-
Notifications
You must be signed in to change notification settings - Fork 0
/
bitbucket-pipelines.yml
136 lines (135 loc) · 5.14 KB
/
bitbucket-pipelines.yml
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
definitions:
steps:
- step: &build-docker-image
name: 'Build Docker Image'
script:
- docker build --build-arg ARCH=amd64 --tag "${BITBUCKET_REPO_SLUG}:local" .
- docker save "${BITBUCKET_REPO_SLUG}:local" --output "${BITBUCKET_REPO_SLUG}.tar"
services:
- docker
caches:
- docker
artifacts:
- "*.tar"
- step: &docker-lint
image: hadolint/hadolint:v2.12.0-alpine
name: 'Docker Lint'
script:
- echo "Linting Dockerfile(s)"
- hadolint Dockerfile || echo "found linting issues in Dockerfile"
- step: &build-test
image: golang:1.21.1-alpine3.18
name: 'Build & Test'
script:
- go build -o bin/sbom-utils
- apk add bash
- go test -v -covermode=count -coverprofile=profile.out sbom-utilities/utils
artifacts:
- "bin/*"
- "profile.out"
- step: &go-formatter
image: golang:1.21.1-alpine3.18
name: 'Check Go Formatting'
script:
- gofmt -s -d $(find . -name "*.go")
- step: &go-lint-yourself
image: golang:1.21.1-alpine3.18
name: 'Go Linter'
script:
- wget -O- -nv https://raw.githubusercontent.com/golangci/golangci-lint/master/install.sh | sh -s v1.54.2
- bin/golangci-lint run ./...
- step: &gen-sbom-for-project
name: gen sbom
image: debian:bookworm-slim
services:
- docker
caches:
- docker
script:
- apt-get update
- DEBIAN_FRONTEND=noninteractive apt-get -y upgrade
- apt-get install -y curl
- curl -sSfL https://raw.githubusercontent.com/anchore/syft/main/install.sh | sh -s -- -b /usr/local/bin v1.0.1
- docker load --input "${BITBUCKET_REPO_SLUG}.tar"
- mkdir sbom_output
- syft "${BITBUCKET_REPO_SLUG}:local" --output [email protected] >> sbom_output/${BITBUCKET_REPO_SLUG}_cyclonedx-sbom.json
artifacts:
- sbom_output/*
pipelines:
pull-requests:
'**':
- parallel:
- step: *docker-lint
- step: *build-docker-image
- step: *build-test
- step: *go-formatter
- step: *go-lint-yourself
- step: *gen-sbom-for-project
branches:
main:
- parallel:
- step: *docker-lint
- step: *build-docker-image
- step: *build-test
- step: *go-formatter
- step: *go-lint-yourself
- step: *gen-sbom-for-project
custom:
push to Dockerhub (dev):
- step: *build-docker-image
- step:
name: 'Publish Dev Docker Image'
deployment: Development
script:
- echo ${DOCKERHUB_PASSWORD} | docker login --username "${DOCKERHUB_USERNAME}" --password-stdin
- docker load --input "${BITBUCKET_REPO_SLUG}.tar"
- docker tag "${BITBUCKET_REPO_SLUG}:local" "${DOCKERHUB_NAMESPACE}/${BITBUCKET_REPO_SLUG}:${DEV_VERSION}-${BITBUCKET_BUILD_NUMBER}"
- docker push "${DOCKERHUB_NAMESPACE}/${BITBUCKET_REPO_SLUG}:${DEV_VERSION}-${BITBUCKET_BUILD_NUMBER}"
services:
- docker
Prod Release:
- variables:
- name: PRODUCTION_VERSION
- step: *build-docker-image
- stage:
name: OSS Scan
steps:
- step: *gen-sbom-for-project
- step:
name: Scan SBOM
script:
- chmod 777 sbom_output
- pipe: docker://ccideas/sbom-utilities-pipe:1.2.0
variables:
PATH_TO_SBOM: 'sbom_output/${BITBUCKET_REPO_SLUG}_cyclonedx-sbom.json'
SCAN_SBOM_WITH_BOMBER: 'true'
BOMBER_OUTPUT_FORMAT: 'html'
BOMBER_DEBUG: 'true'
OUTPUT_DIRECTORY: 'sbom_output'
SCAN_SBOM_WITH_SBOMQS: 'true'
SBOMQS_OUTPUT_FORMAT: 'table'
SCAN_SBOM_WITH_OSV: 'true'
OSV_OUTPUT_FORMAT: 'json'
artifacts:
- sbom_output/*
- stage:
name: Deploy to Prod
deployment: Production
steps:
- step:
name: 'Publish Prod Docker Image'
script:
- echo ${DOCKERHUB_PASSWORD} | docker login --username "${DOCKERHUB_USERNAME}" --password-stdin
- docker load --input "${BITBUCKET_REPO_SLUG}.tar"
- docker tag "${BITBUCKET_REPO_SLUG}:local" "${DOCKERHUB_NAMESPACE}/${BITBUCKET_REPO_SLUG}:${PRODUCTION_VERSION}"
- docker push "${DOCKERHUB_NAMESPACE}/${BITBUCKET_REPO_SLUG}:${PRODUCTION_VERSION}"
services:
- docker
caches:
- docker
- step:
name: tag branch
image: alpine/git:1.0.26
script:
- git tag -a "v${PRODUCTION_VERSION}" -m "release version ${PRODUCTION_VERSION}"
- git push origin "v${PRODUCTION_VERSION}"