ZeroDownTime/CloudBender
3
0
Fork 0
Code Issues 1 Pull Requests 4 Packages Projects Releases Wiki Activity

ci: migrate to central ci-tools-lib

Browse Source
This commit is contained in:
Stefan Reimer 2022-10-13 15:46:00 +02:00
parent 611dddb062
commit f3b759e5a9
2 changed files with 6 additions and 88 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

59
Jenkinsfile vendored
View File

@ -1,56 +1,5 @@
pipeline { library identifier: 'zdt-lib@master', retriever: modernSCM(
agent { node { label 'podman-aws-trivy' } } [$class: 'GitSCMSource',
remote: 'https://git.zero-downtime.net/ZeroDownTime/ci-tools-lib.git'])
stages { buildPodman name: 'jenkins-podman', trivyFail: 'NONE'
stage('Prepare'){
// get tags
steps {
sh 'git fetch -q --tags ${GIT_URL} +refs/heads/${BRANCH_NAME}:refs/remotes/origin/${BRANCH_NAME}'
}
}
// Build using rootless podman
stage('Build'){
steps {
sh 'make build'
}
}
stage('Test'){
steps {
sh 'make test'
}
}
// Scan via trivy
stage('Scan'){
environment {
TRIVY_FORMAT = "template"
TRIVY_OUTPUT = "reports/trivy.html"
}
steps {
sh 'mkdir -p reports'
sh 'make scan'
publishHTML target : [
allowMissing: true,
alwaysLinkToLastBuild: true,
keepAll: true,
reportDir: 'reports',
reportFiles: 'trivy.html',
reportName: 'TrivyScan',
reportTitles: 'TrivyScan'
]
// Scan again and fail on CRITICAL vulns
// sh 'TRIVY_EXIT_CODE=1 TRIVY_SEVERITY=CRITICAL make scan'
}
}
// Push to ECR
stage('Push'){
steps {
sh 'make push'
}
}
}
}

35
Makefile
View File

@ -2,23 +2,13 @@ REGISTRY := public.ecr.aws/zero-downtime
IMAGE := cloudbender IMAGE := cloudbender
REGION := us-east-1 REGION := us-east-1
# Parse version from latest git semver tag include .ci/podman.mk
GTAG=$(shell git describe --tags --match v*.*.* 2>/dev/null || git rev-parse --short HEAD 2>/dev/null)
TAG ?= $(shell echo $(GTAG) | awk -F '-' '{ print $$1 "-" $$2 }' | sed -e 's/-$$//')
ifneq ($(TRIVY_REMOTE),)
TRIVY_OPTS := --server ${TRIVY_REMOTE}
endif
.PHONY: pytest pybuild test_upload upload all build test push scan
all: pytest pybuild
pytest: pytest:
flake8 cloudbender tests flake8 cloudbender tests
TEST=True pytest --log-cli-level=DEBUG TEST=True pytest --log-cli-level=DEBUG
clean: pyclean:
rm -rf .cache build .coverage .eggs cloudbender.egg-info .pytest_cache dist rm -rf .cache build .coverage .eggs cloudbender.egg-info .pytest_cache dist
pybuild: pybuild:
@ -29,24 +19,3 @@ test_upload: pybuild
upload: pybuild upload: pybuild
twine upload -r pypi --non-interactive dist/cloudbender-*.whl twine upload -r pypi --non-interactive dist/cloudbender-*.whl
build:
podman build --rm -t $(IMAGE):$(TAG) -t $(IMAGE):latest .
test:
@echo "Not implemented (yet)"
push:
aws ecr-public get-login-password --region $(REGION) | podman login --username AWS --password-stdin $(REGISTRY)
podman tag $(IMAGE):latest $(REGISTRY)/$(IMAGE):$(TAG) $(REGISTRY)/$(IMAGE):latest
podman push $(REGISTRY)/$(IMAGE):$(TAG)
podman push $(REGISTRY)/$(IMAGE):latest
scan:
trivy image $(TRIVY_OPTS) $(IMAGE):$(TAG)
# Delete all untagged images
.PHONY: rm-remote-untagged
rm-remote-untagged:
@echo "Removing all untagged images from $(IMAGE) in $(REGION)"
@aws ecr-public batch-delete-image --repository-name $(IMAGE) --region $(REGION) --image-ids $$(for image in $$(aws ecr-public describe-images --repository-name $(IMAGE) --region $(REGION) --output json | jq -r '.imageDetails[] | select(.imageTags | not ).imageDigest'); do echo -n "imageDigest=$$image "; done)