Y_REPORTER='$(PA11Y_REPORTER)' \
|
||||
-e PA11Y_USERNAME='$(PA11Y_USERNAME)' \
|
||||
-e PA11Y_PASSWORD='$(PA11Y_PASSWORD)' \
|
||||
-e PA11Y_STANDARD='$(PA11Y_STANDARD)' \
|
||||
-e PA11Y_COOKIE='$(PA11Y_COOKIE)' \
|
||||
-e PA11Y_IGNORE='$(PA11Y_IGNORE)' \
|
||||
-u $(shell id -u $(USER)):$(shell id -g $(USER)) \
|
||||
-v "$(PWD)/data/pa11y/reports:/home/pa11y/reports" \
|
||||
$(DOCKER_ARGS) \
|
||||
|
||||
24
README.md
24
README.md
@ -2,9 +2,29 @@
|
||||
|
||||
Utilitaires pour la création de pipeline Jenkins dans l'environnement Cadoles.
|
||||
|
||||
## Documentation
|
||||
## Pipelines
|
||||
|
||||
Voir le répertoire [`./doc`](./doc)
|
||||
- [Pipeline d'empaquetage Debian](./pipelines/debian-packaging.jenkinsfile)
|
||||
|
||||
## Librairie
|
||||
|
||||
### Méthodes exposées
|
||||
|
||||
#### Création de paquets
|
||||
|
||||
- [`tamarin.buildPackage()`](./vars/tamarin.groovy#L48)
|
||||
- [`tamarin.buildPackageWithCPKG()`](./vars/tamarin.groovy#L1)
|
||||
|
||||
#### Publication de paquets
|
||||
|
||||
- [`vulcain.publish()`](./vars/vulcain.groovy#L1)
|
||||
|
||||
#### Pilotage d'OpenNebula
|
||||
|
||||
- [`nebula.initWithCredentials()`](./vars/nebula.groovy#L125)
|
||||
- [`nebula.runInNewVM() { client -> ... }`](./vars/nebula.groovy#L135)
|
||||
- [`client.findVMTemplate()`](./vars/nebula.groovy#L65)
|
||||
- [`client.withNewVM()`](./vars/nebula.groovy#L79)
|
||||
|
||||
## Licence
|
||||
|
||||
|
||||
@ -1,29 +0,0 @@
|
||||
# Documentation
|
||||
|
||||
## Tutoriels
|
||||
|
||||
- [Utilisation du pipeline `standardMakePipeline()`](./tutorials/standard-make-pipeline.md)
|
||||
|
||||
## Pipelines
|
||||
|
||||
- [Pipeline d'empaquetage Debian](../pipelines/debian-packaging.jenkinsfile)
|
||||
|
||||
## Librairie
|
||||
|
||||
### Méthodes exposées
|
||||
|
||||
#### Création de paquets
|
||||
|
||||
- [`tamarin.buildPackage()`](../vars/tamarin.groovy#L48)
|
||||
- [`tamarin.buildPackageWithCPKG()`](../vars/tamarin.groovy#L1)
|
||||
|
||||
#### Publication de paquets
|
||||
|
||||
- [`vulcain.publish()`](../vars/vulcain.groovy#L1)
|
||||
|
||||
#### Pilotage d'OpenNebula
|
||||
|
||||
- [`nebula.initWithCredentials()`](../vars/nebula.groovy#L125)
|
||||
- [`nebula.runInNewVM() { client -> ... }`](../vars/nebula.groovy#L135)
|
||||
- [`client.findVMTemplate()`](../vars/nebula.groovy#L65)
|
||||
- [`client.withNewVM()`](../vars/nebula.groovy#L79)
|
||||
@ -1,123 +0,0 @@
|
||||
# Utilisation du pipeline `standardMakePipeline()`
|
||||
|
||||
> **Note** Vous travaillez sur un projet Symfony ? Dans ce cas référez vous au tutoriel ["Utiliser le pipeline Symfony](https://forge.cadoles.com/Cadoles/Jenkins/wiki/Utiliser-le-pipeline-%22Symfony%22).
|
||||
|
||||
Le pipeline [`standardMakePipeline()`](../../vars/standardMakePipeline.groovy) a pour objectif de permettre d'obtenir simplement et rapidement un pipeline générique pour un projet de développement ou d'intégration en utilisant et respectant quelques conventions de nommage dans ses tâches `Make`.
|
||||
|
||||
Globalement, le pipeline exécute les opérations suivantes:
|
||||
|
||||
- Il exécute la commande `make build` sur votre projet;
|
||||
- Il exécute la commande `make test` sur votre projet et si votre branche est une PR, il créait un commentaire sur celle ci avec la sortie de ces tests;
|
||||
- Si votre branche est une branche de "release" (par défaut les branches `develop`, `testing` et `stable`) il exécute la commande `make release` puis diffuse une notification sur le canal `#cadoles-jenkins`.
|
||||
|
||||
Le pipeline ne présume pas des opérations réalisées par ces 3 tâches. Il ne fait que les exécuter en partant du principe que votre projet suit un cycle conventionnel de développement. Mais globalement ces tâches devraient:
|
||||
|
||||
- `make build`: Construire votre projet (installer les dépendances, générer les assets, compiler le code source le cas échéant, etc);
|
||||
- `make test`: Exécuter les tests automatisés associés à votre projet (unitaire, intégration, etc);
|
||||
- `make release`: Diffuser une nouvelle version de votre projet (construire et déployer des artefacts comme des paquets ou des images de conteneur, exécuter un déploiement Ansible, etc).
|
||||
|
||||
> **Note:** La gestion des dépendances des tâches est à la charge du développeur (voir "Comment installer les dépendances NPM avant une tâche ?" dans la FAQ pour un exemple).
|
||||
|
||||
## Utilisation
|
||||
|
||||
Afin d'utiliser le pipeline, vous devez effectuer les opérations suivantes à l'initialisation de votre projet:
|
||||
|
||||
1. Créer votre fichier `Jenkinsfile` à la racine de votre projet
|
||||
|
||||
```groovy
|
||||
@Library("cadoles") _
|
||||
|
||||
standardMakePipeline()
|
||||
```
|
||||
|
||||
2. Créer votre fichier `Makefile` à la racine de votre projet
|
||||
|
||||
```makefile
|
||||
test:
|
||||
echo "Testing my project..."
|
||||
|
||||
build:
|
||||
echo "Building my project..."
|
||||
|
||||
release:
|
||||
echo "Releasing my project..."
|
||||
```
|
||||
|
||||
3. Ajouter les deux fichiers à votre historique Git (`commit`) et pousser sur la branche de développement.
|
||||
|
||||
4. Accéder à [Jenkins](https://jenkins.cadol.es/) puis à l'organisation contenant votre projet. Dans la barre de gauche cliquer sur le bouton "Scan Gitea Organization Now"
|
||||
|
||||
> **Note:** Globalement un projet doit être partagé avec l'équipe "Bots" sur la forge afin que Jenkins puisse accéder aux sources de votre projet. Dans la majorité des organisations pré-existentes ce partage est déjà configuré.
|
||||
|
||||
5. Votre pipeline devrait s'exécuter sur Jenkins !
|
||||
|
||||
## Variables d'environnement pré-disponibles
|
||||
|
||||
Le pipeline injecte directement dans l'environnement d'exécution une série de variables d'environnement:
|
||||
|
||||
|Variable|Description|Valeurs possibles|
|
||||
|--------|-----------|-----------------|
|
||||
|`PROJECT_VERSION_TAG`|Tag conventionnel de la version du projet|Voir ["R14. Respecter le schéma d'identification des images publiées"](https://forge.cadoles.com/CadolesKube/KubeRules/wiki/Bonnes-pratiques-de-d%C3%A9veloppement-applicatif-en-vue-d%27un-d%C3%A9ploiement-sur-Kubernetes#r14-respecter-le-sch%C3%A9ma-d-identification-des-images-publi%C3%A9es)|
|
||||
|`PROJECT_VERSION_SHORT_TAG`|Tag court conventionnel de la version du projet|Voir ["R14. Respecter le schéma d'identification des images publiées"](https://forge.cadoles.com/CadolesKube/KubeRules/wiki/Bonnes-pratiques-de-d%C3%A9veloppement-applicatif-en-vue-d%27un-d%C3%A9ploiement-sur-Kubernetes#r14-respecter-le-sch%C3%A9ma-d-identification-des-images-publi%C3%A9es)|
|
||||
|`BRANCH_NAME`|Nom de la branche courante|Nom de la branche courante (préfixé par `PR-` le cas échéant)|
|
||||
|`IS_PR`|Est ce que l'exécution courante s'effectue pour une PR ?|`true` ou `false`|
|
||||
|`CI`|Est ce que l'exécution courante s'exécute sur le serveur d'intégration continue ?|`true`|
|
||||
## FAQ
|
||||
|
||||
### Comment installer des dépendances supplémentaires dans l'environnement d'exécution ?
|
||||
|
||||
Par défaut l'environnement d'exécution du pipeline est un conteneur basé sur une image Ubuntu LTS (22.04 à ce jour). Dans cette image sont installées [des dépendances de base](../../resources/com/cadoles/standard-make/Dockerfile) généralement utilisées par les projets de développement.
|
||||
|
||||
Cependant si vous avez besoin d'autres dépendances systèmes il est possible d'étendre le fichier `Dockerfile` par défaut. Pour ce faire, éditer votre fichier `Jenkinsfile`:
|
||||
|
||||
```groovy
|
||||
@Library("cadoles") _
|
||||
|
||||
// Exemple: installation du paquet ansible-lint
|
||||
// dans l'environnement d'exécution
|
||||
standardMakePipeline([
|
||||
'dockerfileExtension': '''
|
||||
RUN apt-get update -y \
|
||||
&& apt-get install -y ansible-lint
|
||||
'''
|
||||
])
|
||||
```
|
||||
|
||||
### Comment injecter des secrets dans l'environnement d'exécution ?
|
||||
|
||||
Parfois vous aurez besoin d'utiliser des secrets afin d'accéder soit à des projets privés sur la forge, soit pour publier des paquets ou des images de conteneur. Jenkins intègre [une gestion des secrets](https://jenkins.cadol.es/manage/credentials/) et ceux ci peuvent être récupérés dans votre environnement d'exécution sous diverses formes (variable d'environnement, fichiers, etc).
|
||||
|
||||
Pour ce faire, éditer votre fichier `Jenkinsfile`:
|
||||
|
||||
```groovy
|
||||
@Library("cadoles") _
|
||||
|
||||
// Exemple: récupération des identifiants du compte
|
||||
// "jenkins" sur la forge sous la forme des variables
|
||||
// d'environnement FORGE_USERNAME et FORGE_PASSWORD
|
||||
standardMakePipeline([
|
||||
'credentials': [
|
||||
usernamePassword([
|
||||
credentialsId: 'forge-jenkins',
|
||||
usernameVariable: 'FORGE_USERNAME',
|
||||
passwordVariable: 'FORGE_PASSWORD',
|
||||
]),
|
||||
]
|
||||
])
|
||||
```
|
||||
|
||||
Les différents types d'entrées possible pour le tableau `credentials` sont décris [sur cette page](https://www.jenkins.io/doc/pipeline/steps/credentials-binding/).
|
||||
|
||||
### Comment installer les dépendances NPM avant une tâche ?
|
||||
|
||||
Pour cela vous pouvez utiliser les mécanismes de gestion des dépendances intégrées à Make. Par exemple:
|
||||
|
||||
```makefile
|
||||
test: node_modules
|
||||
npm run test
|
||||
|
||||
node_modules:
|
||||
npm ci
|
||||
```
|
||||
|
||||
De cette manière Make exécutera la commande `npm ci` si et seulement si le répertoire `node_modules` n'existe pas déjà.
|
||||
@ -1,26 +0,0 @@
|
||||
#!/bin/sh
|
||||
|
||||
cleanup_docker() {
|
||||
RUNNING_CONTAINERS=$(docker ps -q)
