rpki-ta-0/.gitlab-ci.yml at main · RIPE-NCC/rpki-ta-0 · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
stages:
  - build
  - test
  - security
  - deploy

workflow:
  rules:
    - if: $CI_PIPELINE_SOURCE == "merge_request_event"
    - if: $CI_PIPELINE_SOURCE == "external"
    - if: $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH

include:
  - project: swe/gitlab-support
    file: /templates/security.yml
    inputs:
      stage: security
      needs: ["lockfile"]
  - project: swe/gitlab-support
    file: /templates/approval.yml
    inputs:
      stage: .post
      access-token: "$APPROVAL_BOT_ACCESS_TOKEN"

# Cache the complete build directories
cache: &global_cache
  key:
    files:
      - build.gradle
  paths:
    - build
    - .gradle
  policy: pull-push

variables:
  GRADLE_USER_HOME: "${CI_PROJECT_DIR}/.gradle/"
  GRADLE_OPTS: "-Dorg.gradle.caching=true -Dorg.gradle.parallel=true -Dorg.gradle.daemon=false"

default:
  image: gradle:jdk11

lockfile:
  stage: .pre
  cache:
    <<: *global_cache
    policy: pull-push
  script:
    - ./gradlew dependencies --write-locks
  artifacts:
    paths:
      - "gradle.lockfile"

build:
  stage: build
  script: ./gradlew -i clean build
  artifacts:
    paths:
      - build/distributions/*
      - src/main/scripts/deploy.sh
    reports:
      junit:
        - build/test-results/test/*.xml
  rules:
    - if: '$CI_COMMIT_BRANCH != "main"'

build-release:
  stage: build
  script:
    - ./gradlew -i clean build
  artifacts:
    paths:
      - build/distributions/*
      - src/main/scripts/deploy.sh
    expire_in: never
    reports:
      junit:
        - build/test-results/test/*.xml
  rules:
    - if: '$CI_COMMIT_BRANCH == "main"'

.deploy: &deploy
  stage: deploy
  image: docker-registry.ripe.net/swe/gitlab-ci/debian-deployenv
  # No caching of gradle data needed
  cache: []
  allow_failure: true
  script:
    # Preparation: Include in scripts because we want the output.
    - echo "Using SSH key from ${SSH_KEY}"
    - chmod 400 ${SSH_KEY}
    - chmod +x src/main/scripts/*.sh
    - mv build/distributions/rpki-ta-0-*.tgz .
    # Print public key
    - ssh-keygen -y -l -f ${SSH_KEY}
    - >
      src/main/scripts/deploy.sh ${SSH_KEY}
      rpki-ta-0-*.tgz "${NODES}"
  rules:
    - if: $CI_COMMIT_TAG
    - if: $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH
    - if: $CI_MERGE_REQUEST_IID
      when: manual

localcert:
  <<: *deploy
  variables:
    NODES: "localcert-3.rpki.ripe.net"
  environment:
    name: localcert

prepdev:
  <<: *deploy
  variables:
    NODES: "core-5.rpki.prepdev.ripe.net"
  environment:
    name: prepdev