-
Notifications
You must be signed in to change notification settings - Fork 1
/
Copy path.gitlab-ci.yml
124 lines (118 loc) · 3.43 KB
/
.gitlab-ci.yml
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
---
include:
- project: 'rahome/gitlab-ci-templates'
ref: main
file:
- '/templates/Checkov.gitlab-ci.yml'
- '/templates/Docker.gitlab-ci.yml'
- '/templates/Yaml.gitlab-ci.yml'
- project: 'rahome/trivy-cache'
ref: main
file:
- '/Trivy.gitlab-ci.yml'
pre-sdk-artifacts:
stage: .pre
image: alpine:3.17.3
rules:
- if: '$CI_PIPELINE_SOURCE == "schedule"'
when: never
- if: '$CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH'
needs: []
before_script:
- apk -qU --no-cache add curl unzip ca-certificates
script: |
curl -O -Ls "https://dl.google.com/android/repository/${ANDROID_CMDLINE_TOOLS_ZIP}"
unzip -qq "${ANDROID_CMDLINE_TOOLS_ZIP}"
artifacts:
paths:
- cmdline-tools
variables:
ANDROID_CMDLINE_TOOLS_ZIP: commandlinetools-linux-8092744_latest.zip
build:docker:
stage: build
rules:
- if: '$CI_PIPELINE_SOURCE == "schedule"'
when: never
- if: '$CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH'
extends:
- .docker-registry
needs:
- job: pre-sdk-artifacts
parallel:
matrix:
- JDK_VERSION: "jdk-8"
DOCKER_FILE: "${JDK_VERSION}/Dockerfile"
- JDK_VERSION: ["jdk-17", "jdk-11", "jdk-8"]
DOCKER_TAG_PREFIX: "${JDK_VERSION}-"
DOCKER_FILE: "${JDK_VERSION}/Dockerfile"
- JDK_VERSION: ["jdk-17", "jdk-11", "jdk-8"]
ANDROID_API_VERSION: [31, 32, 33, 34, 35]
DOCKER_TAG_PREFIX: "${JDK_VERSION}-android-${ANDROID_API_VERSION}-"
DOCKER_FILE: "${JDK_VERSION}/${ANDROID_API_VERSION}/Dockerfile"
variables:
DOCKER_REGISTRY: "${DOCKER_HUB_REGISTRY}"
DOCKER_REGISTRY_USER: "${DOCKER_HUB_REGISTRY_USER}"
DOCKER_REGISTRY_PASSWORD: "${DOCKER_HUB_REGISTRY_PASSWORD}"
DOCKER_REGISTRY_IMAGE: index.docker.io/raatiniemi/android-environment
test:checkov:
stage: test
rules:
- if: '$CI_PIPELINE_SOURCE == "schedule"'
when: never
- if: '$CI_COMMIT_BRANCH'
extends:
- .checkov-junit
needs: []
parallel:
matrix:
- JDK_VERSION: ["jdk-17", "jdk-11", "jdk-8"]
DOCKER_FILE: "${JDK_VERSION}/Dockerfile"
- JDK_VERSION: ["jdk-17", "jdk-11", "jdk-8"]
ANDROID_API_VERSION: [31, 32, 33, 34, 35]
DOCKER_FILE: "${JDK_VERSION}/${ANDROID_API_VERSION}/Dockerfile"
variables:
CHECKOV_COMMAND: "-f ${DOCKER_FILE}"
test:docker:
stage: test
rules:
- if: '$CI_PIPELINE_SOURCE == "schedule"'
when: never
- if: '$CI_COMMIT_BRANCH'
extends:
- .docker-lint
needs: []
test:trivy:
stage: test
rules:
- if: '$CI_PIPELINE_SOURCE == "schedule"'
when: always
- if: '$CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH'
extends:
- .trivy
needs:
- job: build:docker
optional: true
artifacts: false
allow_failure: true
parallel:
matrix:
- JDK_VERSION: "jdk-8"
- JDK_VERSION: ["jdk-17", "jdk-11", "jdk-8"]
DOCKER_TAG_PREFIX: "${JDK_VERSION}-"
- JDK_VERSION: ["jdk-17", "jdk-11", "jdk-8"]
ANDROID_API_VERSION: [31, 32, 33, 34, 35]
DOCKER_TAG_PREFIX: "${JDK_VERSION}-android-${ANDROID_API_VERSION}-"
variables:
TRIVY_AUTH_URL: "${DOCKER_HUB_REGISTRY}"
TRIVY_USERNAME: "${DOCKER_HUB_REGISTRY_USER}"
TRIVY_PASSWORD: "${DOCKER_HUB_REGISTRY_PASSWORD}"
CI_REGISTRY_IMAGE: index.docker.io/raatiniemi/android-environment
test:yaml:
stage: test
rules:
- if: '$CI_PIPELINE_SOURCE == "schedule"'
when: never
- if: '$CI_COMMIT_BRANCH'
extends:
- .yaml-lint
needs: []