|
||||
if [ ! -z "$RUNNING_CONTAINERS" ]; then
|
||||
docker stop $RUNNING_CONTAINERS
|
||||
fi
|
||||
|
||||
docker system prune -f -a --volumes
|
||||
docker network prune -f
|
||||
|
||||
service docker restart
|
||||
}
|
||||
|
||||
cleanup_old_workspaces() {
|
||||
# Suppression des workspaces dont la dernière date
|
||||
# de modification est supérieure à 7 jours.
|
||||
find /workspace -maxdepth 1 -type d -mtime +7 -exec rm -rf {} \;
|
||||
}
|
||||
|
||||
main() {
|
||||
cleanup_docker
|
||||
cleanup_old_workspaces
|
||||
}
|
||||
|
||||
main
|
||||
@ -3,7 +3,7 @@
|
||||
pipeline {
|
||||
|
||||
agent {
|
||||
label 'docker'
|
||||
label 'common'
|
||||
}
|
||||
|
||||
environment {
|
||||
@ -20,7 +20,6 @@ pipeline {
|
||||
stage("Prepare build environment") {
|
||||
when {
|
||||
anyOf {
|
||||
triggeredBy cause: "UserIdCause", detail: "wpetit"
|
||||
triggeredBy 'TimerTrigger'
|
||||
}
|
||||
}
|
||||
@ -43,7 +42,7 @@ pipeline {
|
||||
checkout scm:
|
||||
[
|
||||
$class: 'GitSCM',
|
||||
userRemoteConfigs: [[url: env.repository_url, credentialsId: 'jenkins-ssh-mse']],
|
||||
userRemoteConfigs: [[url: env.repository_url, credentialsId: 'jenkins-forge-ssh']],
|
||||
branches: [[name: env.ref]],
|
||||
extensions: [
|
||||
[$class: 'RelativeTargetDirectory', relativeTargetDir: env.projectDir ],
|
||||
@ -181,7 +180,6 @@ pipeline {
|
||||
post {
|
||||
always {
|
||||
sh "rm -rf '${env.projectDir}'"
|
||||
cleanWs()
|
||||
}
|
||||
}
|
||||
}
|
||||
@ -225,4 +223,4 @@ def waitForPackages(String tagRef, buildResults) {
|
||||
])
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
@ -1,13 +1,15 @@
|
||||
import hudson.tasks.test.AbstractTestResultAction
|
||||
|
||||
@Library('cadoles') _
|
||||
@Library("cadoles") _
|
||||
|
||||
pipeline {
|
||||
parameters {
|
||||
|
||||
parameters {
|
||||
text(name: 'URLS', defaultValue: 'https://msedev.crous-toulouse.fr\nhttps://msedev.crous-toulouse.fr/envole/enregistrement\nhttps://msedev.crous-toulouse.fr/envole/page/faq\nhttps://msedev.crous-toulouse.fr/envole/page/?t=liens_utiles\nhttps://msedev.crous-toulouse.fr/envole/page/?t=mentions_legales\nhttps://msedev.crous-toulouse.fr/envole/message/new\nhttps://msedev.crous-toulouse.fr/envole/recuperation/email\nhttps://msedev.crous-toulouse.fr/envole/courriel/raz', description: 'Liste des URLs à tester, une par ligne')
|
||||
string(name: 'USERNAME', defaultValue: '', description: "Nom d'utilisateur pour l'authentification Basic Auth, si nécessaire")
|
||||
password(name: 'PASSWORD', defaultValue: '', description: "Mot de passe pour l'authentification Basic Auth, si nécessaire")
|
||||
booleanParam(name: 'INCLUDE_WARNINGS', defaultValue: false, description: 'Inclure les avertissements')
|
||||
booleanParam(name: 'INCLUDE_NOTICES', defaultValue: false, description: 'Inclure les notifications')
|
||||
text(name: 'COOKIE_VALUE', defaultValue: 'mselang=fr_FR')
|
||||
}
|
||||
|
||||
options {
|
||||
@ -16,56 +18,48 @@ pipeline {
|
||||
|
||||
agent {
|
||||
node {
|
||||
label 'docker'
|
||||
label "docker"
|
||||
}
|
||||
}
|
||||
|
||||
stages {
|
||||
stage('Run RGAA audit') {
|
||||
stage("Run RGAA audit") {
|
||||
steps {
|
||||
script {
|
||||
def urls = params.URLS.split('\n')
|
||||
|
||||
def count = 0
|
||||
urls.each { u ->
|
||||
stage("Audit page '${u}'") {
|
||||
withCredentials([
|
||||
usernamePassword(
|
||||
credentialsId: 'msedev-basic-auth',
|
||||
usernameVariable: 'MSEDEV_USERNAME',
|
||||
passwordVariable: 'MSEDEV_PASSWORD'
|
||||
)
|
||||
]) {
|
||||
def report = pa11y.audit(u.trim(), [
|
||||
reporter: 'junit',
|
||||
username: env.MSEDEV_USERNAME,
|
||||
password: env.MSEDEV_PASSWORD,
|
||||
standard: 'WCAG2AA',
|
||||
includeNotices: params.INCLUDE_NOTICES,
|
||||
includeWarnings: params.INCLUDE_WARNINGS,
|
||||
cookie_value: params.COOKIE_VALUE
|
||||
])
|
||||
|
||||
writeFile file:"./report_${count}.xml", text:report
|
||||
count++
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
junit testResults: '*.xml', skipPublishingChecks: true
|
||||
|
||||
rocketSend(
|
||||
channel: '#cnous-mse',
|
||||
def urls = params.URLS.split('\n')
|
||||
|
||||
def count = 0
|
||||
urls.each { u ->
|
||||
stage("Audit page '${u}'") {
|
||||
def report = pa11y.audit(u.trim(), [
|
||||
reporter: 'junit',
|
||||
username: params.USERNAME,
|
||||
password: params.PASSWORD,
|
||||
standard: 'WCAG2AA',
|
||||
includeNotices: params.INCLUDE_NOTICES,
|
||||
includeWarnings: params.INCLUDE_WARNINGS,
|
||||
]);
|
||||
|
||||
writeFile file:"./report_${count}.xml", text:report
|
||||
count++
|
||||
}
|
||||
}
|
||||
|
||||
junit "*.xml"
|
||||
|
||||
rocketSend (
|
||||
channel: "#cnous-mse",
|
||||
avatar: 'https://jenkins.cadol.es/static/b5f67753/images/headshot.png',
|
||||
message: """
|
||||
Audit RGAA | ${testStatuses()}
|
||||
|
||||
|
||||
- [Voir les tests](${env.RUN_DISPLAY_URL})
|
||||
|
||||
@here
|
||||
""".stripIndent(),
|
||||
rawMessage: true,
|
||||
)
|
||||
|
||||
}
|
||||
}
|
||||
}
|
||||
@ -76,18 +70,21 @@ pipeline {
|
||||
cleanWs()
|
||||
}
|
||||
}
|
||||
|
||||
|
||||
|
||||
}
|
||||
|
||||
@NonCPS
|
||||
def testStatuses() {
|
||||
def testStatus = ''
|
||||
AbstractTestResultAction testResultAction = currentBuild.rawBuild.getAction(AbstractTestResultAction.class)
|
||||
if (testResultAction != null) {
|
||||
def total = testResultAction.totalCount
|
||||
def failed = testResultAction.failCount
|
||||
def skipped = testResultAction.skipCount
|
||||
def passed = total - failed - skipped
|
||||
testStatus = "Passant(s): ${passed}, Échoué(s): ${failed} ${testResultAction.failureDiffString}, Désactivé(s): ${skipped}"
|
||||
}
|
||||
return testStatus
|
||||
}
|
||||
def testStatus = ""
|
||||
AbstractTestResultAction testResultAction = currentBuild.rawBuild.getAction(AbstractTestResultAction.class)
|
||||
if (testResultAction != null) {
|
||||
def total = testResultAction.totalCount
|
||||
def failed = testResultAction.failCount
|
||||
def skipped = testResultAction.skipCount
|
||||
def passed = total - failed - skipped
|
||||
testStatus = "Passant(s): ${passed}, Échoué(s): ${failed} ${testResultAction.failureDiffString}, Désactivé(s): ${skipped}"
|
||||
}
|
||||
return testStatus
|
||||
}
|
||||
20
resources/com/cadoles/common/add-letsencrypt-ca.sh
Executable file → Normal file
20
resources/com/cadoles/common/add-letsencrypt-ca.sh
Executable file → Normal file
@ -2,24 +2,8 @@
|
||||
|
||||
set -eo pipefail
|
||||
|
||||
declare -a DESTDIR_PATHS=(
|
||||
"/usr/local/share/ca-certificates"
|
||||
"/etc/ca-certificates/trust-source/anchors"
|
||||
"/etc/pki/ca-trust/source/anchors"
|
||||
)
|
||||
|
||||
for path in "${DESTDIR_PATHS[@]}"; do
|
||||
if [ -d "$path" ]; then
|
||||
DESTDIR=$path
|
||||
break
|
||||
fi
|
||||
done
|
||||
|
||||
DESTDIR=/usr/local/share/ca-certificates
|
||||
UPDATE_CERTS_CMD=update-ca-certificates
|
||||
if [ -z "$(which $UPDATE_CERTS_CMD)" ]; then
|
||||
UPDATE_CERTS_CMD="update-ca-trust extract"
|
||||
fi
|
||||
|
||||
CERTS="$(cat <<EOF
|
||||
https://letsencrypt.org/certs/isrgrootx1.pem
|
||||
https://letsencrypt.org/certs/isrg-root-x2.pem
|
||||
@ -27,8 +11,6 @@ https://letsencrypt.org/certs/lets-encrypt-r3.pem
|
||||
https://letsencrypt.org/certs/lets-encrypt-e1.pem
|
||||
https://letsencrypt.org/certs/lets-encrypt-r4.pem
|
||||
https://letsencrypt.org/certs/lets-encrypt-e2.pem
|
||||
https://letsencrypt.org/certs/2024/r10.pem
|
||||
https://letsencrypt.org/certs/2024/r11.pem
|
||||
EOF
|
||||
)"
|
||||
|
||||
|
||||
@ -1,181 +0,0 @@
|
||||
#!/bin/bash
|
||||
|
||||
set -eo pipefail
|
||||
|
||||
GITEA_DOWNLOAD_PROJECT=${GITEA_DOWNLOAD_PROJECT}
|
||||
GITEA_DOWNLOAD_ORG=${GITEA_DOWNLOAD_ORG}
|
||||
GITEA_DOWNLOAD_BASE_URL=${GITEA_BASE_URL:-https://forge.cadoles.com}
|
||||
GITEA_DOWNLOAD_ANONYMOUS=${GITEA_DOWNLOAD_ANONYMOUS:-no}
|
||||
GITEA_DOWNLOAD_USERNAME=${GITEA_DOWNLOAD_USERNAME}
|
||||
GITEA_DOWNLOAD_PASSWORD=${GITEA_DOWNLOAD_PASSWORD}
|
||||
GITEA_DOWNLOAD_RELEASE_NAME=${GITEA_DOWNLOAD_RELEASE_NAME:-latest}
|
||||
GITEA_DOWNLOAD_TARGET_DIRECTORY=${GITEA_DOWNLOAD_TARGET_DIRECTORY:-gitea-dl}
|
||||
GITEA_DOWNLOAD_ATTACHMENTS_FILTER="${GITEA_DOWNLOAD_ATTACHMENTS_FILTER:-.*}"
|
||||
|
||||
function check_dependencies {
|
||||
assert_command_available 'curl'
|
||||
assert_command_available 'jq'
|
||||
}
|
||||
|
||||
function assert_command_available {
|
||||
local command=$1
|
||||
local command_path=$(which $command)
|
||||
|
||||
if [ -z "$command_path" ]; then
|
||||
echo "The '$command' command could not be found. Please install it before using this script." 1>&2
|
||||
exit 1
|
||||
fi
|
||||
}
|
||||
|
||||
function check_environment {
|
||||
assert_environment GITEA_DOWNLOAD_PROJECT
|
||||
assert_environment GITEA_DOWNLOAD_ORG
|
||||
assert_environment GITEA_DOWNLOAD_BASE_URL
|
||||
}
|
||||
|
||||
function source_env_file {
|
||||
if [ ! -f '.env' ]; then
|
||||
return 0
|
||||
fi
|
||||
set -o allexport
|
||||
source .env
|
||||
set +o allexport
|
||||
}
|
||||
|
||||
function assert_environment {
|
||||
local name=$1
|
||||
local value=${!name}
|
||||
|
||||
if [ -z "$value" ]; then
|
||||
echo "The $"$name" environment variable is empty." 1>&2
|
||||
exit 1
|
||||
fi
|
||||
}
|
||||
|
||||
function ask_credentials {
|
||||
if [ "${GITEA_DOWNLOAD_ANONYMOUS}" == "yes" ]; then
|
||||
return
|
||||
fi
|
||||
|
||||
if [ -z "$GITEA_DOWNLOAD_USERNAME" ]; then
|
||||
echo -n "Username: "
|
||||
read GITEA_DOWNLOAD_USERNAME
|
||||
|
||||
fi
|
||||
if [ -z "$GITEA_DOWNLOAD_PASSWORD" ]; then
|
||||
echo -n "Password: "
|
||||
stty -echo
|
||||
read GITEA_DOWNLOAD_PASSWORD
|
||||
stty echo
|
||||
echo
|
||||
fi
|
||||
}
|
||||
|
||||
function retrieve_release_name {
|
||||
if [ ! -z "$GITEA_DOWNLOAD_RELEASE_NAME" ]; then
|
||||
return
|
||||
fi
|
||||
|
||||
echo -n "Release name: "
|
||||
read GITEA_DOWNLOAD_RELEASE_NAME
|
||||
}
|
||||
|
||||
function retrieve_target_directory {
|
||||
if [ ! -z "$GITEA_DOWNLOAD_TARGET_DIRECTORY" ]; then
|
||||
return
|
||||
fi
|
||||
|
||||
echo -n "Target directory: "
|
||||
read GITEA_DOWNLOAD_TARGET_DIRECTORY
|
||||
}
|
||||
|
||||
function json_set {
|
||||
local data=$1
|
||||
local key=$2
|
||||
local value=$3
|
||||
local use_raw_file=$4
|
||||
|
||||
if [ "$use_raw_file" != "true" ]; then
|
||||
echo $data | jq -cr --argjson v "$value" --arg k "$key" '.[$k] = $v'
|
||||
else
|
||||
local tmpfile=$(mktemp)
|
||||
echo "$value" > "$tmpfile"
|
||||
echo $data | jq -cr --rawfile v "$tmpfile" --arg k "$key" '.[$k] = $v'
|
||||
rm -f "$tmpfile"
|
||||
fi
|
||||
}
|
||||
|
||||
function gitea_api {
|
||||
local path=$1
|
||||
local args=${@:2}
|
||||
|
||||
if [ "${GITEA_DOWNLOAD_ANONYMOUS}" != 'yes' ]; then
|
||||
args="-u "$GITEA_DOWNLOAD_USERNAME:$GITEA_DOWNLOAD_PASSWORD" ${args}"
|
||||
fi
|
||||
|
||||
curl -L \
|
||||
--fail \
|
||||
--ipv4 \
|
||||
-k \
|
||||
${args} \
|
||||
"$GITEA_DOWNLOAD_BASE_URL/api/v1$path"
|
||||
}
|
||||
|
||||
function gitea_download {
|
||||
local attachment_id=$1
|
||||
local output=$2
|
||||
|
||||
if [ "${GITEA_DOWNLOAD_ANONYMOUS}" != 'yes' ]; then
|
||||
GITEA_DOWNLOAD_CURL_ARGS="-u "$GITEA_DOWNLOAD_USERNAME:$GITEA_DOWNLOAD_PASSWORD" ${GITEA_DOWNLOAD_CURL_ARGS}"
|
||||
fi
|
||||
|
||||
curl -L \
|
||||
--fail \
|
||||
--ipv4 \
|
||||
-k \
|
||||
--output "$output" \
|
||||
$GITEA_DOWNLOAD_CURL_ARGS \
|
||||
"$GITEA_DOWNLOAD_BASE_URL/attachments/$attachment_id"
|
||||
}
|
||||
|
||||
function download_release_files {
|
||||
local releases=$(gitea_api "/repos/${GITEA_DOWNLOAD_ORG}/${GITEA_DOWNLOAD_PROJECT}/releases")
|
||||
|
||||
local assets
|
||||
if [ "$GITEA_DOWNLOAD_RELEASE_NAME" == "latest" ]; then
|
||||
assets=$(echo $releases | jq -r '. | sort_by(.id) | reverse | .[0].assets')
|
||||
else
|
||||
assets=$(echo $releases | jq -r --arg name "$GITEA_DOWNLOAD_RELEASE_NAME" '. | map(select( .name == $name)) | .[0].assets')
|
||||
fi
|
||||
|
||||
if [ "$assets" == "null" ]; then
|
||||
echo 1>&2 "No release found."
|
||||
exit 1
|
||||
fi
|
||||
|
||||
mkdir -p "$GITEA_DOWNLOAD_TARGET_DIRECTORY"
|
||||
|
||||
local attachment_uuids=$(echo $assets | jq -r '.[].uuid')
|
||||
for uuid in $attachment_uuids; do
|
||||
local filename=$(echo $assets | jq -r --arg uuid "$uuid" '. | map(select( .uuid == $uuid)) | .[0].name')
|
||||
|
||||
if [[ "$filename" =~ $GITEA_DOWNLOAD_ATTACHMENTS_FILTER ]]; then
|
||||
echo "Downloading attachment '$filename'"
|
||||
gitea_download "$uuid" "$GITEA_DOWNLOAD_TARGET_DIRECTORY/$filename"
|
||||
else
|
||||
echo "Ignoring attachment '$filename'"
|
||||
fi
|
||||
done
|
||||
}
|
||||
|
||||
function main {
|
||||
check_dependencies
|
||||
source_env_file
|
||||
check_environment
|
||||
ask_credentials
|
||||
retrieve_release_name
|
||||
retrieve_target_directory
|
||||
download_release_files
|
||||
}
|
||||
|
||||
main
|
||||
@ -1,161 +0,0 @@
|
||||
#!/bin/bash
|
||||
|
||||
set -eo pipefail
|
||||
|
||||
GITEA_PACKAGE_ORG=${GITEA_PACKAGE_ORG}
|
||||
GITEA_PACKAGE_BASE_URL=${GITEA_BASE_URL:-https://forge.cadoles.com}
|
||||
GITEA_PACKAGE_USERNAME=${GITEA_PACKAGE_USERNAME}
|
||||
GITEA_PACKAGE_PASSWORD=${GITEA_PACKAGE_PASSWORD}
|
||||
GITEA_PACKAGE_FILE=${GITEA_PACKAGE_FILE}
|
||||
GITEA_PACKAGE_CURL_MAX_RETRY=${GITEA_PACKAGE_CURL_MAX_RETRY:-3}
|
||||
GITEA_PACKAGE_FORCE_OVERWRITE=${GITEA_PACKAGE_FORCE_UPLOAD:-yes}
|
||||
|
||||
GITEA_PACKAGE_DEBIAN_DISTRIBUTION=${GITEA_PACKAGE_DEBIAN_DISTRIBUTION:-latest}
|
||||
GITEA_PACKAGE_DEBIAN_COMPONENT=${GITEA_PACKAGE_DEBIAN_COMPONENT:-main}
|
||||
|
||||
GITEA_PACKAGE_ALPINE_BRANCH=${GITEA_PACKAGE_ALPINE_BRANCH:-latest}
|
||||
GITEA_PACKAGE_ALPINE_REPOSITORY=${GITEA_PACKAGE_ALPINE_REPOSITORY:-main}
|
||||
|
||||
function check_dependencies {
|
||||
assert_command_available 'curl'
|
||||
}
|
||||
|
||||
function assert_command_available {
|
||||
local command=$1
|
||||
local command_path=$(which $command)
|
||||
|
||||
if [ -z "$command_path" ]; then
|
||||
echo "The '$command' command could not be found. Please install it before using this script." 1>&2
|
||||
exit 1
|
||||
fi
|
||||
}
|
||||
|
||||
function check_environment {
|
||||
assert_environment GITEA_PACKAGE_ORG
|
||||
assert_environment GITEA_PACKAGE_BASE_URL
|
||||
}
|
||||
|
||||
function source_env_file {
|
||||
if [ ! -f '.env' ]; then
|
||||
return 0
|
||||
fi
|
||||
set -o allexport
|
||||
source .env
|
||||
set +o allexport
|
||||
}
|
||||
|
||||
function assert_environment {
|
||||
local name=$1
|
||||
local value=${!name}
|
||||
|
||||
if [ -z "$value" ]; then
