129 lines
3.1 KiB
YAML
129 lines
3.1 KiB
YAML
stages:
|
|
- verify
|
|
- container
|
|
- package
|
|
- release
|
|
|
|
workflow:
|
|
rules:
|
|
- if: '$CI_COMMIT_TAG'
|
|
- if: '$CI_PIPELINE_SOURCE == "merge_request_event"'
|
|
- if: '$CI_COMMIT_BRANCH'
|
|
|
|
variables:
|
|
CARGO_HOME: "$CI_PROJECT_DIR/.cargo"
|
|
CARGO_TERM_COLOR: never
|
|
RUST_BACKTRACE: "1"
|
|
|
|
.rust-job:
|
|
image: rust:1.88.0-bookworm
|
|
before_script:
|
|
- apt-get update
|
|
- >-
|
|
apt-get install --no-install-recommends -y
|
|
libpam0g-dev libpam-modules pkg-config xauth xvfb util-linux
|
|
- rustup component add rustfmt clippy
|
|
cache:
|
|
key:
|
|
files:
|
|
- Cargo.lock
|
|
- rust-toolchain.toml
|
|
paths:
|
|
- .cargo/registry/index/
|
|
- .cargo/registry/cache/
|
|
- .cargo/git/db/
|
|
- .cargo/bin/
|
|
- target/
|
|
|
|
rust-verify:
|
|
extends: .rust-job
|
|
stage: verify
|
|
script:
|
|
- make check COLOR=0
|
|
- make version COLOR=0
|
|
artifacts:
|
|
when: always
|
|
expire_in: 7 days
|
|
paths:
|
|
- target/debug/deps/
|
|
|
|
security-audit:
|
|
image: rust:1.88.0-bookworm
|
|
stage: verify
|
|
cache:
|
|
key: cargo-audit-0.22.2
|
|
paths:
|
|
- .cargo/bin/
|
|
- .cargo/registry/index/
|
|
- .cargo/registry/cache/
|
|
before_script:
|
|
- export PATH="$CARGO_HOME/bin:$PATH"
|
|
- command -v cargo-audit >/dev/null || cargo install cargo-audit --locked --version 0.22.2
|
|
script:
|
|
- cargo audit
|
|
|
|
docker-verify:
|
|
image: docker:27.5.1-cli
|
|
stage: container
|
|
services:
|
|
- name: docker:27.5.1-dind
|
|
alias: docker
|
|
variables:
|
|
DOCKER_HOST: tcp://docker:2376
|
|
DOCKER_TLS_CERTDIR: "/certs"
|
|
DOCKER_TLS_VERIFY: "1"
|
|
DOCKER_CERT_PATH: "$DOCKER_TLS_CERTDIR/client"
|
|
before_script:
|
|
- until docker info >/dev/null 2>&1; do sleep 1; done
|
|
script:
|
|
- ./scripts/test-docker.sh
|
|
rules:
|
|
- if: '$CI_COMMIT_BRANCH'
|
|
- if: '$CI_COMMIT_TAG'
|
|
- if: '$CI_PIPELINE_SOURCE == "merge_request_event"'
|
|
|
|
package:
|
|
extends: .rust-job
|
|
stage: package
|
|
needs:
|
|
- job: rust-verify
|
|
artifacts: false
|
|
- job: docker-verify
|
|
artifacts: false
|
|
- job: security-audit
|
|
artifacts: false
|
|
rules:
|
|
- if: '$CI_COMMIT_TAG =~ /^v?[0-9]+\.[0-9]+\.[0-9]+([-.][0-9A-Za-z.-]+)?$/'
|
|
script:
|
|
- VERSION="${CI_COMMIT_TAG#v}" make package COLOR=0 TAG="$CI_COMMIT_TAG"
|
|
- (cd dist && sha256sum --check "$(basename "$(ls *.tar.gz)").sha256")
|
|
- printf 'PACKAGE_JOB_ID=%s\n' "$CI_JOB_ID" >> dist/release.env
|
|
artifacts:
|
|
name: "latchd-${CI_COMMIT_TAG}"
|
|
expire_in: 30 days
|
|
paths:
|
|
- dist/
|
|
reports:
|
|
dotenv: dist/release.env
|
|
|
|
release:
|
|
image: registry.gitlab.com/gitlab-org/cli:v1.103.0
|
|
stage: release
|
|
needs:
|
|
- job: package
|
|
artifacts: true
|
|
rules:
|
|
- if: '$CI_COMMIT_TAG =~ /^v?[0-9]+\.[0-9]+\.[0-9]+([-.][0-9A-Za-z.-]+)?$/'
|
|
script:
|
|
- test -n "$PACKAGE_JOB_ID"
|
|
- test -f dist/release.env
|
|
release:
|
|
tag_name: "$CI_COMMIT_TAG"
|
|
name: "latchd ${CI_COMMIT_TAG}"
|
|
description: "Production artifacts and checksums are attached from the reproducible package job."
|
|
assets:
|
|
links:
|
|
- name: "latchd package and SHA-256"
|
|
url: "${CI_PROJECT_URL}/-/jobs/${PACKAGE_JOB_ID}/artifacts/download?file_type=archive"
|
|
link_type: package
|