cf-gitlab/.gitlab-ci.yml at main · FlarelyLegal/cf-gitlab · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
# ─── CI/CD Pipeline ─────────────────────────────────────────────────────────
# Replaces Auto DevOps with checks appropriate for a shell-script repo.
# Runs on the shell executor runner (runner-1).
#
# Secret detection is handled by the detect-secrets pre-receive server hook,
# which blocks pushes containing leaked credentials before they enter the repo.
# ─────────────────────────────────────────────────────────────────────────────

# Prevent duplicate pipelines: if a branch push has an open MR, only the MR
# pipeline runs. Direct pushes to branches (including main) still trigger.
# Tag pushes create release pipelines.
workflow:
  rules:
    - if: $CI_PIPELINE_SOURCE == "merge_request_event"
    - if: $CI_COMMIT_BRANCH && $CI_OPEN_MERGE_REQUESTS
      when: never
    - if: $CI_COMMIT_BRANCH
    - if: $CI_COMMIT_TAG

variables:
  GITHUB_REPO: "FlarelyLegal/cf-gitlab"
  GITLAB_COM_PROJECT_ID: "79915657"

stages:
  - lint-fast
  - lint
  - test
  - build
  - deploy
  - release

include:
  # CI/CD Catalog components (flarely-legal/ci-templates)
  - component: gitlab.flarelylegal.com/flarely-legal/ci-templates/auto-label@~latest
  - component: gitlab.flarelylegal.com/flarely-legal/ci-templates/mr-description-check@~latest
  - component: gitlab.flarelylegal.com/flarely-legal/ci-templates/shellcheck@~latest
  - component: gitlab.flarelylegal.com/flarely-legal/ci-templates/shfmt@~latest
  - component: gitlab.flarelylegal.com/flarely-legal/ci-templates/printf-check@~latest
  - component: gitlab.flarelylegal.com/flarely-legal/ci-templates/executable-check@~latest
  - component: gitlab.flarelylegal.com/flarely-legal/ci-templates/prettier@~latest
  - component: gitlab.flarelylegal.com/flarely-legal/ci-templates/markdownlint@~latest
  - component: gitlab.flarelylegal.com/flarely-legal/ci-templates/codespell@~latest
  - component: gitlab.flarelylegal.com/flarely-legal/ci-templates/yamllint@~latest
  - component: gitlab.flarelylegal.com/flarely-legal/ci-templates/gitleaks@~latest
  - component: gitlab.flarelylegal.com/flarely-legal/ci-templates/semgrep@~latest
  - component: gitlab.flarelylegal.com/flarely-legal/ci-templates/mirror-github@~latest
  - component: gitlab.flarelylegal.com/flarely-legal/ci-templates/gitlab-release@~latest
  # Local workflows
  - local: ".gitlab/workflows/test-caddy.yml"
  - local: ".gitlab/workflows/build-caddy.yml"

# ─── Unit Tests ──────────────────────────────────────────────────────────────

cdn:test:
  stage: test
  tags: [linux, x64]
  script:
    - cd gitlab-cdn
    - npm ci --prefer-offline
    - npm run test:ci
  artifacts:
    when: always
    reports:
      junit: junit-cdn.xml
  rules:
    - changes:
        - "gitlab-cdn/**"