|
||||
echo "The $"$name" environment variable is empty." 1>&2
|
||||
exit 1
|
||||
fi
|
||||
}
|
||||
|
||||
function ask_credentials {
|
||||
if [ -z "$GITEA_PACKAGE_USERNAME" ]; then
|
||||
echo -n "Username: "
|
||||
read GITEA_PACKAGE_USERNAME
|
||||
|
||||
fi
|
||||
if [ -z "$GITEA_PACKAGE_PASSWORD" ]; then
|
||||
echo -n "Password: "
|
||||
stty -echo
|
||||
read GITEA_PACKAGE_PASSWORD
|
||||
stty echo
|
||||
echo
|
||||
fi
|
||||
}
|
||||
|
||||
function ask_package_type {
|
||||
local available_types="debian alpine redhat"
|
||||
local match=$( ( echo "$available_types" | grep -qw "$GITEA_PACKAGE_TYPE" ) && echo yes || echo no )
|
||||
while [ "$match" == "no" ] || [ -z $GITEA_PACKAGE_TYPE ]; do
|
||||
echo -n "Package type ($available_types): "
|
||||
read GITEA_PACKAGE_TYPE
|
||||
match=$( ( echo "$available_types" | grep -qw "$GITEA_PACKAGE_TYPE" ) && echo yes || echo no )
|
||||
done
|
||||
}
|
||||
|
||||
function ask_package_file {
|
||||
while [ ! -f "$GITEA_PACKAGE_FILE" ]; do
|
||||
echo -n "Package file (must be a valid path to a supported package file): "
|
||||
read GITEA_PACKAGE_FILE
|
||||
done
|
||||
|
||||
if [ -z $GITEA_PACKAGE_TYPE ]; then
|
||||
local filename=$(basename -- "$GITEA_PACKAGE_FILE")
|
||||
local extension="${filename##*.}"
|
||||
|
||||
case $extension in
|
||||
deb)
|
||||
GITEA_PACKAGE_TYPE=debian
|
||||
;;
|
||||
apk)
|
||||
GITEA_PACKAGE_TYPE=alpine
|
||||
;;
|
||||
rpm)
|
||||
GITEA_PACKAGE_TYPE=redhat
|
||||
;;
|
||||
esac
|
||||
fi
|
||||
}
|
||||
|
||||
function upload_debian_package {
|
||||
gitea_api "/api/packages/$GITEA_PACKAGE_ORG/debian/pool/$GITEA_PACKAGE_DEBIAN_DISTRIBUTION/$GITEA_PACKAGE_DEBIAN_COMPONENT/upload" \
|
||||
--upload-file "$GITEA_PACKAGE_FILE"
|
||||
}
|
||||
|
||||
function upload_alpine_package {
|
||||
gitea_api "/api/packages/$GITEA_PACKAGE_ORG/alpine/$GITEA_PACKAGE_ALPINE_BRANCH/$GITEA_PACKAGE_ALPINE_REPOSITORY" \
|
||||
--upload-file "$GITEA_PACKAGE_FILE"
|
||||
}
|
||||
|
||||
function upload_redhat_package {
|
||||
gitea_api "/api/packages/$GITEA_PACKAGE_ORG/rpm/upload" \
|
||||
--upload-file "$GITEA_PACKAGE_FILE"
|
||||
}
|
||||
|
||||
|
||||
function gitea_api {
|
||||
local path=$1
|
||||
local args=${@:2}
|
||||
|
||||
curl -L \
|
||||
--fail \
|
||||
--ipv4 \
|
||||
--progress-bar \
|
||||
--retry "$GITEA_PACKAGE_CURL_MAX_RETRY" \
|
||||
-u "$GITEA_PACKAGE_USERNAME:$GITEA_PACKAGE_PASSWORD" \
|
||||
$GITEA_PACKAGE_CURL_ARGS \
|
||||
${args} \
|
||||
"$GITEA_PACKAGE_BASE_URL$path"
|
||||
}
|
||||
|
||||
function main {
|
||||
check_dependencies
|
||||
source_env_file
|
||||
check_environment
|
||||
ask_credentials
|
||||
ask_package_file
|
||||
ask_package_type
|
||||
case $GITEA_PACKAGE_TYPE in
|
||||
debian)
|
||||
upload_debian_package
|
||||
;;
|
||||
alpine)
|
||||
upload_alpine_package
|
||||
;;
|
||||
redhat)
|
||||
upload_redhat_package
|
||||
;;
|
||||
*)
|
||||
echo "Package type '$GITEA_PACKAGE_TYPE' is not yet supported" 1>&2
|
||||
exit 1
|
||||
;;
|
||||
esac
|
||||
}
|
||||
|
||||
main
|
||||
@ -7,17 +7,12 @@ GITEA_RELEASE_ORG=${GITEA_RELEASE_ORG}
|
||||
GITEA_RELEASE_BASE_URL=${GITEA_BASE_URL:-https://forge.cadoles.com}
|
||||
GITEA_RELEASE_USERNAME=${GITEA_RELEASE_USERNAME}
|
||||
GITEA_RELEASE_PASSWORD=${GITEA_RELEASE_PASSWORD}
|
||||
GITEA_RELEASE_NAME=${GITEA_RELEASE_NAME}
|
||||
GITEA_RELEASE_VERSION=${GITEA_RELEASE_VERSION}
|
||||
GITEA_RELEASE_COMMITISH_TARGET=${GITEA_RELEASE_COMMITISH_TARGET}
|
||||
GITEA_RELEASE_IS_DRAFT=${GITEA_RELEASE_IS_DRAFT:-false}
|
||||
GITEA_RELEASE_IS_PRERELEASE=${GITEA_RELEASE_IS_PRERELEASE:-true}
|
||||
GITEA_RELEASE_BODY=${GITEA_RELEASE_BODY}
|
||||
GITEA_RELEASE_ATTACHMENTS=${GITEA_RELEASE_ATTACHMENTS}
|
||||
GITEA_RELEASE_CURL_MAX_RETRY=${GITEA_RELEASE_CURL_MAX_RETRY:-3}
|
||||
|
||||
GITEA_RELEASE_CLEANUP_PRERELEASES=${GITEA_RELEASE_CLEANUP_PRERELEASES:-true}
|
||||
GITEA_RELEASE_CLEANUP_KEPT_PRERELEASES=${GITEA_RELEASE_CLEANUP_KEPT_PRERELEASES:-3}
|
||||
|
||||
function check_dependencies {
|
||||
assert_command_available 'curl'
|
||||
@ -96,48 +91,28 @@ function retrieve_commitish_target {
|
||||
function create_release {
|
||||
local payload={}
|
||||
|
||||
payload=$(json_set "$payload" body "$GITEA_RELEASE_BODY" true)
|
||||
payload=$(json_set "$payload" body "\"$GITEA_RELEASE_BODY\"")
|
||||
payload=$(json_set "$payload" draft $GITEA_RELEASE_IS_DRAFT)
|
||||
payload=$(json_set "$payload" name "\"${GITEA_RELEASE_NAME:-$GITEA_RELEASE_VERSION}\"")
|
||||
payload=$(json_set "$payload" name "\"$GITEA_RELEASE_VERSION\"")
|
||||
payload=$(json_set "$payload" prerelease $GITEA_RELEASE_IS_PRERELEASE)
|
||||
payload=$(json_set "$payload" tag_name "\"${GITEA_RELEASE_VERSION:-$GITEA_RELEASE_COMMITISH_TARGET}\"")
|
||||
payload=$(json_set "$payload" target_commitish "\"$GITEA_RELEASE_COMMITISH_TARGET\"")
|
||||
|
||||
local existing_release=$(gitea_api "/repos/$GITEA_RELEASE_ORG/$GITEA_RELEASE_PROJECT/releases" -XGET | jq -e ".[] | select(.tag_name == \"${GITEA_RELEASE_VERSION}\") | .id")
|
||||
|
||||
if [ ! -z "${existing_release}" ]; then
|
||||
gitea_api "/repos/$GITEA_RELEASE_ORG/$GITEA_RELEASE_PROJECT/releases/${existing_release}" -XDELETE
|
||||
fi
|
||||
|
||||
local tmpfile=$(mktemp)
|
||||
|
||||
echo "$payload" > "$tmpfile"
|
||||
|
||||
gitea_api "/repos/$GITEA_RELEASE_ORG/$GITEA_RELEASE_PROJECT/releases" \
|
||||
-H "Content-Type:application/json" \
|
||||
-d "@$tmpfile"
|
||||
|
||||
rm -f "$tmpfile"
|
||||
-d "$payload"
|
||||
}
|
||||
|
||||
function json_set {
|
||||
local data=$1
|
||||
local key=$2
|
||||
local value=$3
|
||||
local use_raw_file=$4
|
||||
|
||||
if [ "$use_raw_file" != "true" ]; then
|
||||
echo $data | jq -cr --argjson v "$value" --arg k "$key" '.[$k] = $v'
|
||||
else
|
||||
local tmpfile=$(mktemp)
|
||||
echo "$value" > "$tmpfile"
|
||||
echo $data | jq -cr --rawfile v "$tmpfile" --arg k "$key" '.[$k] = $v'
|
||||
rm -f "$tmpfile"
|
||||
fi
|
||||
echo $data | jq -cr --argjson v "$value" --arg k "$key" '.[$k] = $v'
|
||||
}
|
||||
|
||||
function upload_release_attachments {
|
||||
local release_id="$1"
|
||||
local release="$1"
|
||||
local release_id=$(echo "$release" | jq -r .id)
|
||||
|
||||
if [ -z "$GITEA_RELEASE_ATTACHMENTS" ]; then
|
||||
set +e
|
||||
@ -159,32 +134,11 @@ function gitea_api {
|
||||
|
||||
curl -L \
|
||||
--fail \
|
||||
--ipv4 \
|
||||
--progress-bar \
|
||||
--retry "$GITEA_RELEASE_CURL_MAX_RETRY" \
|
||||
-u "$GITEA_RELEASE_USERNAME:$GITEA_RELEASE_PASSWORD" \
|
||||
$GITEA_RELEASE_CURL_ARGS \
|
||||
${args} \
|
||||
"$GITEA_RELEASE_BASE_URL/api/v1$path"
|
||||
}
|
||||
|
||||
function clean_prereleases {
|
||||
if [ "$GITEA_RELEASE_CLEANUP_PRERELEASES" != "true" ]; then
|
||||
return
|
||||
fi
|
||||
|
||||
local releases=$(gitea_api "/repos/$GITEA_RELEASE_ORG/$GITEA_RELEASE_PROJECT/releases")
|
||||
local to_delete=$(echo "$releases" | jq -r --arg index "$GITEA_RELEASE_CLEANUP_KEPT_PRERELEASES" '[.[] | select(.prerelease == true)] | sort_by(.created_at, .id) | reverse | .[$index | tonumber:] | .[].id')
|
||||
|
||||
echo $to_delete
|
||||
|
||||
for release_id in $to_delete; do
|
||||
gitea_api "/repos/$GITEA_RELEASE_ORG/$GITEA_RELEASE_PROJECT/releases/$release_id" \
|
||||
-X DELETE \
|
||||
-H "Content-Type:application/json"
|
||||
done
|
||||
}
|
||||
|
||||
function main {
|
||||
check_dependencies
|
||||
source_env_file
|
||||
@ -193,10 +147,7 @@ function main {
|
||||
retrieve_commitish_target
|
||||
retrieve_version
|
||||
local release=$(create_release)
|
||||
local release_id=$(echo "$release" | jq -r .id)
|
||||
sleep 1 # Wait for release creation
|
||||
upload_release_attachments "$release_id"
|
||||
clean_prereleases
|
||||
upload_release_attachments "$release"
|
||||
}
|
||||
|
||||
main
|
||||
@ -1,4 +1,4 @@
|
||||
FROM reg.cadoles.com/proxy_cache/library/golang:1.15 as envtpl
|
||||
FROM golang:1.15 as envtpl
|
||||
|
||||
ARG HTTP_PROXY=
|
||||
ARG HTTPS_PROXY=
|
||||
@ -14,7 +14,7 @@ RUN git clone https://github.com/subfuzion/envtpl /src \
|
||||
-ldflags "-X main.AppVersionMetadata=$(date -u +%s)" \
|
||||
-a -installsuffix cgo -o ./bin/envtpl ./cmd/envtpl/.
|
||||
|
||||
FROM reg.cadoles.com/proxy_cache/library/alpine:3.13
|
||||
FROM alpine:3.13
|
||||
|
||||
ARG HTTP_PROXY=
|
||||
ARG HTTPS_PROXY=
|
||||
|
||||
@ -1,4 +1,4 @@
|
||||
FROM reg.cadoles.com/proxy_cache/library/golang:1.13 as envtpl
|
||||
FROM golang:1.13 as envtpl
|
||||
|
||||
ARG HTTP_PROXY=
|
||||
ARG HTTPS_PROXY=
|
||||
@ -14,7 +14,7 @@ RUN git clone https://github.com/subfuzion/envtpl /src \
|
||||
-ldflags "-X main.AppVersionMetadata=$(date -u +%s)" \
|
||||
-a -installsuffix cgo -o ./bin/envtpl ./cmd/envtpl/.
|
||||
|
||||
FROM alpine:3.16
|
||||
FROM alpine:3.10
|
||||
|
||||
ARG HTTP_PROXY=
|
||||
ARG HTTPS_PROXY=
|
||||
@ -33,16 +33,11 @@ RUN apk add --no-cache \
|
||||
nodejs \
|
||||
npm \
|
||||
chromium \
|
||||
bash \
|
||||
curl \
|
||||
openssl \
|
||||
git
|
||||
bash
|
||||
|
||||
RUN curl -k https://forge.cadoles.com/Cadoles/Jenkins/raw/branch/master/resources/com/cadoles/common/add-letsencrypt-ca.sh | bash
|
||||
RUN PUPPETEER_SKIP_CHROMIUM_DOWNLOAD=1 npm install -g pa11y@^5.0.0 pa11y-reporter-html@^1.0.0 pa11y-reporter-junit
|
||||
|
||||
RUN PUPPETEER_SKIP_CHROMIUM_DOWNLOAD=true npm install -g pa11y git+https://forge.cadoles.com/rmasson/junit-reporter-fork.git
|
||||
|
||||
RUN adduser -D pa11y
|
||||
RUN adduser -D pa11y
|
||||
|
||||
COPY run-audit.sh /usr/local/bin/run-audit
|
||||
RUN chmod +x /usr/local/bin/run-audit
|
||||
|
||||
@ -6,10 +6,7 @@
|
||||
"headers": {
|
||||
{{if not (empty .PA11Y_USERNAME)}}
|
||||
{{ $credentials := print .PA11Y_USERNAME ":" .PA11Y_PASSWORD }}
|
||||
"Authorization": "Basic {{b64enc $credentials}}" {{if not (empty .PA11Y_COOKIE)}},{{end}}
|
||||
{{end}}
|
||||
{{if not (empty .PA11Y_COOKIE)}}
|
||||
"Cookie": "{{print .PA11Y_COOKIE}}"
|
||||
"Authorization": "Basic {{b64enc $credentials}}"
|
||||
{{end}}
|
||||
}
|
||||
}
|
||||
@ -9,8 +9,7 @@ cd reports
|
||||
|
||||
export PUPPETEER_EXECUTABLE_PATH=$(which chromium-browser)
|
||||
export PA11Y_REPORTER="${PA11Y_REPORTER:-html}"
|
||||
export PA11Y_STANDARD="${PA11Y_STANDARD:-WCAG2AA}"
|
||||
export PA11Y_IGNORE="${PA11Y_IGNORE}"
|
||||
export PA11Y_STANDARD=${PA11Y_STANDARD:-WCAG2AA}
|
||||
|
||||
PA11Y_ARGS=""
|
||||
|
||||
@ -27,5 +26,4 @@ pa11y \
|
||||
${PA11Y_ARGS} \
|
||||
--reporter "${PA11Y_REPORTER}" \
|
||||
--standard "${PA11Y_STANDARD}" \
|
||||
--ignore "${PA11Y_IGNORE}" \
|
||||
"$PA11Y_URL" || exit 0
|
||||
|
||||
@ -1,25 +0,0 @@
|
||||
{{ $serviceName := index ( .Env.IMAGE_NAME | strings.Split "/" | coll.Reverse ) 0 }}
|
||||
name: "cadoles-pod-{{ $serviceName }}"
|
||||
arch: amd64
|
||||
platform: linux
|
||||
version: "{{ strings.TrimPrefix "v" ( getenv "IMAGE_TAG" "latest" ) }}"
|
||||
version_schema: none
|
||||
version_metadata: git
|
||||
section: "{{ getenv "PACKAGE_SECTION" "default" }}"
|
||||
priority: "{{ getenv "PACKAGE_PRIORITY" "optional" }}"
|
||||
maintainer: "{{ getenv "PACKAGE_MAINTAINER" "contact@cadoles.com" }}"
|
||||
description: "{{ getenv "PACKAGE_DESCRIPTION" "" }}"
|
||||
homepage: "{{ getenv "PACKAGE_HOMEPAGE" "https://forge.cadoles.com" }}"
|
||||
license: "{{ getenv "PACKAGE_LICENCE" "GPL-3.0" }}"
|
||||
depends:
|
||||
- podman
|
||||
scripts:
|
||||
postinstall: post-install.sh
|
||||
contents:
|
||||
- packager: deb
|
||||
src: pod.service
|
||||
dst: "/usr/lib/systemd/system/cadoles-pod-{{ $serviceName }}.service"
|
||||
- packager: deb
|
||||
src: pod.conf
|
||||
dst: /etc/cadoles-pod-{{ $serviceName }}.conf
|
||||
type: config|noreplace
|
||||
@ -1 +0,0 @@
|
||||
PODMAN_ARGS="{{ getenv "PODMAN_ARGS" "" }}"
|
||||
@ -1,24 +0,0 @@
|
||||
[Unit]
|
||||
Description={{ .Env.IMAGE_NAME }} pod service
|
||||
Wants=network-online.target
|
||||
After=network-online.target
|
||||
RequiresMountsFor=/run/containers/storage
|
||||
|
||||
[Service]
|
||||
Type=simple
|
||||
Environment=PODMAN_SYSTEMD_UNIT=%n
|
||||
EnvironmentFile=-/etc/cadoles-pod-{{ .Env.IMAGE_NAME }}.conf
|
||||
Environment=IMAGE_NAME={{ .Env.IMAGE_NAME }} IMAGE_TAG={{ .Env.IMAGE_TAG }}
|
||||
PassEnvironment=PODMAN_ARGS IMAGE_NAME IMAGE_TAG
|
||||
Restart=on-failure
|
||||
TimeoutStopSec=70
|
||||
{{ if getenv "SYSTEMD_EXEC_STARTPRE" "" }}
|
||||
ExecStartPre={{ .Env.SYSTEMD_EXEC_STARTPRE }}
|
||||
{{ end }}
|
||||
ExecStart=/bin/sh -c "podman run ${PODMAN_ARGS} '${IMAGE_NAME}:${IMAGE_TAG}'"
|
||||
{{ if getenv "SYSTEMD_EXEC_STARTPOST" "" }}
|
||||
ExecStartPost={{ .Env.SYSTEMD_EXEC_STARTPOST }}
|
||||
{{ end }}
|
||||
|
||||
[Install]
|
||||
WantedBy=default.target
|
||||
@ -1,79 +0,0 @@
|
||||
#!/bin/sh
|
||||
|
||||
# Adapted from https://nfpm.goreleaser.com/tips/
|
||||
|
||||
use_systemctl="True"
|
||||
systemd_version=0
|
||||
if ! command -V systemctl >/dev/null 2>&1; then
|
||||
use_systemctl="False"
|
||||
else
|
||||
systemd_version=$( systemctl --version | head -1 | sed 's/systemd //g' | cut -d' ' -f1 )
|
||||
fi
|
||||
|
||||
SERVICE_NAME="cadoles-pod-{{ .Env.IMAGE_NAME }}"
|
||||
|
||||
cleanup() {
|
||||
if [ "${use_systemctl}" = "False" ]; then
|
||||
rm -f /usr/lib/systemd/system/$SERVICE_NAME.service
|
||||
else
|
||||
rm -f /etc/chkconfig/$SERVICE_NAME
|
||||
rm -f /etc/init.d/$SERVICE_NAME
|
||||
fi
|
||||
}
|
||||
|
||||
cleanInstall() {
|
||||
if [ "${use_systemctl}" = "False" ]; then
|
||||
if command -V chkconfig >/dev/null 2>&1; then
|
||||
chkconfig --add $SERVICE_NAME
|
||||
fi
|
||||
|
||||
service $SERVICE_NAME restart ||:
|
||||
else
|
||||
if [ "${systemd_version}" -lt 231 ]; then
|
||||
printf "\033[31m systemd version %s is less then 231, fixing the service file \033[0m\n" "${systemd_version}"
|
||||
sed -i "s/=+/=/g" /usr/lib/systemd/system/$SERVICE_NAME.service
|
||||
fi
|
||||
systemctl daemon-reload ||:
|
||||
systemctl unmask $SERVICE_NAME ||:
|
||||
systemctl preset $SERVICE_NAME ||:
|
||||
systemctl enable $SERVICE_NAME ||:
|
||||
systemctl restart $SERVICE_NAME ||:
|
||||
fi
|
||||
}
|
||||
|
||||
upgrade() {
|
||||
if [ "${use_systemctl}" = "False" ]; then
|
||||
service $SERVICE_NAME restart ||:
|
||||
else
|
||||
if [ "${systemd_version}" -lt 231 ]; then
|
||||
printf "\033[31m systemd version %s is less then 231, fixing the service file \033[0m\n" "${systemd_version}"
|
||||
sed -i "s/=+/=/g" /usr/lib/systemd/system/$SERVICE_NAME.service
|
||||
fi
|
||||
systemctl daemon-reload ||:
|
||||
systemctl restart $SERVICE_NAME ||:
|
||||
fi
|
||||
|
||||
echo 'Cleaning up unused images...'
