54 lines
1.4 KiB
YAML
54 lines
1.4 KiB
YAML
stages:
|
|
- verify
|
|
- build
|
|
|
|
backend_verify:
|
|
stage: verify
|
|
image: python:3.12-slim
|
|
script:
|
|
- pip install --no-cache-dir -r backend/requirements.txt pytest ruff bandit pip-audit
|
|
- PYTHONPATH=backend python -m compileall -q backend/app
|
|
- ruff check backend/app backend/tests
|
|
- PYTHONPATH=backend pytest -q backend/tests --junitxml=backend-test-report.xml
|
|
- bandit -q -r backend/app -lll
|
|
- pip-audit -r backend/requirements.txt
|
|
artifacts:
|
|
reports:
|
|
junit: backend-test-report.xml
|
|
paths:
|
|
- backend-test-report.xml
|
|
expire_in: 180 days
|
|
|
|
frontend_build:
|
|
stage: build
|
|
image: node:20-alpine
|
|
script:
|
|
- cd frontend
|
|
- npm ci
|
|
- npm run build
|
|
artifacts:
|
|
name: "qiji-frontend-$CI_COMMIT_SHORT_SHA"
|
|
paths:
|
|
- frontend/dist/
|
|
expire_in: 30 days
|
|
|
|
backend_sbom:
|
|
stage: verify
|
|
image: python:3.12-slim
|
|
script:
|
|
- pip install --no-cache-dir cyclonedx-bom
|
|
- python -m cyclonedx_py requirements backend/requirements.txt --output-reproducible --of JSON -o sbom-backend.cdx.json
|
|
artifacts:
|
|
name: "qiji-sbom-$CI_COMMIT_SHORT_SHA"
|
|
paths:
|
|
- sbom-backend.cdx.json
|
|
expire_in: 180 days
|
|
|
|
filesystem_security:
|
|
stage: verify
|
|
image:
|
|
name: aquasec/trivy:0.67.2
|
|
entrypoint: [""]
|
|
script:
|
|
- trivy fs --exit-code 1 --ignore-unfixed --severity HIGH,CRITICAL --scanners vuln,misconfig,secret .
|