Continuous Integration and Continuous Delivery/Deployment with Gitlab CI

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
build-job: (1)
  stage: build (2)
  script: (3)
    - echo "Hello, $GITLAB_USER_LOGIN!"

test-job1:
  stage: test
  script:
    - echo "This job tests something"

test-job2:
  stage: test
  script:
    - echo "This job tests something, but takes more time than test-job1."
    - echo "After the echo commands complete, it runs the sleep command for 20 seconds"
    - echo "which simulates a test that runs 20 seconds longer than test-job1"
    - sleep 20

deploy-prod:
  stage: deploy
  script:
    - echo "This job deploys something from the $CI_COMMIT_BRANCH branch."
  environment: production (4)

1
2
3
4
5
6
7
8
9
# ...
include:
  - component: gitlab.com/devops-training-info/templates/ci/components/ansible-component/configure@1.0.0 (1)
    inputs: (2)
      stage: configure (3)
  - component: gitlab.com/devops-training-info/templates/ci/components/js-component/install@1.1.0
    inputs:
      stage: configure
# ...

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
spec: (1)
  inputs:
    stage: (2)
      default: configure
      description: "Defines the build stage"
    ansible_image:
      default: alpine/ansible
      description: "Defines image with ansible to use"
    shell_script:
      default: "./scripts/gitlab-configure.sh"
      description: "Defines location of prepared shell script which should configure and run ansible playbook"
    ansible_artifacts_paths:
      type: array
      default:
        - secrets
      description: "Defines locations of generated artifacts"
---

configure: (3)
  image: $[[ inputs.ansible_image ]]
  stage: $[[ inputs.stage ]]
  before_script:
    - ansible --version
  script:
    - $[[ inputs.shell_script ]] (4)
  artifacts:
    expire_in: 1 week
    paths: $[[ inputs.ansible_artifacts_paths ]] (5)

1
2
3
4
5
6
7
8
stages:
  - configure

include:
  - component: $CI_SERVER_FQDN/$CI_PROJECT_PATH/configure@$CI_COMMIT_SHA (1)
    inputs:
      stage: configure
      ansible_image: alpine/ansible

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
spec:
  inputs:
    stage:
      default: 'configure'
      description: 'Defines the format stage'
    node_version:
      default: 'latest'
      description: 'Node image version tag'
---
"install-$[[ inputs.node_version ]]": (1)
  image: registry.gitlab.com/devops-training-info/examples/docker/node-yarn:$[[ inputs.node_version ]] (2)
  stage: $[[ inputs.stage ]]
  script:
    - yarn install (3)
  artifacts: (4)
    expire_in: 1 week
    paths:
      - node_modules

# ...
include:
  # ...
  - component: gitlab.com/devops-training-info/templates/ci/components/js-component/format@1.1.0
    inputs:
      stage: format
  - component: gitlab.com/devops-training-info/templates/ci/components/js-component/lint@1.1.0
    inputs:
      stage: format
# ...

spec:
  inputs:
    stage:
      default: 'pre-build-tests'
      description: 'Defines the format stage'
    node_version:
      default: 'latest'
      description: 'Node image version tag'
---
"format-$[[ inputs.node_version ]]":
  image: registry.gitlab.com/devops-training-info/examples/docker/node-yarn:$[[ inputs.node_version ]]
  stage: $[[ inputs.stage ]]
  script:
    - yarn test:format

spec:
  inputs:
    stage:
      default: 'pre-build-tests'
      description: 'Defines the format stage'
    node_version:
      default: 'latest'
      description: 'Node image version tag'
---
"lint-$[[ inputs.node_version ]]":
  image: registry.gitlab.com/devops-training-info/examples/docker/node-yarn:$[[ inputs.node_version ]]
  stage: $[[ inputs.stage ]]
  script:
    - yarn test:lint

# ...
include:
  # ...
  - component: gitlab.com/devops-training-info/templates/ci/components/js-component/build@1.1.0
    inputs:
      stage: build
  - component: gitlab.com/devops-training-info/templates/ci/components/js-component/build@1.1.0
    inputs:
      stage: build
      node_version: "26.1.0"
  - component:  gitlab.com/devops-training-info/templates/ci/components/asciidoctor-component/generate@1.0.0
    inputs:
      stage: build
      ruby_image: ruby:3.4
  - component: gitlab.com/devops-training-info/templates/ci/components/container-component/build@1.0.2
    inputs:
      stage: build
# ...