|
||||
podman image prune -f --filter "reference={{ .Env.IMAGE_NAME }}"
|
||||
}
|
||||
|
||||
action="$1"
|
||||
if [ "$1" = "configure" ] && [ -z "$2" ]; then
|
||||
action="install"
|
||||
elif [ "$1" = "configure" ] && [ -n "$2" ]; then
|
||||
action="upgrade"
|
||||
fi
|
||||
|
||||
case "$action" in
|
||||
"1" | "install")
|
||||
cleanInstall
|
||||
;;
|
||||
"2" | "upgrade")
|
||||
upgrade
|
||||
;;
|
||||
*)
|
||||
cleanInstall
|
||||
;;
|
||||
esac
|
||||
|
||||
cleanup
|
||||
@ -1,26 +0,0 @@
|
||||
ARG JQ_VERSION=1.6
|
||||
|
||||
RUN apt-get update && \
|
||||
DEBIAN_FRONTEND=noninteractive apt-get install -y \
|
||||
wget tar curl ca-certificates \
|
||||
openssl bash git unzip build-essential gnupg
|
||||
|
||||
COPY add-letsencrypt-ca.sh /root/add-letsencrypt-ca.sh
|
||||
|
||||
RUN bash /root/add-letsencrypt-ca.sh \
|
||||
&& rm -f /root/add-letsencrypt-ca.sh
|
||||
|
||||
# Install JQ
|
||||
RUN wget -O /usr/local/bin/jq https://github.com/stedolan/jq/releases/download/jq-${JQ_VERSION}/jq-linux64 \
|
||||
&& chmod +x /usr/local/bin/jq
|
||||
|
||||
# Install Docker client
|
||||
RUN install -m 0755 -d /etc/apt/keyrings \
|
||||
&& curl -fsSL https://download.docker.com/linux/ubuntu/gpg | gpg --dearmor -o /etc/apt/keyrings/docker.gpg \
|
||||
&& chmod a+r /etc/apt/keyrings/docker.gpg \
|
||||
&& echo \
|
||||
"deb [arch="$(dpkg --print-architecture)" signed-by=/etc/apt/keyrings/docker.gpg] https://download.docker.com/linux/ubuntu \
|
||||
"$(. /etc/os-release && echo "$VERSION_CODENAME")" stable" | \
|
||||
tee /etc/apt/sources.list.d/docker.list > /dev/null \
|
||||
&& apt-get update \
|
||||
&& apt-get install -y docker-ce-cli
|
||||
@ -1,7 +1,7 @@
|
||||
ARG PHP_SECURITY_CHECKER_VERSION=1.0.0
|
||||
ARG JQ_VERSION=1.6
|
||||
|
||||
RUN apt-get update && \
|
||||
RUN apt update && \
|
||||
DEBIAN_FRONTEND=noninteractive apt-get install -y \
|
||||
wget tar curl ca-certificates \
|
||||
openssl bash git unzip \
|
||||
@ -39,9 +39,4 @@ RUN mkdir --parents /tools/phpstan \
|
||||
&& composer require --working-dir=/tools/phpstan phpstan/phpstan \
|
||||
&& ln -s /tools/phpstan/vendor/bin/phpstan /usr/local/bin/phpstan \
|
||||
&& composer require --working-dir=/tools/phpstan phpstan/phpstan-symfony \
|
||||
&& composer require --working-dir=/tools/phpstan phpstan/phpstan-doctrine
|
||||
|
||||
# Install Symfony
|
||||
RUN curl -1sLf 'https://dl.cloudsmith.io/public/symfony/stable/setup.deb.sh' | bash \
|
||||
&& apt update \
|
||||
&& DEBIAN_FRONTEND=noninteractive apt-get install -y symfony-cli
|
||||
&& composer require --working-dir=/tools/phpstan phpstan/phpstan-doctrine
|
||||
@ -1,4 +1,4 @@
|
||||
FROM reg.cadoles.com/proxy_cache/library/alpine:3.20
|
||||
FROM alpine:3.12
|
||||
|
||||
ARG HTTP_PROXY=
|
||||
ARG HTTPS_PROXY=
|
||||
@ -11,7 +11,7 @@ RUN apk add --no-cache git docker python3 bash openssl curl
|
||||
|
||||
RUN curl -k https://forge.cadoles.com/Cadoles/Jenkins/raw/branch/master/resources/com/cadoles/common/add-letsencrypt-ca.sh | bash
|
||||
|
||||
RUN git clone https://forge.cadoles.com/Cadoles/Tamarin /tamarin\
|
||||
RUN git clone http://forge.cadoles.com/Cadoles/Tamarin /tamarin\
|
||||
&& cd /tamarin\
|
||||
&& git checkout ${TAMARIN_VERSION}
|
||||
|
||||
|
||||
@ -1,56 +0,0 @@
|
||||
{{- if . }}
|
||||
{{- range . }}
|
||||
<h3>Target <code>{{ escapeXML .Target }}</code></h3>
|
||||
{{- if (eq (len .Vulnerabilities) 0) }}
|
||||
<h4>No Vulnerabilities found</h4>
|
||||
{{- else }}
|
||||
<h4>Vulnerabilities ({{ len .Vulnerabilities }})</h4>
|
||||
<table>
|
||||
<tr>
|
||||
<th>Package</th>
|
||||
<th>ID</th>
|
||||
<th>Severity</th>
|
||||
<th>Installed Version</th>
|
||||
<th>Fixed Version</th>
|
||||
</tr>
|
||||
{{- range .Vulnerabilities }}
|
||||
<tr>
|
||||
<td><code>{{ escapeXML .PkgName }}</code></td>
|
||||
<td>{{ escapeXML .VulnerabilityID }}</td>
|
||||
<td>{{ escapeXML .Severity }}</td>
|
||||
<td>{{ escapeXML .InstalledVersion }}</td>
|
||||
<td>{{ escapeXML .FixedVersion }}</td>
|
||||
</tr>
|
||||
{{- end }}
|
||||
</table>
|
||||
{{- end }}
|
||||
{{- if (eq (len .Misconfigurations ) 0) }}
|
||||
<h4>No Misconfigurations found</h4>
|
||||
{{- else }}
|
||||
<h4>Misconfigurations</h4>
|
||||
<table>
|
||||
<tr>
|
||||
<th>Type</th>
|
||||
<th>ID</th>
|
||||
<th>Check</th>
|
||||
<th>Severity</th>
|
||||
<th>Message</th>
|
||||
</tr>
|
||||
{{- range .Misconfigurations }}
|
||||
<tr>
|
||||
<td>{{ escapeXML .Type }}</td>
|
||||
<td>{{ escapeXML .ID }}</td>
|
||||
<td>{{ escapeXML .Title }}</td>
|
||||
<td>{{ escapeXML .Severity }}</td>
|
||||
<td>
|
||||
{{ escapeXML .Message }}
|
||||
<br><a href={{ escapeXML .PrimaryURL | printf "%q" }}>{{ escapeXML .PrimaryURL }}</a></br>
|
||||
</td>
|
||||
</tr>
|
||||
{{- end }}
|
||||
</table>
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- else }}
|
||||
<h3>Trivy Returned Empty Report</h3>
|
||||
{{- end }}
|
||||
@ -1,4 +1,4 @@
|
||||
FROM reg.cadoles.com/proxy_cache/library/golang:1.11.4 as envtpl
|
||||
FROM golang:1.11.4 as envtpl
|
||||
|
||||
ARG HTTP_PROXY=
|
||||
ARG HTTPS_PROXY=
|
||||
@ -14,7 +14,7 @@ RUN git clone https://github.com/subfuzion/envtpl /src \
|
||||
-ldflags "-X main.AppVersionMetadata=$(date -u +%s)" \
|
||||
-a -installsuffix cgo -o ./bin/envtpl ./cmd/envtpl/.
|
||||
|
||||
FROM reg.cadoles.com/proxy_cache/library/alpine:3.9
|
||||
FROM alpine:3.9
|
||||
|
||||
ARG HTTP_PROXY=
|
||||
ARG HTTPS_PROXY=
|
||||
|
||||
@ -1,245 +0,0 @@
|
||||
/**
|
||||
* Construit, valide et publie (optionnellement) une image Docker sur le registre Cadoles (par défaut)
|
||||
*
|
||||
* Options disponibles:
|
||||
*
|
||||
* - dockerfile - String - Chemin vers le fichier Dockerfile à utiliser pour construire l'image, par défaut "./Dockerfile"
|
||||
* - contextDir - String - Répertoire servant de "contexte" pour la construction de l'image, par défault "./"
|
||||
* - imageName - String - Nom de l'image à construire, par défaut ""
|
||||
* - imageTags - String - Tag(s) apposé(s) sur l'image après construction, par défaut tags générés par la méthode utils.getProjectVersionTags()
|
||||
* - gitCredentialsId - String - Identifiant des "credentials" Jenkins utilisés pour cloner le dépôt Git, par défaut "forge-jenkins"
|
||||
* - dockerRepository - String - Nom d'hôte du registre Docker sur lequel publier l'image, par défaut "reg.cadoles.com"
|
||||
* - dockerRepositoryCredentialsId - String - Identifiant des "credentials" Jenkins utilisés pour déployer l'image sur le registre Docker, par défault "reg.cadoles.com-jenkins"
|
||||
* - dryRun - Boolean - Désactiver/activer la publication de l'image sur le registre Docker, par défaut "true"
|
||||
* - skipVerifications - Boolean - Désactiver/activer les étapes de vérifications de qualité/sécurité de l'image Docker, par défaut "false"
|
||||
*/
|
||||
String buildAndPublishImage(Map options = [:]) {
|
||||
String dockerfile = options.get('dockerfile', './Dockerfile')
|
||||
String contextDir = options.get('contextDir', '.')
|
||||
String imageName = options.get('imageName', '')
|
||||
String gitRef = sh(returnStdout: true, script: 'git describe --always').trim()
|
||||
|
||||
List<String> defaultImageTags = utils.getProjectVersionTags() + [ "${utils.getProjectVersionDefaultChannel()}-latest" ]
|
||||
List<String> imageTags = options.get('imageTags', defaultImageTags)
|
||||
// Handle legacy imageTag parameter
|
||||
if (options.containsKey('imageTag')) {
|
||||
imageTags = [ options.get("imageTag", gitRef) ]
|
||||
}
|
||||
|
||||
String gitCredentialsId = options.get('gitCredentialsId', 'forge-jenkins')
|
||||
String dockerRepository = options.get('dockerRepository', 'reg.cadoles.com')
|
||||
String dockerRepositoryCredentialsId = options.get('dockerRepositoryCredentialsId', 'reg.cadoles.com-jenkins')
|
||||
Boolean dryRun = options.get('dryRun', true)
|
||||
Boolean skipVerifications = options.get('skipVerification', false)
|
||||
|
||||
String projectRepository = env.JOB_NAME
|
||||
if (env.BRANCH_NAME ==~ /^PR-.*$/) {
|
||||
projectRepository = env.JOB_NAME - "/${env.JOB_BASE_NAME}"
|
||||
}
|
||||
projectRepository = options.get('projectRepository', projectRepository)
|
||||
|
||||
withCredentials([
|
||||
usernamePassword([
|
||||
credentialsId: dockerRepositoryCredentialsId,
|
||||
usernameVariable: 'HUB_USERNAME',
|
||||
passwordVariable: 'HUB_PASSWORD'
|
||||
]),
|
||||
]) {
|
||||
stage('Validate Dockerfile with Hadolint') {
|
||||
utils.when(!skipVerifications) {
|
||||
runHadolintCheck(dockerfile, projectRepository)
|
||||
}
|
||||
}
|
||||
|
||||
String primaryImageTag = imageTags[0]
|
||||
|
||||
stage("Build image '${imageName}:${primaryImageTag}'") {
|
||||
git.withHTTPCredentials(gitCredentialsId) {
|
||||
sh """
|
||||
docker build \
|
||||
--build-arg="GIT_USERNAME=${env.GIT_USERNAME}" \
|
||||
--build-arg="GIT_PASSWORD=${env.GIT_PASSWORD}" \
|
||||
-t '${imageName}:${primaryImageTag}' \
|
||||
-f '${dockerfile}' \
|
||||
'${contextDir}'
|
||||
"""
|
||||
}
|
||||
}
|
||||
|
||||
stage('Validate image with Trivy') {
|
||||
utils.when(!skipVerifications) {
|
||||
runTrivyCheck("${imageName}:${primaryImageTag}", projectRepository)
|
||||
}
|
||||
}
|
||||
|
||||
stage("Login with image repository") {
|
||||
utils.when(!dryRun) {
|
||||
sh """
|
||||
echo ${env.HUB_PASSWORD} | docker login -u '${env.HUB_USERNAME}' --password-stdin '${dockerRepository}'
|
||||
"""
|
||||
}
|
||||
}
|
||||
|
||||
imageTags.each { imageTag ->
|
||||
stage("Publish image '${imageName}:${imageTag}'") {
|
||||
utils.when(!dryRun) {
|
||||
sh """
|
||||
docker tag "${imageName}:${primaryImageTag}" "${imageName}:${imageTag}"
|
||||
"""
|
||||
retry(2) {
|
||||
sh """
|
||||
docker push '${imageName}:${imageTag}'
|
||||
"""
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
}
|
||||
}
|
||||
|
||||
void runHadolintCheck(String dockerfile, String projectRepository) {
|
||||
String reportFile = ".hadolint-report-${currentBuild.startTimeInMillis}.txt"
|
||||
|
||||
try {
|
||||
validateDockerfileWithHadolint(dockerfile, ['reportFile': reportFile])
|
||||
} catch (err) {
|
||||
unstable("Dockerfile '${dockerfile}' failed linting !")
