java-sql-inspector/.gitlab-ci.yml at main · thomasleplus/java-sql-inspector · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
---
include:
  - template: Jobs/Secret-Detection.gitlab-ci.yml
  - template: Jobs/SAST.gitlab-ci.yml
  - template: Jobs/SAST-IaC.gitlab-ci.yml

stages:
  - check
  - build

default:
  interruptible: true

variables:
  GIT_DEPTH: 1
  SAST_SEMGREP_METRICS: false
  SEMGREP_SEND_METRICS: off
  MAVEN_OPTS: >
    -Dhttps.protocols=TLSv1.2
    -Dmaven.repo.local=.m2/repository
    -Dorg.slf4j.simpleLogger.log.org.apache.maven.cli.transfer.Slf4jMavenTransferListener=WARN
    -Dorg.slf4j.simpleLogger.showDateTime=true
    -Djava.awt.headless=true
  MAVEN_CLI_OPTS: >
    --batch-mode
    --errors
    --fail-at-end
    --show-version
    -DinstallAtEnd=true
    -DdeployAtEnd=true

sast:
  stage: check

iac-sast:
  stage: check

kics-iac-sast:
  stage: check

secret_detection:
  stage: check

osv-scanner:
  allow_failure: true
  image:
    name: golang:alpine
    entrypoint:
      - "" # Entrypoint is overridden by GitLab anyway
  stage: check
  cache:
    key: osv-scanner
    paths:
      - .cache/gopath/pkg/mod
      - .cache/gocache
  variables:
    GOPATH: ${CI_PROJECT_DIR}/.cache/gopath
    GOCACHE: ${CI_PROJECT_DIR}/.cache/gocache
  before_script:
    - "go install github.com/google/osv-scanner/cmd/osv-scanner@latest"
  script:
    - 'PATH="${PATH}:${GOPATH}/bin" osv-scanner -r .'
  timeout: 10 minutes

super-linter:
  image:
    name: ghcr.io/super-linter/super-linter:v8.5.0@sha256:6831c0a801d353b510e4e468a3209a8a48bf0102e193d5c7e94e57667fdf64eb
    entrypoint:
      - "" # Entrypoint is overridden by GitLab anyway
  stage: check
  variables:
    BIOME_CONFIG_PATH: .biome.json
    ENFORCE_COMMITLINT_CONFIGURATION_CHECK: "true"
    FILTER_REGEX_EXCLUDE: "^/tmp/lint/(gradlew|gradlew\\.bat|gradle/.*|mvnw|mvnw\\.cmd|\\.m2/.*|\\.mvn/.*)$"
    JAVA_FILE_NAME: google_checks.xml
    LINTER_RULES_PATH: "."
    RUN_LOCAL: "true"
    USE_FIND_ALGORITHM: "true"
    VALIDATE_ALL_CODEBASE: "true"
  before_script:
    - 'ln -s "$(pwd)" /tmp/lint'
  script:
    - "/action/lib/linter.sh"
  timeout: 10 minutes

maven-check-versions:
  image:
    name: leplusorg/maven-check-versions:3.9.11@sha256:cabe45dc45c644032ba61b2f43e304baf382e834efe76d74a81c666b893c5dc2
    entrypoint:
      - "" # Entrypoint is overridden by GitLab anyway
  stage: check
  cache:
    key: maven
    paths:
      - .m2/repository
  variables:
    MAVEN_CLI_EXTRA_OPTS: "-DprocessDependencyManagementTransitive=false -Dmaven.version.ignore=(?i).+-(alpha|beta).+,(?i).+-m\\d+,(?i).+-rc\\d+"
  timeout: 10 minutes

maven:jdk17:
  stage: build
  image:
    name: maven:3-openjdk-17-slim
    entrypoint:
      - "" # Entrypoint is overridden by GitLab anyway
  cache:
    key: maven
    paths:
      - .m2/repository
  script:
    - "./mvnw $MAVEN_CLI_OPTS -DdependencyCheck.skip=true verify"

maven:jdk21:
  stage: build
  image:
    name: maven:3-eclipse-temurin-21-alpine
    entrypoint:
      - "" # Entrypoint is overridden by GitLab anyway
  cache:
    key: maven
    paths:
      - .m2/repository
  script:
    - "./mvnw $MAVEN_CLI_OPTS -DdependencyCheck.skip=true verify"

maven:jdk25:
  stage: build
  image:
    name: maven:3-eclipse-temurin-25-alpine
    entrypoint:
      - "" # Entrypoint is overridden by GitLab anyway
  cache:
    key: maven
    paths:
      - .m2/repository
  script:
    - "./mvnw $MAVEN_CLI_OPTS -DdependencyCheck.skip=true verify"