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
spec:
  inputs:
    stage:
      default: 'build'
      description: 'Defines the build stage'
    docker_file:
      default: 'multi-stage.Dockerfile'
      description: 'Name of the Dockerfile to use for Container creation'
    test_image:
      default: ${CI_REGISTRY_IMAGE}/test:${CI_COMMIT_SHA}_${CI_PIPELINE_ID} (1)
      description: 'Name of the target container test image'
---

test_image:
  stage: $[[ inputs.stage ]]
  variables:
    DOCKER_FILE: $[[ inputs.docker_file ]]
    CONTAINER_TEST_IMAGE: $[[ inputs.test_image ]]
  image:
    name: gcr.io/kaniko-project/executor:debug
    entrypoint: [""]
  script:
    - mkdir -p /kaniko/.docker
    - echo "{\"auths\":{\"${CI_REGISTRY}\":{\"auth\":\"$(printf "%s:%s" "${CI_REGISTRY_USER}" "${CI_REGISTRY_PASSWORD}" | base64 | tr -d '\n')\"}}}" > /kaniko/.docker/config.json
    - /kaniko/executor --context "${CI_PROJECT_DIR}" --dockerfile "${CI_PROJECT_DIR}/${DOCKER_FILE}" --destination "${CONTAINER_TEST_IMAGE}"
  after_script: (2)
    # If we try to pull the image immediately it sometimes fails
    - /bin/sleep 5

# ...
include:
  # ...
  - component: gitlab.com/devops-training-info/templates/ci/components/js-component/coverage@1.1.0
    inputs:
      stage: test
  - component: gitlab.com/devops-training-info/templates/ci/components/security-component/trivy@1.0.0
    inputs:
      stage: test
# ...

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
spec:
  inputs:
    stage:
      default: 'pre-build-tests'
      description: 'Defines the format stage'
    node_version:
      default: 'latest'
      description: 'Node image version tag'
---
"coverage-$[[ inputs.node_version ]]":
  image: registry.gitlab.com/devops-training-info/examples/docker/node-yarn:$[[ inputs.node_version ]]
  stage: $[[ inputs.stage ]]
  script:
    - yarn test:coverage
  artifacts:
    reports: (1)
      coverage_report:
        coverage_format: cobertura
        path: coverage/cobertura-coverage.xml

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
spec:
  inputs:
    stage:
      default: test
      description: "Defines the build stage"
    image_to_scan:
      default: "${CI_REGISTRY_IMAGE}/test:${CI_COMMIT_SHA}_${CI_PIPELINE_ID}"
      description: "Image which we are planning to scan for security"
---

scan:
  stage: $[[ inputs.stage ]]
  image:
    name: docker.io/aquasec/trivy:latest
    entrypoint: [ "" ]
  variables:
    # No need to clone the repo, we exclusively work on artifacts.  See
    # https://docs.gitlab.com/ee/ci/runners/README.html#git-strategy
    GIT_STRATEGY: none
    TRIVY_USERNAME: "$CI_REGISTRY_USER"
    TRIVY_PASSWORD: "$CI_REGISTRY_PASSWORD"
    TRIVY_AUTH_URL: "$CI_REGISTRY"
    TRIVY_DB_REPOSITORY: "public.ecr.aws/aquasecurity/trivy-db"
    TRIVY_JAVA_DB_REPOSITORY: "public.ecr.aws/aquasecurity/trivy-java-db"
    CONTAINER_TEST_IMAGE: $[[ inputs.image_to_scan ]]
  script:
    - trivy --version
    # cache cleanup is needed when scanning images with the same tags, it does not remove the database
    - time trivy clean --scan-cache
    # update vulnerabilities db
    - time trivy image --download-db-only --no-progress --cache-dir .trivycache/
    # Builds report and puts it in the default workdir $CI_PROJECT_DIR, so `artifacts:` can take it from there
    - time trivy image --exit-code 0 --cache-dir .trivycache/ --no-progress --format template --template "@/contrib/gitlab.tpl"
        --output "$CI_PROJECT_DIR/gl-container-scanning-report.json" "$CONTAINER_TEST_IMAGE"
    # Prints full report
    - time trivy image --exit-code 0 --cache-dir .trivycache/ --severity CRITICAL,HIGH,MEDIUM --ignore-unfixed --no-progress "$CONTAINER_TEST_IMAGE"
    # Fail on critical vulnerabilities which are fixed
    - time trivy image --exit-code 1 --cache-dir .trivycache/ --severity CRITICAL --ignore-unfixed --no-progress "$CONTAINER_TEST_IMAGE"
  allow_failure: true (1)
  cache:
    paths:
      - .trivycache/
  # Enables https://docs.gitlab.com/ee/user/application_security/container_scanning/ (Container Scanning report is available on GitLab EE Ultimate or GitLab.com Gold)
  artifacts: (2)
    when:                          always
    reports:
      container_scanning:          gl-container-scanning-report.json

# ...
include:
  # ...
  - component: gitlab.com/devops-training-info/templates/ci/components/asciidoctor-component/pages@1.0.0
    inputs:
      stage: release
  - component: gitlab.com/devops-training-info/templates/ci/components/container-component/release@1.0.2
    inputs:
      stage: release
  - component: gitlab.com/devops-training-info/templates/ci/components/container-component/clean@1.0.2
# ...