|
||||
} finally {
|
||||
String lintReport = ''
|
||||
|
||||
if (fileExists(reportFile)) {
|
||||
String report = readFile(reportFile)
|
||||
|
||||
lintReport = """${lintReport}
|
||||
|
|
||||
|```
|
||||
|${report.trim() ? report : "Rien à signaler."}
|
||||
|```"""
|
||||
} else {
|
||||
lintReport = """${lintReport}
|
||||
|
|
||||
|_Vérification échouée mais aucun rapport trouvé !?_ :thinking:"""
|
||||
}
|
||||
|
||||
String defaultReport = '_Rien à signaler !_ :thumbsup:'
|
||||
String report = """## Rapport d'analyse du fichier `${dockerfile}` avec [Hadolint](https://github.com/hadolint/hadolint)
|
||||
|
|
||||
|${lintReport ?: defaultReport}
|
||||
""".stripMargin()
|
||||
|
||||
print report
|
||||
|
||||
if (env.CHANGE_ID) {
|
||||
gitea.commentPullRequest(projectRepository, env.CHANGE_ID, report)
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
String validateDockerfileWithHadolint(String dockerfile, Map options = [:]) {
|
||||
String hadolintBin = getOrInstallHadolint(options)
|
||||
String hadolintArgs = options.get('hadolintArgs', '--no-color')
|
||||
String reportFile = options.get('reportFile', ".hadolint-report-${currentBuild.startTimeInMillis}.txt")
|
||||
|
||||
sh("""#!/bin/bash
|
||||
set -eo pipefail
|
||||
'${hadolintBin}' '${dockerfile}' ${hadolintArgs} | tee '${reportFile}'
|
||||
""")
|
||||
|
||||
return reportFile
|
||||
}
|
||||
|
||||
void runTrivyCheck(String imageName, String projectRepository, Map options = [:]) {
|
||||
String reportFile = ".trivy-report-${currentBuild.startTimeInMillis}.txt"
|
||||
|
||||
try {
|
||||
validateImageWithTrivy(imageName, ['reportFile': reportFile])
|
||||
} catch (err) {
|
||||
unstable("Image '${imageName}' failed validation !")
|
||||
} finally {
|
||||
String lintReport = ''
|
||||
|
||||
if (fileExists(reportFile)) {
|
||||
lintReport = """${lintReport}
|
||||
|
|
||||
|${readFile(reportFile)}
|
||||
|"""
|
||||
} else {
|
||||
lintReport = """${lintReport}
|
||||
|
|
||||
|_Vérification échouée mais aucun rapport trouvé !?_ :thinking:"""
|
||||
}
|
||||
|
||||
String defaultReport = '_Rien à signaler !_ :thumbsup:'
|
||||
String report = """## Rapport d'analyse de l'image avec [Trivy](https://github.com/aquasecurity/trivy)
|
||||
|
|
||||
|${lintReport ?: defaultReport}
|
||||
""".stripMargin()
|
||||
|
||||
print report
|
||||
|
||||
if (env.CHANGE_ID) {
|
||||
gitea.commentPullRequest(projectRepository, env.CHANGE_ID, report)
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
String validateImageWithTrivy(String imageName, Map options = [:]) {
|
||||
String trivyBin = getOrInstallTrivy(options)
|
||||
String trivyArgs = options.get('trivyArgs', '--exit-code 1')
|
||||
String cacheDirectory = options.get('cacheDirectory', '.trivy/.cache')
|
||||
String cacheDefaultBranch = options.get('cacheDefaultBranch', 'develop')
|
||||
Integer cacheMaxSize = options.get('cacheMaxSize', 250)
|
||||
String reportFile = options.get('reportFile', ".trivy-report-${currentBuild.startTimeInMillis}.txt")
|
||||
|
||||
String markdownTemplate = libraryResource 'com/cadoles/trivy/templates/markdown.tpl'
|
||||
writeFile file:'.trivy-markdown.tpl', text: markdownTemplate
|
||||
|
||||
cache(maxCacheSize: cacheMaxSize, defaultBranch: cacheDefaultBranch, caches: [
|
||||
[$class: 'ArbitraryFileCache', path: cacheDirectory, compressionMethod: 'TARGZ']
|
||||
]) {
|
||||
sh("'${trivyBin}' --cache-dir '${cacheDirectory}' image --ignorefile .trivyignore.yaml --format template --template '@.trivy-markdown.tpl' -o '${reportFile}' ${trivyArgs} '${imageName}'")
|
||||
}
|
||||
|
||||
return reportFile
|
||||
}
|
||||
|
||||
String getOrInstallHadolint(Map options = [:]) {
|
||||
String installDir = options.get('installDir', '/usr/local/bin')
|
||||
String version = options.get('version', '2.12.0')
|
||||
String forceDownload = options.get('forceDownload', false)
|
||||
String downloadUrl = options.get('downloadUrl', "https://github.com/hadolint/hadolint/releases/download/v${version}/hadolint-Linux-x86_64")
|
||||
|
||||
String hadolintBin = sh(returnStdout: true, script: 'which hadolint || exit 0').trim()
|
||||
if (hadolintBin == '' || forceDownload) {
|
||||
sh("""
|
||||
mkdir -p '${installDir}'
|
||||
curl -o '${installDir}/hadolint' -sSL '${downloadUrl}'
|
||||
chmod +x '${installDir}/hadolint'
|
||||
""")
|
||||
|
||||
hadolintBin = "${installDir}/hadolint"
|
||||
}
|
||||
|
||||
return hadolintBin
|
||||
}
|
||||
|
||||
String getOrInstallTrivy(Map options = [:]) {
|
||||
String installDir = options.get('installDir', '/usr/local/bin')
|
||||
String version = options.get('version', '0.47.0')
|
||||
String forceDownload = options.get('forceDownload', false)
|
||||
String installScriptDownloadUrl = options.get('downloadUrl', 'https://raw.githubusercontent.com/aquasecurity/trivy/main/contrib/install.sh')
|
||||
|
||||
String trivyBin = sh(returnStdout: true, script: 'which trivy || exit 0').trim()
|
||||
if (trivyBin == '' || forceDownload) {
|
||||
sh("""
|
||||
mkdir -p '${installDir}'
|
||||
curl -sfL '${installScriptDownloadUrl}' | sh -s -- -b '${installDir}' v${version}
|
||||
chmod +x '${installDir}/trivy'
|
||||
""")
|
||||
|
||||
trivyBin = "${installDir}/trivy"
|
||||
}
|
||||
|
||||
return trivyBin
|
||||
}
|
||||
@ -1,8 +1,8 @@
|
||||
import java.util.regex.Matcher
|
||||
|
||||
// Basic port of https://forge.cadoles.com/Cadoles/cpkg
|
||||
def call(Map params = [:]) {
|
||||
|
||||
def currentRef = sh(script: 'git rev-parse HEAD', returnStdout: true).trim()
|
||||
def baseRef = params.baseRef ? params.baseRef : currentRef
|
||||
def distRepo = params.distRepo ? params.distRepo : 'dev'
|
||||
def dist = params.dist ? params.dist : 'eole'
|
||||
def distVersion = params.distVersion ? params.distVersion : '2.7.0'
|
||||
@ -12,7 +12,7 @@ def call(Map params = [:]) {
|
||||
def gitEmail = params.gitEmail ? params.gitEmail : 'jenkins@cadoles.com'
|
||||
def gitUsername = params.gitUsername ? params.gitUsername : 'Jenkins'
|
||||
def skipCi = params.containsKey('skipCi') ? params.skipCi : false
|
||||
def skipPush = params.containsKey('skipPush') ? params.skipPush : true
|
||||
def skipPush = params.containsKey('skipPush') ? params.skipPush: true
|
||||
|
||||
// Define dist branch based on provided informations and base branch name
|
||||
def distBranch = "dist/${dist}/${distVersion}/${distBranchName}"
|
||||
@ -28,7 +28,7 @@ def call(Map params = [:]) {
|
||||
sh("git config --add remote.origin.fetch +refs/heads/${distBranch}:refs/remotes/origin/${distBranch}")
|
||||
|
||||
// Update branches
|
||||
sh('git fetch --all')
|
||||
sh("git fetch --all")
|
||||
|
||||
// Merge currentRef into distBranch and push
|
||||
sh("git checkout -b '${distBranch}' 'origin/${distBranch}'")
|
||||
@ -40,11 +40,11 @@ def call(Map params = [:]) {
|
||||
sh("git merge ${currentRef}")
|
||||
|
||||
if (!skipPush) {
|
||||
sh('git push')
|
||||
sh("git push")
|
||||
} else {
|
||||
println("Skipping push. Set skipPush param to 'true' to enable remote repository update.")
|
||||
}
|
||||
|
||||
|
||||
// Retrieve last tag matching pattern pkg/${distRepo}/${dist}-${distVersion}/*
|
||||
def lastTag = sh(
|
||||
script: "git tag -l 'pkg/${distRepo}/${dist}-${distVersion}/*' --sort=v:refname | tail -n 1",
|
||||
@ -61,25 +61,7 @@ def call(Map params = [:]) {
|
||||
|
||||
println("Last version number is '${lastVersionNumber}'")
|
||||
|
||||
String versionRoot = extractVersionRoot(lastVersionNumber)
|
||||
String versionNumber = ''
|
||||
|
||||
if (versionRoot) {
|
||||
versionNumber = versionRoot
|
||||
} else {
|
||||
versionNumber = sh(
|
||||
script: "git describe --always ${currentRef}",
|
||||
returnStdout: true,
|
||||
).split('/').last().trim()
|
||||
|
||||
Boolean isCommitRef = !versionNumber.matches(/^[0-9]+\.[0-9]+\.[0-9]+.*$/)
|
||||
|
||||
if (isCommitRef) {
|
||||
versionNumber = "0.0.0-${versionNumber}"
|
||||
}
|
||||
}
|
||||
|
||||
versionNumber = "${versionNumber}-${env.BUILD_NUMBER}"
|
||||
def versionNumber = incrementVersionNumber(lastVersionNumber)
|
||||
|
||||
println("New version number will be '${versionNumber}'")
|
||||
result['newVersionNumber'] = versionNumber
|
||||
@ -89,16 +71,16 @@ def call(Map params = [:]) {
|
||||
|
||||
result['newTag'] = tag
|
||||
|
||||
def tagComment = "Build ${versionNumber} ${distRepo} package for ${dist}-${distVersion}."
|
||||
def tagComment="Build ${versionNumber} ${distRepo} package for ${dist}-${distVersion}."
|
||||
if (skipCi) {
|
||||
tagComment += ' [ci skip]'
|
||||
}
|
||||
|
||||
sh("git tag -f -a '${tag}' -m '${tagComment}'")
|
||||
sh("git tag -a '${tag}' -m '${tagComment}'")
|
||||
|
||||
// Push tag
|
||||
if (!skipPush) {
|
||||
sh('git push --tags -f')
|
||||
sh("git push --tags")
|
||||
} else {
|
||||
println("Skipping push. Set skipPush param to 'true' to enable remote repository update.")
|
||||
}
|
||||
@ -126,13 +108,20 @@ def call(Map params = [:]) {
|
||||
return result
|
||||
}
|
||||
|
||||
@NonCPS
|
||||
String extractVersionRoot(String fullVersion) {
|
||||
Matcher fullVersionMatcher = fullVersion =~ /^([0-9]+\.[0-9]+\.[0-9]+).*$/
|
||||
|
||||
if (!fullVersionMatcher.matches()) {
|
||||
return ""
|
||||
}
|
||||
def incrementVersionNumber(String versionNumber) {
|
||||
// Split versionNumber (typical pattern: <major>.<minor>.<patch>)
|
||||
def versionNumberParts = versionNumber.split(/\./)
|
||||
|
||||
return fullVersionMatcher.group(1)
|
||||
}
|
||||
// Extract path number
|
||||
def patchNumber = versionNumberParts.last()
|
||||
|
||||
// Split patch number (typical pattern: <patch>-<build>)
|
||||
def patchNumberParts = patchNumber.split('-')
|
||||
|
||||
// If version number matches pattern <major>.<minor>.<patch>-<build>
|
||||
if (patchNumberParts.size() > 1) {
|
||||
return versionNumberParts[0..-2].join('.') + '.' + patchNumberParts[0..-2].join('-') + '-' + (patchNumberParts.last().toInteger() + 1)
|
||||
} else { // Else version number matches pattern <major>.<minor>.<patch>
|
||||
return versionNumberParts[0..-2].join('.') + '.' + (patchNumber.toInteger() + 1)
|
||||
}
|
||||
}
|
||||
@ -52,7 +52,7 @@ def listRepoPackages(Map params = [:]) {
|
||||
def type = params.type ? params.type : 'binary'
|
||||
def arch = params.arch ? params.arch : 'amd64'
|
||||
|
||||
def response = httpRequest(ignoreSslErrors: true, url: "${baseURL}/dists/${distrib}/${component}/${type}-${arch}/Packages")
|
||||
def response = httpRequest(url: "${baseURL}/dists/${distrib}/${component}/${type}-${arch}/Packages")
|
||||
|
||||
def packages = [:]
|
||||
def lines = response.content.split('\n')
|
||||
|
||||
@ -1,4 +1,4 @@
|
||||
def commentPullRequest(String repo, String issueId, String comment, Integer commentIndex = -1) {
|
||||
def commentPullRequest(String repo, String issueId, String comment, Integer commentIndex = 0) {
|
||||
comment = comment.replaceAll('"', '\\"')
|
||||
withCredentials([
|
||||
string(credentialsId: 'GITEA_JENKINS_PERSONAL_TOKEN', variable: 'GITEA_TOKEN'),
|
||||
@ -7,17 +7,13 @@ def commentPullRequest(String repo, String issueId, String comment, Integer comm
|
||||
sh """#!/bin/bash
|
||||
set -xeo pipefail
|
||||
|
||||
previous_comment_id=null
|
||||
|
||||
if [ "${commentIndex}" != "-1" ]; then
|
||||
# Récupération si il existe du commentaire existant
|
||||
previous_comment_id=\$(curl -v --fail \
|
||||
-H "Authorization: token ${GITEA_TOKEN}" \
|
||||
-H "Content-Type: application/json" \
|
||||
https://forge.cadoles.com/api/v1/repos/${repo}/issues/${issueId}/comments \
|
||||
| jq -c '[ .[] | select(.user.login=="jenkins") ] | .[${commentIndex}] | .id' \
|
||||
)
|
||||
fi
|
||||
# Récupération si il existe du commentaire existant
|
||||
previous_comment_id=\$(curl -v --fail \
|
||||
-H "Authorization: token ${GITEA_TOKEN}" \
|
||||
-H "Content-Type: application/json" \
|
||||
https://forge.cadoles.com/api/v1/repos/${repo}/issues/${issueId}/comments \
|
||||
| jq -c '[ .[] | select(.user.login=="jenkins") ] | .[${commentIndex}] | .id' \
|
||||
)
|
||||
|
||||
# Génération du payload pour l'API Gitea
|
||||
echo '{}' | jq -c --rawfile body .prComment '.body = \$body' > payload.json
|
||||
@ -44,15 +40,14 @@ def commentPullRequest(String repo, String issueId, String comment, Integer comm
|
||||
}
|
||||
|
||||
// Effectue une "release" sur Gitea pour le <ORG>/<PROJET> donné.
|
||||
void release(String credentialsId, String org, String project, Map options = [:]) {
|
||||
Boolean isDraft = options.get('isDraft', false)
|
||||
String baseUrl = options.get('baseUrl', 'https://forge.cadoles.com')
|
||||
String defaultVersion = sh(returnStdout: true, script: 'git describe --always').trim()
|
||||
String releaseVersion = options.get('releaseVersion', defaultVersion)
|
||||
String releaseName = options.get('releaseName', releaseVersion)
|
||||
String commitishTarget = options.get('commitishTarget', env.GIT_COMMIT)
|
||||
def release(String credentialsId, String org, String project, Map options = [:]) {
|
||||
def isDraft = options.get('isDraft', false)
|
||||
def baseUrl = options.get('baseUrl', 'https://forge.cadoles.com')
|
||||
def defaultVersion = sh(returnStdout: true, script: 'git describe --always').trim()
|
||||
def releaseVersion = options.get('releaseVersion', defaultVersion)
|
||||
def commitishTarget = options.get('commitishTarget', env.GIT_COMMIT)
|
||||
|
||||
Boolean defaultIsPrerelease = true
|
||||
def defaultIsPrerelease = true
|
||||
try {
|
||||
sh(script: "git describe --exact-match ${GIT_COMMIT}")
|
||||
defaultIsPrerelease = false
|
||||
@ -60,16 +55,16 @@ void release(String credentialsId, String org, String project, Map options = [:]
|
||||
println "Could not find tag associated with commit '${GIT_COMMIT}' ! Using 'prerelease' as default."
