retasc/.gitlab-ci.yml at main · release-engineering/retasc · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
---
stages:
  - test
  - sonarqube

variables:
  # SonarQube project name
  PROJECT_NAME: "exd-guild-rhel-workflow-automation:retasc"
  COVERAGE_XML: coverage.xml
  JUNIT_XML: report.xml

workflow:
  rules:
    # Avoid running CI on automated dependency updates (often partial)
    - if: '$CI_COMMIT_BRANCH !~ /^konflux\/mintmaker/'

# code-scanning-container
# Requires SONAR_TOKEN variable in GitLab project.
include:
  - project: rhelwfautomation/rhelwf-images
    file: gitlab-ci-runner-tag.yaml
    ref: main
  - project: security-guild/code-scanning-container
    file: code_scanning-gitlab-ci.yml

unittests:
  image:
    name: quay.io/fedora/python-313:latest@sha256:e7b70989fee8db02ffa56287bc64dce88508ed14b389efb3f43dcef5f1bb7113
  stage: test
  script:
    - pip install tox
    - tox -e py3 -- --junit-xml="${JUNIT_XML}"
  coverage: '/Total coverage: \d+\.\d+\%/'
  artifacts:
    paths:
      - $COVERAGE_XML
      - $JUNIT_XML
    reports:
      junit: $JUNIT_XML
      coverage_report:
        coverage_format: cobertura
        path: $COVERAGE_XML

sonarqube-scan-sast:
  variables:
    # Larger memory requirements for Java/SonarQube
    KUBERNETES_MEMORY_REQUEST: "2Gi"
    KUBERNETES_MEMORY_LIMIT: "2Gi"
  stage: sonarqube
  needs:
    - unittests

owasp_dependency_check-scan:
  rules:
    # Avoid failing pipeline on unstable OWASP scan
    - allow_failure: true
      when: on_success