.gitbay/ci.yml

 1jobs:
 2  # Fast feedback: this finishes in seconds, so it is not held behind the
 3  # suite.
 4  build:
 5    steps:
 6      - go build ./...
 7      - go vet ./...
 8  # The suite drives real git, ssh, sshd and gpg. Several tests skip
 9  # themselves when a tool is absent, so the prerequisites are asserted
10  # first, all of them in one step so one run names everything to install.
11  # A green check that quietly tested less is worse than a red one.
12  # The 20m is under the runner's own 30m limit, so go times out first and
13  # says which test hung instead of the runner killing it blind.
14  test:
15    steps:
16      - missing=""; for t in git git-lfs gpg; do command -v "$t" >/dev/null || missing="$missing $t"; done; test -x /usr/sbin/sshd || missing="$missing sshd"; test -z "$missing" || { echo "runner is missing:$missing"; exit 1; }
17      - go test ./... -count=1 -timeout 20m
18    paths-ignore:
19      - .gitbay/wiki/**
20  # Vulnerability scanning, separate from test so a newly published advisory
21  # against unchanged code does not mask a real test failure. It fails the
22  # build on purpose: an advisory that only lands in a report nobody reads is
23  # the state this replaced. @latest matches deploy/audit.sh, so a run scans
24  # against the database as it is today, not as it was at commit time.
25  #
26  # Nightly rather than per-push, because that last sentence is the whole
27  # job: the trigger is the advisory database, not the code. An advisory
28  # published against code nobody touched was invisible until someone
29  # happened to push, while a rebase that changed nothing re-scanned it.
30  # A schedule asks the question on the cadence the answer changes.
31  # `build trigger krz/gitbay vuln` runs it on demand before a release
32  # (#177).
33  vuln:
34    schedule: "0 3 * * *"
35    steps:
36      - go run golang.org/x/vuln/cmd/govulncheck@latest ./...
37  # SonarCloud static analysis. Report-only: unlike vuln this does not
38  # gate, so a first scan of an existing codebase does not turn every
39  # build red before anyone has read what it says. Flip the trailing
40  # `|| true` off to make the quality gate binding.
41  #
42  # Also nightly (#177). Report-only means it cannot fail a build, so
43  # analysing every push of a branch that is about to be squashed away
44  # informs nobody, and a stack being rebased analysed the same tree four
45  # times. A scheduled job is registered by a default-branch push, so
46  # this now tracks main — which is what the per-branch handling in the
47  # step below was protecting in the first place (#154). It still works
48  # on a branch when triggered by hand.
49  #
50  # One step, because each step runs in its own `sh -c` and an export
51  # would not survive to the next. The scanner is cached under the
52  # runner's home rather than re-downloading ~50MB per build, and the
53  # linux-x64 bundle carries its own JRE, which is why the host needs no
54  # Java.
55  sonar:
56    schedule: "30 3 * * *"
57    steps:
58      - |
59        set -eu
60        if [ -z "${SONAR_TOKEN:-}" ]; then
61          echo "no SONAR_TOKEN in this build's environment; skipping."
62          echo "A merge request from a fork is built without secrets on purpose,"
63          echo "so this is expected there and is not a failure."
64          exit 0
65        fi
66        VERSION=8.1.0.6389
67        HOME_DIR="${HOME:-/var/lib/gitbay-runner}"
68        SCANNER="$HOME_DIR/.sonar/sonar-scanner-$VERSION-linux-x64"
69        if [ ! -x "$SCANNER/bin/sonar-scanner" ]; then
70          echo "installing sonar-scanner $VERSION"
71          curl --create-dirs -fsSLo "$HOME_DIR/.sonar/sonar-scanner.zip" \
72            "https://binaries.sonarsource.com/Distribution/sonar-scanner-cli/sonar-scanner-cli-$VERSION-linux-x64.zip"
73          unzip -q -o "$HOME_DIR/.sonar/sonar-scanner.zip" -d "$HOME_DIR/.sonar/"
74          rm -f "$HOME_DIR/.sonar/sonar-scanner.zip"
75        fi
76        # Analyse each branch as itself. Without this every branch is
77        # recorded against the project's main branch, so a feature branch
78        # replaces main's results — a branch that removes findings makes
79        # main look clean before its fix is merged, and one that adds
80        # findings makes main look broken when it is not (#154).
81        BRANCH="${GITBAY_REF:-}"
82        BRANCH="${BRANCH#refs/heads/}"
83        BRANCH_ARG=""
84        if [ -n "$BRANCH" ] && [ "$BRANCH" != "main" ]; then
85          BRANCH_ARG="-Dsonar.branch.name=$BRANCH"
86        fi
87        SONAR_HOST_URL=https://sonarcloud.io \
88        "$SCANNER/bin/sonar-scanner" -Dsonar.scm.revision="${GITBAY_SHA:-}" $BRANCH_ARG || true