|
||||
}
|
||||
|
||||
Boolean isPrerelease = options.get('isPrerelease', defaultIsPrerelease)
|
||||
String body = options.get('body', '')
|
||||
List<String> attachments = options.get('attachments', [])
|
||||
def isPrerelease = options.get('isPrerelease', defaultIsPrerelease)
|
||||
def body = options.get('body', '')
|
||||
def attachments = options.get('attachments', [])
|
||||
|
||||
String scriptTempDir = ".gitea-release-script-${System.currentTimeMillis()}"
|
||||
def scriptTempDir = ".gitea-release-script-${System.currentTimeMillis()}"
|
||||
sh("mkdir -p '${scriptTempDir}'")
|
||||
|
||||
String giteaReleaseScript = "${scriptTempDir}/gitea-release.sh"
|
||||
def giteaReleaseScript = "${scriptTempDir}/gitea-release.sh"
|
||||
|
||||
String giteaReleaseScriptContent = libraryResource 'com/cadoles/gitea/gitea-release.sh'
|
||||
def giteaReleaseScriptContent = libraryResource 'com/cadoles/gitea/gitea-release.sh'
|
||||
writeFile file: giteaReleaseScript, text:giteaReleaseScriptContent
|
||||
sh("chmod +x '${giteaReleaseScript}'")
|
||||
|
||||
@ -86,7 +81,6 @@ void release(String credentialsId, String org, String project, Map options = [:]
|
||||
export GITEA_RELEASE_ORG="${org}"
|
||||
export GITEA_RELEASE_BASE_URL="${baseUrl}"
|
||||
export GITEA_RELEASE_VERSION="${releaseVersion}"
|
||||
export GITEA_RELEASE_NAME="${releaseName}"
|
||||
export GITEA_RELEASE_COMMITISH_TARGET="${commitishTarget}"
|
||||
export GITEA_RELEASE_IS_DRAFT="${isDraft}"
|
||||
export GITEA_RELEASE_IS_PRERELEASE="${isPrerelease}"
|
||||
@ -101,56 +95,4 @@ void release(String credentialsId, String org, String project, Map options = [:]
|
||||
deleteDir()
|
||||
}
|
||||
}
|
||||
|
||||
rocketSend(
|
||||
avatar: 'https://jenkins.cadol.es/static/b5f67753/images/headshot.png',
|
||||
message: """
|
||||
Nouvelle version publiée pour le projet `${org}/${project}`: [${releaseName}](${baseUrl}/${org}/${project}/releases/tag/${releaseVersion})
|
||||
|
||||
[Visualiser le job](${env.RUN_DISPLAY_URL})
|
||||
|
||||
@${utils.getBuildUser()}
|
||||
""".stripIndent(),
|
||||
rawMessage: true
|
||||
)
|
||||
}
|
||||
|
||||
// Télécharge les fichiers associés à une "version" publiée sur un projet Gitea
|
||||
void download(String credentialsId, String org, String project, Map options = [:]) {
|
||||
String baseUrl = options.get('baseUrl', 'https://forge.cadoles.com')
|
||||
String releaseName = options.get('releaseName', 'latest')
|
||||
String outputDir = options.get('outputDir', 'gitea-dl')
|
||||
|
||||
String scriptTempDir = ".gitea-download-script-${System.currentTimeMillis()}"
|
||||
sh("mkdir -p '${scriptTempDir}'")
|
||||
|
||||
String giteaDownloadScript = "${scriptTempDir}/gitea-download.sh"
|
||||
|
||||
String giteaDownloadScriptContent = libraryResource 'com/cadoles/gitea/gitea-download.sh'
|
||||
writeFile file: giteaDownloadScript, text:giteaDownloadScriptContent
|
||||
sh("chmod +x '${giteaDownloadScript}'")
|
||||
|
||||
try {
|
||||
withCredentials([
|
||||
usernamePassword(
|
||||
credentialsId: credentialsId,
|
||||
usernameVariable: 'GITEA_DOWNLOAD_USERNAME',
|
||||
passwordVariable: 'GITEA_DOWNLOAD_PASSWORD'
|
||||
)
|
||||
]) {
|
||||
sh """
|
||||
export GITEA_DOWNLOAD_PROJECT="${project}"
|
||||
export GITEA_DOWNLOAD_ORG="${org}"
|
||||
export GITEA_DOWNLOAD_BASE_URL="${baseUrl}"
|
||||
export GITEA_DOWNLOAD_RELEASE_NAME="${releaseName}"
|
||||
export GITEA_DOWNLOAD_TARGET_DIRECTORY="${outputDir}"
|
||||
|
||||
${giteaDownloadScript}
|
||||
"""
|
||||
}
|
||||
} finally {
|
||||
dir(scriptTempDir) {
|
||||
deleteDir()
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
@ -1,46 +0,0 @@
|
||||
void call(String sourceTemplate, String destFile, Map env = [:], Map options = [:]) {
|
||||
String gomplateBin = getOrInstallGomplate(options)
|
||||
|
||||
sh """
|
||||
${exportEnvMap(env)}
|
||||
${gomplateBin} -f '${sourceTemplate}' > '${destFile}'
|
||||
"""
|
||||
}
|
||||
|
||||
String exportEnvMap(Map env) {
|
||||
String exports = ''
|
||||
|
||||
env.each { item ->
|
||||
exports = """
|
||||
${exports}
|
||||
export ${item.key}="${item.value}"
|
||||
"""
|
||||
}
|
||||
|
||||
return exports
|
||||
}
|
||||
|
||||
String getOrInstallGomplate(Map options = [:]) {
|
||||
String installDir = options.get('installDir', '/usr/local/bin')
|
||||
String version = options.get('version', '3.10.0')
|
||||
Boolean forceDownload = options.get('forceDownload', false)
|
||||
String downloadUrl = options.get('downloadUrl', "https://github.com/hairyhenderson/gomplate/releases/download/v${version}/gomplate_linux-amd64")
|
||||
|
||||
String gomplateBin = ''
|
||||
|
||||
lock("${env.NODE_NAME}:gomplate-install") {
|
||||
gomplateBin = sh(returnStdout: true, script: 'which gomplate || exit 0').trim()
|
||||
|
||||
if (gomplateBin == '' || forceDownload) {
|
||||
sh("""
|
||||
mkdir -p '${installDir}'
|
||||
curl -o '${installDir}/gomplate' -sSL '${downloadUrl}'
|
||||
chmod +x '${installDir}/gomplate'
|
||||
""")
|
||||
|
||||
gomplateBin = "${installDir}/gomplate"
|
||||
}
|
||||
}
|
||||
|
||||
return gomplateBin
|
||||
}
|
||||
@ -1,19 +1,15 @@
|
||||
def call(String name) {
|
||||
def filepath = "${env.WORKSPACE}/.jenkins/${name}.groovy"
|
||||
def rootDir = pwd()
|
||||
def filepath = "${rootDir}/.jenkins/${name}.groovy"
|
||||
def exists = fileExists(filepath)
|
||||
if (!exists) {
|
||||
println("No hook '${filepath}' script. Skipping.")
|
||||
return
|
||||
}
|
||||
def hook = load(filepath)
|
||||
|
||||
if (hook == null) {
|
||||
error("Hook '${filepath}' seems to be null. Did you forget to add 'return this' at the end of the script ?")
|
||||
}
|
||||
|
||||
if (hook.metaClass.respondsTo(hook, 'exec')) {
|
||||
if(hook.metaClass.respondsTo(hook, 'exec')) {
|
||||
hook.exec()
|
||||
} else {
|
||||
error("Hook script '${filepath}' exists but does not expose an exec() function.")
|
||||
}
|
||||
}
|
||||
}
|
||||
@ -1,195 +0,0 @@
|
||||
/**
|
||||
* Construit, valide et publie (optionnellement) une image Docker sur le registre Cadoles (par défaut)
|
||||
*
|
||||
* Options disponibles:
|
||||
*
|
||||
* - dockerfile - String - Chemin vers le fichier Dockerfile à utiliser pour construire l'image, par défaut "./Dockerfile"
|
||||
* - contextDir - String - Répertoire servant de "contexte" pour la construction de l'image, par défault "./"
|
||||
* - imageName - String - Nom de l'image à construire, par défaut ""
|
||||
* - imageTag - String - Tag apposé sur l'image après construction, par défaut résultat de la commande `git describe --always`
|
||||
* - gitCredentialsId - String - Identifiant des "credentials" Jenkins utilisés pour cloner le dépôt Git, par défaut "forge-jenkins"
|
||||
* - dockerRepository - String - Nom d'hôte du registre Docker sur lequel publier l'image, par défaut "reg.cadoles.com"
|
||||
* - dockerRepositoryCredentialsId - String - Identifiant des "credentials" Jenkins utilisés pour déployer l'image sur le registre Docker, par défault "reg.cadoles.com-jenkins"
|
||||
* - dryRun - Boolean - Désactiver/activer la publication de l'image sur le registre Docker, par défaut "true"
|
||||
* - skipVerifications - Boolean - Désactiver/activer les étapes de vérifications de qualité/sécurité de l'image Docker, par défaut "false"
|
||||
*/
|
||||
String buildAndPublishImage(Map options = [:]) {
|
||||
String dockerfile = options.get('dockerfile', './Dockerfile')
|
||||
String contextDir = options.get('contextDir', '.')
|
||||
String imageName = options.get('imageName', '')
|
||||
String gitRef = sh(returnStdout: true, script: 'git describe --always').trim()
|
||||
String imageTag = options.get('imageTag', gitRef)
|
||||
String gitCredentialsId = options.get('gitCredentialsId', 'forge-jenkins')
|
||||
String dockerRepository = options.get('dockerRepository', 'reg.cadoles.com')
|
||||
String dockerRepositoryCredentialsId = options.get('dockerRepositoryCredentialsId', 'reg.cadoles.com-jenkins')
|
||||
Boolean dryRun = options.get('dryRun', true)
|
||||
Boolean skipVerifications = options.get('skipVerification', false)
|
||||
String currentBranch = env.BRANCH_NAME.replaceAll("[^a-zA-Z]+","_")
|
||||
|
||||
String projectRepository = env.JOB_NAME
|
||||
if (env.BRANCH_NAME ==~ /^PR-.*$/) {
|
||||
projectRepository = env.JOB_NAME - "/${env.JOB_BASE_NAME}"
|
||||
}
|
||||
projectRepository = options.get('projectRepository', projectRepository)
|
||||
|
||||
withCredentials([
|
||||
usernamePassword([
|
||||
credentialsId: dockerRepositoryCredentialsId,
|
||||
usernameVariable: 'HUB_USERNAME',
|
||||
passwordVariable: 'HUB_PASSWORD'
|
||||
]),
|
||||
]) {
|
||||
stage('Validate Dockerfile with Hadolint') {
|
||||
utils.when(!skipVerifications) {
|
||||
runHadolintCheck(dockerfile, projectRepository)
|
||||
}
|
||||
}
|
||||
|
||||
stage("Build image '${imageName}:${imageTag}'") {
|
||||
git.withHTTPCredentials(gitCredentialsId) {
|
||||
sh """
|
||||
CURRENT_BRANCH=${currentBranch} make
|
||||
"""
|
||||
}
|
||||
}
|
||||
|
||||
stage('Validate image with Trivy') {
|
||||
utils.when(!skipVerifications) {
|
||||
sh """
|
||||
CURRENT_BRANCH=${currentBranch} make scan
|
||||
"""
|
||||
}
|
||||
}
|
||||
|
||||
stage("Publish image '${imageName}:${imageTag}'") {
|
||||
utils.when(!dryRun) {
|
||||
retry(2) {
|
||||
sh """
|
||||
CURRENT_BRANCH=${currentBranch} make release
|
||||
"""
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
void runHadolintCheck(String dockerfile, String projectRepository) {
|
||||
String reportFile = ".hadolint-report-${currentBuild.startTimeInMillis}.txt"
|
||||
|
||||
try {
|
||||
validateDockerfileWithHadolint(dockerfile, ['reportFile': reportFile])
|
||||
} catch (err) {
|
||||
unstable("Dockerfile '${dockerfile}' failed linting !")