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
spec:
  inputs:
    stage:
      default: release
      description: "Defines the build stage"
---

pages: (1)
  stage: $[[ inputs.stage ]]
  image: alpine:latest
  script: (2)
    - mkdir -p public
    - mkdir -p doc/images
    - cp -R doc/images public/
    - cp doc/$APP_NAME.html public/index.html
    - cp doc/$APP_NAME.pdf public/
  artifacts: (3)
    paths:
      - public
  only:
    - master
  dependencies:
    - generate

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
spec:
  inputs:
    stage:
      default: 'release'
      description: 'Defines the build stage'
    docker_file:
      default: 'multi-stage.Dockerfile'
      description: 'Name of the Dockerfile to use for Container creation'
    source_image:
      default: ${CI_REGISTRY_IMAGE}/test:${CI_COMMIT_SHA}_${CI_PIPELINE_ID}
      description: 'Name of the target container test image'
---

# final image for the feature branch -
gitlab_registry_branch:
  stage: $[[ inputs.stage ]]
  variables:
    DOCKER_FILE: $[[ inputs.docker_file ]]
    CONTAINER_IMAGE: $CI_REGISTRY_IMAGE:$CI_COMMIT_REF_SLUG (1)
  image:
    name: gcr.io/kaniko-project/executor:debug
    entrypoint: [""]
  script:
    - mkdir -p /kaniko/.docker
    - echo "{\"auths\":{\"${CI_REGISTRY}\":{\"auth\":\"$(printf "%s:%s" "${CI_REGISTRY_USER}" "${CI_REGISTRY_PASSWORD}" | base64 | tr -d '\n')\"}}}" > /kaniko/.docker/config.json
    - /kaniko/executor --context "${CI_PROJECT_DIR}" --dockerfile "${CI_PROJECT_DIR}/${DOCKER_FILE}" --destination "${CONTAINER_IMAGE}"
  except: (2)
    - master
    - tags
  when: manual

# final image for the master branch
gitlab_registry_latest:
  stage: $[[ inputs.stage ]]
  image:
    name: gcr.io/go-containerregistry/crane:debug
    entrypoint: [""]
  variables:
    GIT_STRATEGY: none
    CONTAINER_SOURCE_IMAGE: $[[ inputs.source_image ]]
    CONTAINER_TARGET_IMAGE: $CI_REGISTRY_IMAGE:latest
  before_script:
    - crane auth login -u gitlab-ci-token -p $CI_JOB_TOKEN $CI_REGISTRY
  script:
    - crane cp $CONTAINER_SOURCE_IMAGE $CONTAINER_TARGET_IMAGE
  dependencies:
    - test_image
  only:
    - master

# final image for the production ready deployment - tags
gitlab_registry_tag:
  stage: $[[ inputs.stage ]]
  image:
    name: gcr.io/go-containerregistry/crane:debug
    entrypoint: [""]
  variables:
    GIT_STRATEGY: none
    CONTAINER_SOURCE_IMAGE: $[[ inputs.source_image ]]
    CONTAINER_TARGET_IMAGE: $CI_REGISTRY_IMAGE:$CI_COMMIT_REF_NAME
  before_script:
    - crane auth login -u gitlab-ci-token -p $CI_JOB_TOKEN $CI_REGISTRY
  script:
    - crane cp $CONTAINER_SOURCE_IMAGE $CONTAINER_TARGET_IMAGE
  dependencies:
    - test_image
  only:
    - tags

include: (3)
  - component: gitlab.com/google-gitlab-components/artifact-registry/upload-artifact-registry@0.1.0
    inputs:
      stage: $[[ inputs.stage ]]
      source: ${CI_REGISTRY_IMAGE}/test:${CI_COMMIT_SHA}_${CI_PIPELINE_ID}
      target: europe-central2-docker.pkg.dev/devops-training-workshop-sbx/docker/$CI_PROJECT_PATH:latest
    only:
      - master
  - component: gitlab.com/google-gitlab-components/artifact-registry/upload-artifact-registry@0.1.0
    inputs:
      stage: $[[ inputs.stage ]]
      source: ${CI_REGISTRY_IMAGE}/test:${CI_COMMIT_SHA}_${CI_PIPELINE_ID}
      target: europe-central2-docker.pkg.dev/devops-training-workshop-sbx/docker/$CI_PROJECT_PATH:$CI_COMMIT_REF_NAME
    only:
      - tags