|
||||
} finally {
|
||||
String lintReport = ''
|
||||
|
||||
if (fileExists(reportFile)) {
|
||||
lintReport = """${lintReport}
|
||||
|
|
||||
|```
|
||||
|${readFile(reportFile)}
|
||||
|```"""
|
||||
} else {
|
||||
lintReport = """${lintReport}
|
||||
|
|
||||
|_Vérification échouée mais aucun rapport trouvé !?_ :thinking:"""
|
||||
}
|
||||
|
||||
String defaultReport = '_Rien à signaler !_ :thumbsup:'
|
||||
String report = """## Validation du Dockerfile `${dockerfile}`
|
||||
|
|
||||
|${lintReport ?: defaultReport}
|
||||
""".stripMargin()
|
||||
|
||||
print report
|
||||
|
||||
if (env.CHANGE_ID) {
|
||||
gitea.commentPullRequest(projectRepository, env.CHANGE_ID, report)
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
String validateDockerfileWithHadolint(String dockerfile, Map options = [:]) {
|
||||
String hadolintBin = getOrInstallHadolint(options)
|
||||
String hadolintArgs = options.get('hadolintArgs', '--no-color')
|
||||
String reportFile = options.get('reportFile', ".hadolint-report-${currentBuild.startTimeInMillis}.txt")
|
||||
|
||||
sh("""#!/bin/bash
|
||||
set -eo pipefail
|
||||
'${hadolintBin}' '${dockerfile}' ${hadolintArgs} | tee '${reportFile}'
|
||||
""")
|
||||
|
||||
return reportFile
|
||||
}
|
||||
|
||||
void runTrivyCheck(String imageName, String projectRepository, Map options = [:]) {
|
||||
String currentBranch = env.BRANCH_NAME.replaceAll("[^a-zA-Z]+","_")
|
||||
stage("Scan with trivy '${imageName}:${imageTag}'") {
|
||||
utils.when(!dryRun) {
|
||||
retry(2) {
|
||||
sh """
|
||||
CURRENT_BRANCH=${currentBranch} make scan
|
||||
"""
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
String validateImageWithTrivy(String imageName, Map options = [:]) {
|
||||
String trivyBin = getOrInstallTrivy(options)
|
||||
String trivyArgs = options.get('trivyArgs', '--exit-code 1')
|
||||
String cacheDirectory = options.get('cacheDirectory', '.trivy/.cache')
|
||||
String cacheDefaultBranch = options.get('cacheDefaultBranch', 'develop')
|
||||
Integer cacheMaxSize = options.get('cacheMaxSize', 250)
|
||||
String reportFile = options.get('reportFile', ".trivy-report-${currentBuild.startTimeInMillis}.txt")
|
||||
|
||||
|
||||
|
||||
cache(maxCacheSize: cacheMaxSize, defaultBranch: cacheDefaultBranch, caches: [
|
||||
[$class: 'ArbitraryFileCache', path: cacheDirectory, compressionMethod: 'TARGZ']
|
||||
]) {
|
||||
sh("'${trivyBin}' --cache-dir '${cacheDirectory}' image -o '${reportFile}' ${trivyArgs} '${imageName}'")
|
||||
}
|
||||
|
||||
return reportFile
|
||||
}
|
||||
|
||||
String getOrInstallHadolint(Map options = [:]) {
|
||||
String installDir = options.get('installDir', '/usr/local/bin')
|
||||
String version = options.get('version', '2.10.0')
|
||||
String forceDownload = options.get('forceDownload', false)
|
||||
String downloadUrl = options.get('downloadUrl', "https://github.com/hadolint/hadolint/releases/download/v${version}/hadolint-Linux-x86_64")
|
||||
|
||||
String hadolintBin = sh(returnStdout: true, script: 'which hadolint || exit 0').trim()
|
||||
if (hadolintBin == '' || forceDownload) {
|
||||
sh("""
|
||||
mkdir -p '${installDir}'
|
||||
curl -o '${installDir}/hadolint' -sSL '${downloadUrl}'
|
||||
chmod +x '${installDir}/hadolint'
|
||||
""")
|
||||
|
||||
hadolintBin = "${installDir}/hadolint"
|
||||
}
|
||||
|
||||
return hadolintBin
|
||||
}
|
||||
|
||||
String getOrInstallTrivy(Map options = [:]) {
|
||||
String installDir = options.get('installDir', '/usr/local/bin')
|
||||
String version = options.get('version', '0.27.1')
|
||||
String forceDownload = options.get('forceDownload', false)
|
||||
String installScriptDownloadUrl = options.get('downloadUrl', 'https://raw.githubusercontent.com/aquasecurity/trivy/main/contrib/install.sh')
|
||||
|
||||
String trivyBin = sh(returnStdout: true, script: 'which trivy || exit 0').trim()
|
||||
if (trivyBin == '' || forceDownload) {
|
||||
sh("""
|
||||
mkdir -p '${installDir}'
|
||||
curl -sfL '${installScriptDownloadUrl}' | sh -s -- -b '${installDir}' v${version}
|
||||
chmod +x '${installDir}/trivy'
|
||||
""")
|
||||
|
||||
trivyBin = "${installDir}/trivy"
|
||||
}
|
||||
|
||||
return trivyBin
|
||||
}
|
||||
@ -1,37 +0,0 @@
|
||||
/**
|
||||
* Générer des paquets Debian, RPM, Alpine (ipk) via nfpm
|
||||
* Voir See https://nfpm.goreleaser.com/
|
||||
*
|
||||
* Options:
|
||||
* - installDir - Répertoire d'installation du binaire nfpm, par défaut /usr/local/bin
|
||||
* - version - Version de nfpm à installer, par défaut 2.15.1
|
||||
* - forceDownload - Forcer l'installation de nfpm, par défaut false
|
||||
* - config - Fichier de configuration nfpm à utiliser, par défaut nfpm.yaml
|
||||
* - target - Répertoire cible pour nfpm, par défaut ./dist
|
||||
* - packager - Limiter l'exécution de nfpm à un packager spécifique, par défaut "deb" (i.e. pas de limitation)
|
||||
*/
|
||||
void call(Map options = [:]) {
|
||||
String installDir = options.get('installDir', '/usr/local/bin')
|
||||
String version = options.get('version', '2.20.0')
|
||||
Boolean forceDownload = options.get('forceDownload', false)
|
||||
String downloadUrl = options.get('downloadUrl', "https://github.com/goreleaser/nfpm/releases/download/v${version}/nfpm_${version}_Linux_x86_64.tar.gz")
|
||||
String config = options.get('config', 'nfpm.yaml')
|
||||
String target = options.get('target', env.WORKSPACE + '/dist')
|
||||
String packager = options.get('packager', 'deb')
|
||||
|
||||
String nfpmBin = sh(returnStdout: true, script: 'which nfpm || exit 0').trim()
|
||||
if (nfpmBin == '' || forceDownload) {
|
||||
sh("""
|
||||
mkdir -p '${installDir}'
|
||||
curl -L '${downloadUrl}' > /tmp/nfpm.tar.gz
|
||||
tar -C /usr/local/bin -xzf /tmp/nfpm.tar.gz
|
||||
""")
|
||||
|
||||
nfpmBin = "${installDir}/nfpm"
|
||||
}
|
||||
|
||||
sh("""
|
||||
mkdir -p '${target}'
|
||||
${nfpmBin} package --config '${config}' ${packager ? '--packager ' + packager : ''} --target '${target}'
|
||||
""")
|
||||
}
|
||||
@ -1,13 +1,11 @@
|
||||
def audit(String url, Map params = [:]) {
|
||||
def reporter = params.reporter ? params.reporter : 'html'
|
||||
def username = params.username ? params.username : ''
|
||||
def password = params.password ? params.password : ''
|
||||
def standard = params.standard ? params.standard : 'WCAG2AA'
|
||||
def includeWarnings = params.includeWarnings ? params.includeWarnings : false
|
||||
def includeNotices = params.includeNotices ? params.includeNotices : false
|
||||
def cookie = params.cookie ? params.cookie : ''
|
||||
def ignoredRules = params.ignoredRules ? params.ignoredRules : ''
|
||||
|
||||
def username = params.username ? params.username : '';
|
||||
def password = params.password ? params.password : '';
|
||||
def standard = params.standard ? params.standard : 'WCAG2AA';
|
||||
def includeWarnings = params.includeWarnings ? params.includeWarnings : false;
|
||||
def includeNotices = params.includeNotices ? params.includeNotices : false;
|
||||
|
||||
def pa11yImage = buildDockerImage()
|
||||
|
||||
def dockerArgs = """
|
||||
@ -18,8 +16,6 @@ def audit(String url, Map params = [:]) {
|
||||
-e PA11Y_STANDARD='${standard}'
|
||||
-e PA11Y_INCLUDE_WARNINGS='${includeWarnings}'
|
||||
-e PA11Y_INCLUDE_NOTICES='${includeNotices}'
|
||||
-e PA11Y_COOKIE='${cookie}'
|
||||
-e PA11Y_IGNORE='${ignoredRules}'
|
||||
"""
|
||||
|
||||
pa11yImage.inside(dockerArgs) {
|
||||
@ -33,22 +29,24 @@ def audit(String url, Map params = [:]) {
|
||||
}
|
||||
}
|
||||
|
||||
|
||||
|
||||
def buildDockerImage() {
|
||||
dir('.pa11y') {
|
||||
dir ('.pa11y') {
|
||||
def resourceFiles = [
|
||||
'com/cadoles/pa11y/Dockerfile',
|
||||
'com/cadoles/pa11y/patty.json.tmpl',
|
||||
'com/cadoles/pa11y/run-audit.sh'
|
||||
]
|
||||
];
|
||||
|
||||
for (res in resourceFiles) {
|
||||
def fileContent = libraryResource res
|
||||
def fileName = res.substring(res.lastIndexOf('/') + 1)
|
||||
def fileName = res.substring(res.lastIndexOf("/")+1)
|
||||
writeFile file:fileName, text:fileContent
|
||||
}
|
||||
|
||||
|
||||
def safeJobName = URLDecoder.decode(env.JOB_NAME).toLowerCase().replace('/', '-').replace(' ', '-')
|
||||
def imageTag = "${safeJobName}-${env.BUILD_ID}"
|
||||
return docker.build("pa11y:${imageTag}", '.')
|
||||
return docker.build("pa11y:${imageTag}", ".")
|
||||
}
|
||||
}
|
||||
}
|
||||
@ -1,40 +0,0 @@
|
||||
String buildCadolesPodPackage(String imageName, String imageTag, Map options = [:]) {
|
||||
String destDir = options.get('destDir', env.WORKSPACE + '/dist')
|
||||
Map nfpmOptions = options.get('nfpmOptions', [:])
|
||||
|
||||
nfpmOptions['target'] = destDir
|
||||
|
||||
Map env = options.get('env', [:])
|
||||
env['IMAGE_NAME'] = imageName
|
||||
env['IMAGE_TAG'] = imageTag
|
||||
|
||||
return withPodmanPackagingTempDir {
|
||||
gomplate('post-install.sh.gotmpl', 'post-install.sh', env)
|
||||
gomplate('pod.service.gotmpl', 'pod.service', env)
|
||||
gomplate('pod.conf.gotmpl', 'pod.conf', env)
|
||||
gomplate('nfpm.yaml.gotmpl', 'nfpm.yaml', env)
|
||||
nfpm(nfpmOptions)
|
||||
}
|
||||
}
|
||||
|
||||
void withPodmanPackagingTempDir(Closure fn) {
|
||||
File tempDir = File.createTempDir()
|
||||
|
||||
tempDir.deleteOnExit()
|
||||
tempDir.mkdirs()
|
||||
|
||||
dir(tempDir.getAbsolutePath()) {
|
||||
List<String> resources = [
|
||||
'com/cadoles/podman/nfpm.yaml.gotmpl',
|
||||
'com/cadoles/podman/pod.conf.gotmpl',
|
||||
'com/cadoles/podman/pod.service.gotmpl',
|
||||
'com/cadoles/podman/post-install.sh.gotmpl',
|
||||
]
|
||||
for (res in resources) {
|
||||
String fileContent = libraryResource res
|
||||
String fileName = res.substring(res.lastIndexOf('/') + 1)
|
||||
writeFile file:fileName, text:fileContent
|
||||
}
|
||||
fn()
|
||||
}
|
||||
}
|
||||
@ -4,9 +4,9 @@ def call() {
|
||||
agent {
|
||||
label 'docker'
|
||||
}
|
||||
|
||||
|
||||
environment {
|
||||
projectDir = "${env.project_name}_${env.BUILD_ID}"
|
||||
projectDir = "${env.project_name}_${env.BUILD_ID}"
|
||||
}
|
||||
|
||||
stages {
|
||||
@ -19,21 +19,21 @@ def call() {
|
||||
steps {
|
||||
script {
|
||||
stage("Clone repository") {
|
||||
checkout scm:
|
||||
checkout scm:
|
||||
[
|
||||
$class: 'GitSCM',
|
||||
userRemoteConfigs: [[url: env.repository_url, credentialsId: 'jenkins-ssh-mse']],
|
||||
$class: 'GitSCM',
|
||||
userRemoteConfigs: [[url: env.repository_url, credentialsId: 'jenkins-forge-ssh']],
|
||||
branches: [[name: env.ref]],
|
||||
extensions: [
|
||||
[$class: 'RelativeTargetDirectory', relativeTargetDir: env.projectDir ],
|
||||
[$class: 'CloneOption', noTags: false, shallow: false, depth: 0, reference: ''],
|
||||
[$class: 'WipeWorkspace' ]
|
||||
]
|
||||
],
|
||||
changelog: false,
|
||||
],
|
||||
changelog: false,
|
||||
poll: false
|
||||
}
|
||||
|
||||
|
||||
stage("Scan project") {
|
||||
dir(env.projectDir) {
|
||||
withCredentials([
|
||||
@ -57,14 +57,14 @@ def call() {
|
||||
// avatar: 'https://jenkins.cadol.es/static/b5f67753/images/headshot.png',
|
||||
// message: """
|
||||
// Le projet ${env.project_name} a été scanné par SonarQube.
|
||||
|
||||
|
||||
// - [Voir les résultats](${env.SONARQUBE_URL}/dashboard?id=${env.sonarqubeProjectKey})
|
||||
// - [Visualiser le job](${env.RUN_DISPLAY_URL})
|
||||
|
||||
|
||||
// @${env.sender_login}
|
||||
// """.stripIndent(),
|
||||
// rawMessage: true,
|
||||
// )
|
||||
// )
|
||||
}
|
||||
}
|
||||
}
|
||||
@ -77,4 +77,4 @@ def call() {
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
@ -1,258 +0,0 @@
|
||||
import org.jenkinsci.plugins.pipeline.modeldefinition.Utils
|
||||
|
||||
void call(Map options = [:]) {
|
||||
Map hooks = options.get('hooks', [
|
||||
'pre': null,
|
||||
|
||||
'pre-test': null,
|
||||
'post-test': null,
|
||||
|
||||
'pre-build': null,
|
||||
'post-build': null,
|
||||
|
||||
'pre-release': null,
|
||||
'post-release': null,
|
||||
|
||||
'post-success': null,
|
||||
'post-always': null,
|
||||
'post-failure': null,
|
||||
])
|
||||
String testTask = options.get('testTask', 'test')
|
||||
String buildTask = options.get('buildTask', 'build')
|
||||
String releaseTask = options.get('releaseTask', 'release')
|
||||
String jobHistory = options.get('jobHistory', '5')
|
||||
|
||||
String baseDockerfile = options.get('baseDockerfile', '')
|
||||
String baseImage = options.get('baseImage', 'reg.cadoles.com/proxy_cache/library/ubuntu:22.04')
|
||||
String dockerfileExtension = options.get('dockerfileExtension', '')
|
||||
List credentials = options.get('credentials', [])
|
||||
|
||||
List<String> releaseBranches = options.get('releaseBranches', ['develop', 'testing', 'stable', 'staging', 'master'])
|
||||
|
||||
node {
|
||||
properties([
|
||||
buildDiscarder(logRotator(daysToKeepStr: jobHistory, numToKeepStr: jobHistory)),
|
||||
])
|
||||
|
||||
environment {
|
||||
// Set MKT_PROJECT_VERSION_BRANCH_NAME to Jenkins current branch name by default
|
||||
// See https://forge.cadoles.com/Cadoles/mktools project
|
||||
MKT_PROJECT_VERSION_BRANCH_NAME = env.BRANCH_NAME
|
||||
}
|
||||
|
||||
stage('Cancel older jobs') {
|
||||
int buildNumber = env.BUILD_NUMBER as int
|
||||
if (buildNumber > 1) {
|
||||
milestone(buildNumber - 1)
|
||||
}
|
||||
|
||||
milestone(buildNumber)
|
||||
}
|
||||
|
||||
stage('Checkout project') {
|
||||
checkout(scm)
|
||||
}
|
||||
|
||||
try {
|
||||
def containerImage = buildContainerImage(baseImage, baseDockerfile, dockerfileExtension)
|
||||
containerImage.inside('-v /var/run/docker.sock:/var/run/docker.sock --network host') {
|
||||
String repo = env.JOB_NAME
|
||||
if (env.BRANCH_NAME ==~ /^PR-.*$/) {
|
||||
repo = env.JOB_NAME - "/${env.JOB_BASE_NAME}"
|
||||
}
|
||||
|
||||
List<String> environment = prepareEnvironment()
|
||||
|
||||
withEnv(environment) {
|
||||
withCredentials(credentials) {
|
||||
runHook(hooks, 'pre')
|
||||
|
||||
stage('Build project') {
|
||||
runHook(hooks, 'pre-build')
|
||||
runTask('buildTask', buildTask)
|
||||
runHook(hooks, 'post-build')
|
||||
}
|
||||
|
||||
stage('Run tests') {
|
||||
runHook(hooks, 'pre-test')
|
||||
|
||||
catchError(buildResult: 'UNSTABLE', stageResult: 'FAILURE') {
|
||||
def ( status, output ) = runAndCaptureTask('testTask', testTask)
|
||||
|
||||
if (!!output.trim() && env.CHANGE_ID) {
|
||||
String gitCommit = sh(script: 'git rev-parse --short HEAD', returnStdout: true)
|
||||
String report = """
|
||||
|# Test report for ${gitCommit}
|
||||
|
|
||||
|<details ${output.count('\n') <= 10 ? 'open' : ''}>
|
||||
|
|
||||
|<summary>Output</summary>
|
||||
|
|
||||
|```
|
||||
|${output}
|
||||
|```
|
||||
|
|
||||
|</details>
|
||||
|""".trim().stripMargin()
|
||||
|
||||
gitea.commentPullRequest(repo, env.CHANGE_ID, report)
|
||||
}
|
||||
|
||||
if (status != 0) {
|
||||
throw new Exception("Task `${testTask}` failed !")
|
||||
}
|
||||
}
|
||||
|
||||
runHook(hooks, 'post-test')
|
||||
}
|
||||
|
||||
stage('Release project') {
|
||||
if (releaseBranches.contains(env.BRANCH_NAME)) {
|
||||
try {
|
||||
runHook(hooks, 'pre-release')
|
||||
runTask('releaseTask', releaseTask)
|
||||
runHook(hooks, 'post-release')
|
||||
} catch (Exception ex) {
|
||||
rocketSend(
|
||||
message: """
|
||||
|:warning: Une erreur est survenue lors de la publication de [${repo}](https://forge.cadoles.com/${repo - env.JOB_BASE_NAME}):
|
||||
|
|
||||
| - **Commit:** [${env.GIT_COMMIT}](https://forge.cadoles.com/${repo - env.JOB_BASE_NAME}/commit/${env.GIT_COMMIT})
|
||||
| - **Tags:** `${env.PROJECT_VERSION_TAG}` / `${env.PROJECT_VERSION_SHORT_TAG}`
|
||||
|
|
||||
| **Erreur**
|
||||
|```
|
||||
|${ex}
|
||||
|```
|
||||
|
|
||||
|[Visualiser le job](${env.RUN_DISPLAY_URL})
|
||||
|
|
||||
|@${utils.getBuildUser()}
|
||||
""".stripMargin(),
|
||||
rawMessage: true
|
||||
)
|
||||
|
||||
throw ex
|
||||
}
|
||||
|
||||
rocketSend(
|
||||
message: """
|
||||
|:white_check_mark: Nouvelle publication terminée pour [${repo}](https://forge.cadoles.com/${repo - env.JOB_BASE_NAME}):
|
||||
|
|
||||
| - **Commit:** [${env.GIT_COMMIT}](https://forge.cadoles.com/${repo - env.JOB_BASE_NAME}/commit/${env.GIT_COMMIT})
|
||||
| - **Tags:** `${env.PROJECT_VERSION_TAG}` / `${env.PROJECT_VERSION_SHORT_TAG}`
|
||||
|
|
||||
|[Visualiser le job](${env.RUN_DISPLAY_URL})
|
||||
|
|
||||
|@${utils.getBuildUser()}
|
||||
""".stripMargin(),
|
||||
rawMessage: true
|
||||
)
|
||||
} else {
|
||||
println("Current branch '${env.BRANCH_NAME}' not in releases branches (${releaseBranches}). Skipping.")
|
||||
Utils.markStageSkippedForConditional('Release project')
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
} catch (Exception ex) {
|
||||
runHook(hooks, 'post-failure', [ex])
|
||||
throw ex
|
||||
} finally {
|
||||
runHook(hooks, 'post-always')
|
||||
cleanWs()
|
||||
}
|
||||
|
||||
runHook(hooks, 'post-success')
|
||||
}
|
||||
}
|
||||
|
||||
void buildContainerImage(String baseImage, String baseDockerfile, String dockerfileExtension) {
|
||||
String imageName = 'cadoles-standard-make-ci'
|
||||
dir(".${imageName}") {
|
||||
String dockerfile = ''
|
||||
|
||||
if (baseDockerfile) {
|
||||
dockerfile = baseDockerfile
|
||||
} else {
|
||||
dockerfile = libraryResource 'com/cadoles/standard-make/Dockerfile'
|
||||
dockerfile = "FROM ${baseImage}\n" + dockerfile
|
||||
}
|
||||
|
||||
dockerfile = """
|
||||
${dockerfile}
|
||||
${dockerfileExtension}
|
||||
"""
|
||||
|
||||
writeFile file:'Dockerfile', text: dockerfile
|
||||
|
||||
String addLetsEncryptCA = libraryResource 'com/cadoles/common/add-letsencrypt-ca.sh'
|
||||
writeFile file:'add-letsencrypt-ca.sh', text:addLetsEncryptCA
|
||||
|
||||
String safeJobName = URLDecoder.decode(env.JOB_NAME).toLowerCase().replace('/', '-').replace(' ', '-')
|
||||
String imageTag = "${safeJobName}-${env.BUILD_ID}"
|
||||
|
||||
return docker.build("${imageName}:${imageTag}", '.')
|
||||
}
|
||||
}
|
||||
|
||||
void runHook(Map hooks, String name, List args = []) {
|
||||
if (!hooks[name]) {
|
||||
println("No hook '${name}' defined. Skipping.")
|
||||
return
|
||||
}
|
||||
|
||||
if (hooks[name] instanceof Closure) {
|
||||
hooks[name](*args)
|
||||
} else {
|
||||
error("Hook '${name}' seems to be defined but is not a closure !")
|
||||
}
|
||||
}
|
||||
|
||||
void runTask(String name, task) {
|
||||
if (!task) {
|
||||
println("No task '${name}' defined. Skipping.")
|
||||
return [ -1, '' ]
|
||||
}
|
||||
|
||||
sh(script: """#!/bin/bash
|
||||
make ${task}
|
||||
""")
|
||||
}
|
||||
|
||||
List runAndCaptureTask(String name, task) {
|
||||
if (!task) {
|
||||
println("No task '${name}' defined. Skipping.")
|
||||
return [ -1, '' ]
|
||||
}
|
||||
|
||||
String outputFile = ".${name}-output"
|
||||
int status = sh(script: """#!/bin/bash
|
||||
set -eo pipefail
|
||||
make ${task} 2>&1 | tee '${outputFile}'
|
||||
""", returnStatus: true)
|
||||
|
||||
String output = readFile(outputFile)
|
||||
|
||||
sh(script: "rm -f '${outputFile}'")
|
||||
|
||||
return [status, output]
|
||||
}
|
||||
|
||||
List<String> prepareEnvironment() {
|
||||
List<String> env = []
|
||||
|
||||
def ( longTag, shortTag ) = utils.getProjectVersionTags()
|
||||
|
||||
env += ["PROJECT_VERSION_TAG=${longTag}"]
|
||||
env += ["PROJECT_VERSION_SHORT_TAG=${shortTag}"]
|
||||
|
||||
String gitCommit = sh(script:'git rev-parse --short HEAD', returnStdout: true).trim()
|
||||
env += ["GIT_COMMIT=${gitCommit}"]
|
||||
|
||||
Boolean isPR = utils.isPR()
|
||||
env += ["IS_PR=${isPR ? 'true' : 'false'}"]
|
||||
|
||||
return env
|
||||
}
|
||||
@ -1,58 +1,45 @@
|
||||
import org.jenkinsci.plugins.pipeline.modeldefinition.Utils
|
||||
|
||||
def call(String baseImage = 'ubuntu:22.04', Map options = [:]) {
|
||||
Map hooks = options.get('hooks', [:])
|
||||
String jobHistory = options.get('jobHistory', '10')
|
||||
|
||||
def call(String baseImage = "ubuntu:22.04") {
|
||||
node {
|
||||
properties([
|
||||
buildDiscarder(logRotator(daysToKeepStr: jobHistory, numToKeepStr: jobHistory)),
|
||||
])
|
||||
stage('Cancel older jobs') {
|
||||
def buildNumber = env.BUILD_NUMBER as int
|
||||
if (buildNumber > 1) milestone(buildNumber - 1)
|
||||
milestone(buildNumber)
|
||||
}
|
||||
stage('Checkout project') {
|
||||
stage("Checkout project") {
|
||||
checkout(scm)
|
||||
}
|
||||
stage('Run pre hooks') {
|
||||
runHook(hooks, 'preSymfonyAppPipeline')
|
||||
}
|
||||
|
||||
stage('Run in Symfony image') {
|
||||
def symfonyImage = buildDockerImage(baseImage, hooks)
|
||||
def symfonyImage = buildDockerImage(baseImage)
|
||||
symfonyImage.inside() {
|
||||
def repo = env.JOB_NAME
|
||||
if (env.BRANCH_NAME ==~ /^PR-.*$/) {
|
||||
repo = env.JOB_NAME - "/${env.JOB_BASE_NAME}"
|
||||
}
|
||||
|
||||
stage('Install composer dependencies') {
|
||||
stage("Install composer dependencies") {
|
||||
sh '''
|
||||
symfony composer install
|
||||
composer install
|
||||
'''
|
||||
}
|
||||
|
||||
parallel([
|
||||
'php-security-check': {
|
||||
stage('Check PHP security issues') {
|
||||
stage("Check PHP security issues") {
|
||||
catchError(buildResult: 'UNSTABLE', stageResult: 'FAILURE') {
|
||||
def auditReport = sh(script: 'local-php-security-checker --format=markdown || true', returnStdout: true)
|
||||
if (auditReport.trim() != '') {
|
||||
def auditReport = sh(script: "local-php-security-checker --format=markdown || true", returnStdout: true)
|
||||
if (auditReport.trim() != "") {
|
||||
if (env.CHANGE_ID) {
|
||||
gitea.commentPullRequest(repo, env.CHANGE_ID, auditReport)
|
||||
gitea.commentPullRequest(repo, env.CHANGE_ID, auditReport, 0)
|
||||
} else {
|
||||
print auditReport
|
||||
}
|
||||
}
|
||||
if (!auditReport.contains('No packages have known vulnerabilities.')) {
|
||||
throw new Exception('Dependencies check failed !')
|
||||
if (!auditReport.contains("No packages have known vulnerabilities.")) {
|
||||
throw new Exception("Dependencies check failed !")
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
},
|
||||
'php-cs-fixer': {
|
||||
stage('Run PHP-CS-Fixer on modified code') {
|
||||
stage("Run PHP-CS-Fixer on modified code") {
|
||||
catchError(buildResult: 'FAILURE', stageResult: 'FAILURE') {
|
||||
if ( !fileExists('.php-cs-fixer.dist.php') ) {
|
||||
def phpCsFixerConfig = libraryResource 'com/cadoles/symfony/.php-cs-fixer.dist.php'
|
||||
@ -62,11 +49,11 @@ def call(String baseImage = 'ubuntu:22.04', Map options = [:]) {
|
||||
sh '''
|
||||
CHANGED_FILES=$(git diff --name-only --diff-filter=ACMRTUXB "HEAD~..HEAD" | fgrep ".php" | tr "\n" " ")
|
||||
if ! echo "${CHANGED_FILES}" | grep -qE "^(\\.php-cs-fixer(\\.dist)\\.php?|composer\\.lock)$"; then EXTRA_ARGS=$(printf -- '--path-mode=intersection -- %s' "${CHANGED_FILES}"); else EXTRA_ARGS=''; fi
|
||||
symfony php $(which php-cs-fixer) fix --config=.php-cs-fixer.dist.php -v --dry-run --using-cache=no --format junit ${EXTRA_ARGS} > php-cs-fixer.xml || true
|
||||
php-cs-fixer fix --config=.php-cs-fixer.dist.php -v --dry-run --using-cache=no --format junit ${EXTRA_ARGS} > php-cs-fixer.xml || true
|
||||
'''
|
||||
def report = sh(script: 'junit2md php-cs-fixer.xml', returnStdout: true)
|
||||
def report = sh(script: "junit2md php-cs-fixer.xml", returnStdout: true)
|
||||
if (env.CHANGE_ID) {
|
||||
gitea.commentPullRequest(repo, env.CHANGE_ID, report)
|
||||
gitea.commentPullRequest(repo, env.CHANGE_ID, report, 1)
|
||||
} else {
|
||||
print report
|
||||
}
|
||||
@ -74,20 +61,20 @@ def call(String baseImage = 'ubuntu:22.04', Map options = [:]) {
|
||||
}
|
||||
},
|
||||
'phpstan': {
|
||||
stage('Run phpstan') {
|
||||
stage("Run phpstan") {
|
||||
catchError(buildResult: 'UNSTABLE', stageResult: 'FAILURE') {
|
||||
if ( !fileExists('phpstan.neon') ) {
|
||||
def phpStanConfig = libraryResource 'com/cadoles/symfony/phpstan.neon'
|
||||
writeFile file:'phpstan.neon', text:phpStanConfig
|
||||
}
|
||||
sh '''
|
||||
symfony php $(which phpstan) analyze -l 1 --error-format=table src > phpstan.txt || true
|
||||
phpstan analyze -l 1 --error-format=table src > phpstan.txt || true
|
||||
'''
|
||||
def report = sh(script: 'cat phpstan.txt', returnStdout: true)
|
||||
report = '## Rapport PHPStan\n\n```\n' + report
|
||||
report = report + '\n```\n'
|
||||
def report = sh(script: "cat phpstan.txt", returnStdout: true)
|
||||
report = "## Rapport PHPStan\n\n```\n" + report
|
||||
report = report + "\n```\n"
|
||||
if (env.CHANGE_ID) {
|
||||
gitea.commentPullRequest(repo, env.CHANGE_ID, report)
|
||||
gitea.commentPullRequest(repo, env.CHANGE_ID, report, 2)
|
||||
} else {
|
||||
print report
|
||||
}
|
||||
@ -97,38 +84,32 @@ def call(String baseImage = 'ubuntu:22.04', Map options = [:]) {
|
||||
])
|
||||
}
|
||||
}
|
||||
stage('Run post hooks') {
|
||||
runHook(hooks, 'postSymfonyAppPipeline')
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
void buildDockerImage(String baseImage, Map hooks) {
|
||||
def imageName = 'cadoles-symfony-ci'
|
||||
dir(".${imageName}") {
|
||||
def buildDockerImage(String baseImage) {
|
||||
def imageName = "cadoles-symfony-ci"
|
||||
dir (".${imageName}") {
|
||||
def dockerfile = libraryResource 'com/cadoles/symfony/Dockerfile'
|
||||
writeFile file:'Dockerfile', text: "FROM ${baseImage}\n\n" + dockerfile
|
||||
|
||||
def addLetsEncryptCA = libraryResource 'com/cadoles/common/add-letsencrypt-ca.sh'
|
||||
writeFile file:'add-letsencrypt-ca.sh', text:addLetsEncryptCA
|
||||
|
||||
runHook(hooks, 'buildSymfonyImage')
|
||||
|
||||
|
||||
def safeJobName = URLDecoder.decode(env.JOB_NAME).toLowerCase().replace('/', '-').replace(' ', '-')
|
||||
def imageTag = "${safeJobName}-${env.BUILD_ID}"
|
||||
return docker.build("${imageName}:${imageTag}", '.')
|
||||
return docker.build("${imageName}:${imageTag}", ".")
|
||||
}
|
||||
}
|
||||
|
||||
void runHook(Map hooks, String name) {
|
||||
if (!hooks[name]) {
|
||||
println("No hook '${name}' defined. Skipping.")
|
||||
return
|
||||
}
|
||||
def when(boolean condition, body) {
|
||||
def config = [:]
|
||||
body.resolveStrategy = Closure.OWNER_FIRST
|
||||
body.delegate = config
|
||||
|
||||
if (hooks[name] instanceof Closure) {
|
||||
hooks[name]()
|
||||
} else {
|
||||
error("Hook '${name}' seems to be defined but is not a closure !")
|
||||
}
|
||||
}
|
||||
if (condition) {
|
||||
body()
|
||||
} else {
|
||||
Utils.markStageSkippedForConditional(STAGE_NAME)
|
||||
}
|
||||
}
|
||||
@ -1,117 +0,0 @@
|
||||
import org.jenkinsci.plugins.pipeline.modeldefinition.Utils
|
||||
import org.jenkinsci.plugins.pipeline.modeldefinition.when.impl.ChangeSetConditional
|
||||
|
||||
void when(Boolean condition, body) {
|
||||
Map config = [:]
|
||||
body.resolveStrategy = Closure.OWNER_FIRST
|
||||
body.delegate = config
|
||||
|
||||
if (condition) {
|
||||
body()
|
||||
} else {
|
||||
Utils.markStageSkippedForConditional(STAGE_NAME)
|
||||
}
|
||||
}
|
||||
|
||||
@NonCPS
|
||||
String getBuildUser() {
|
||||
def build = currentBuild.rawBuild
|
||||
String buildUser = ''
|
||||
|
||||
// On essaie de récupérer l'utilisateur à l'origine de l'exécution du job
|
||||
try {
|
||||
def cause = build.getCause(hudson.model.Cause.UserIdCause.class)
|
||||
buildUser = cause.getUserName()
|
||||
} catch (Exception ex) {
|
||||
// On ignore l'erreur
|
||||
}
|
||||
|
||||
if (buildUser == '') {
|
||||
// Si on a pas réussi à retrouver l'utilisateur, on récupère celui du commit courant
|
||||
try {
|
||||
def committerUsername = sh(script: 'git --no-pager show -s --format=\'%ae\' | cut -d\'@\' -f1', returnStdout: true).trim()
|
||||
buildUser = committerUsername
|
||||
} catch (Exception ex) {
|
||||
// On ignore l'erreur
|
||||
}
|
||||
}
|
||||
|
||||
if (buildUser == '') {
|
||||
// Par défaut, on considère que jenkins est à l'origine du job
|
||||
buildUser = 'jenkins'
|
||||
}
|
||||
|
||||
return buildUser
|
||||
}
|
||||
|
||||
String getProjectVersionDefaultChannel() {
|
||||
switch (env.BRANCH_NAME) {
|
||||
case 'develop':
|
||||
return 'develop'
|
||||
|
||||
case 'testing':
|
||||
case 'staging':
|
||||
return 'testing'
|
||||
|
||||
case 'stable':
|
||||
case 'master':
|
||||
return 'stable'
|
||||
|
||||
default:
|
||||
return env.BRANCH_NAME.toLowerCase().replaceAll('(_|-| )+', '')
|
||||
}
|
||||
}
|
||||
|
||||
String getProjectVersionShortChannel(String channel) {
|
||||
switch (channel) {
|
||||
case 'develop':
|
||||
return 'dev'
|
||||
|
||||
case 'testing':
|
||||
case 'staging':
|
||||
return 'tst'
|
||||
|
||||
case 'stable':
|
||||
case 'master':
|
||||
return 'stb'
|
||||
|
||||
default:
|
||||
return channel.toLowerCase().replaceAll('(a|e|i|o|u|y_|-| )+', '').take(3)
|
||||
}
|
||||
}
|
||||
|
||||
List<String> getProjectVersionTags(String overrideChannel = '') {
|
||||
String channel = overrideChannel ? overrideChannel : getProjectVersionDefaultChannel()
|
||||
String shortChannel = getProjectVersionShortChannel(channel)
|
||||
|
||||
String currrentCommitDate = sh(script: 'git show -s --format=%ct', returnStdout: true).trim()
|
||||
String dateVersion = sh(script: "TZ=Europe/Paris date -d '@${currrentCommitDate}' +%Y.%-m.%-d", returnStdout: true).trim()
|
||||
String timestamp = sh(script: "TZ=Europe/Paris date -d '@${currrentCommitDate}' +%-H%M", returnStdout: true).trim()
|
||||
String shortCommit = sh(script: 'git rev-parse --short HEAD', returnStdout: true).trim()
|
||||
|
||||
String longTag = "${dateVersion}-${channel}.${timestamp}.${shortCommit}"
|
||||
String shortTag = "${dateVersion}-${shortChannel}.${timestamp}"
|
||||
|
||||
return [ longTag, shortTag ]
|
||||
}
|
||||
|
||||
Boolean isPR() {
|
||||
return env.BRANCH_NAME ==~ /^PR-.*$/
|
||||
}
|
||||
|
||||
|
||||
def hasChanges(String pattern) {
|
||||
def changeLogSets = currentBuild.changeSets
|
||||
def conditional = new ChangeSetConditional(pattern)
|
||||
|
||||
for (set in changeLogSets) {
|
||||
def entries = set.items
|
||||
for (entry in entries) {
|
||||
if (conditional.changeSetMatches(entry, pattern, true)) {
|
||||
return true;
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
return false;
|
||||
}
|
||||
Loading…
Reference in New Issue
Block a user