.gitlab-ci.yml

---
# Copyright 2016-present Thomas Leplus
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
#     https://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.

include:
  - template: Jobs/Secret-Detection.gitlab-ci.yml
  - template: Jobs/SAST.gitlab-ci.yml
  - template: Jobs/SAST-IaC.gitlab-ci.yml

stages:
  - check
  - build

default:
  interruptible: true

variables:
  GIT_DEPTH: 1
  SAST_SEMGREP_METRICS: false
  SEMGREP_SEND_METRICS: off
  MAVEN_OPTS: >
    -Dhttps.protocols=TLSv1.2
    -Dmaven.repo.local=.m2/repository
    -Dorg.slf4j.simpleLogger.log.org.apache.maven.cli.transfer.Slf4jMavenTransferListener=WARN
    -Dorg.slf4j.simpleLogger.showDateTime=true
    -Djava.awt.headless=true
  MAVEN_CLI_OPTS: >
    --batch-mode
    --errors
    --fail-at-end
    --show-version
    -DinstallAtEnd=true
    -DdeployAtEnd=true

sast:
  stage: check

iac-sast:
  stage: check

kics-iac-sast:
  stage: check

secret_detection:
  stage: check

osv-scanner:
  allow_failure: true
  image:
    name: golang:alpine
    entrypoint:
      - "" # Entrypoint is overridden by GitLab anyway
  stage: check
  cache:
    key: osv-scanner
    paths:
      - .cache/gopath/pkg/mod
      - .cache/gocache
  variables:
    GOPATH: ${CI_PROJECT_DIR}/.cache/gopath
    GOCACHE: ${CI_PROJECT_DIR}/.cache/gocache
  before_script:
    - "go install github.com/google/osv-scanner/cmd/osv-scanner@latest"
  script:
    - 'PATH="${PATH}:${GOPATH}/bin" osv-scanner -r .'
  timeout: 10 minutes

super-linter:
  image:
    name: ghcr.io/super-linter/super-linter:v8.5.0@sha256:6831c0a801d353b510e4e468a3209a8a48bf0102e193d5c7e94e57667fdf64eb
    entrypoint:
      - "" # Entrypoint is overridden by GitLab anyway
  stage: check
  variables:
    BIOME_CONFIG_PATH: .biome.json
    ENFORCE_COMMITLINT_CONFIGURATION_CHECK: "true"
    FILTER_REGEX_EXCLUDE: "^/tmp/lint/(gradlew|gradlew\\.bat|gradle/.*|mvnw|mvnw\\.cmd|\\.m2/.*|\\.mvn/.*)$"
    JAVA_FILE_NAME: "google_checks.xml"
    LINTER_RULES_PATH: "."
    RUN_LOCAL: "true"
    USE_FIND_ALGORITHM: "true"
    VALIDATE_ALL_CODEBASE: "true"
  before_script:
    - 'ln -s "$(pwd)" /tmp/lint'
  script:
    - "/action/lib/linter.sh"
  timeout: 10 minutes

maven-check-versions:
  image:
    name: leplusorg/maven-check-versions:3.9.11@sha256:cabe45dc45c644032ba61b2f43e304baf382e834efe76d74a81c666b893c5dc2
    entrypoint:
      - "" # Entrypoint is overridden by GitLab anyway
  stage: check
  cache:
    key: maven
    paths:
      - .m2/repository
  variables:
    MAVEN_CLI_EXTRA_OPTS: "-DprocessDependencyManagementTransitive=false -Dmaven.version.ignore=(?i).+-(alpha|beta).+,(?i).+-m\\d+,(?i).+-rc\\d+"
  timeout: 10 minutes

maven:jdk17:
  stage: build
  image:
    name: maven:3-openjdk-17-slim
    entrypoint:
      - "" # Entrypoint is overridden by GitLab anyway
  cache:
    key: maven
    paths:
      - .m2/repository
  script:
    - "./mvnw $MAVEN_CLI_OPTS -DdependencyCheck.NVDApiKey=${NVD_API_KEY} verify"

maven:jdk21:
  stage: build
  image:
    name: maven:3-eclipse-temurin-21-alpine
    entrypoint:
      - "" # Entrypoint is overridden by GitLab anyway
  cache:
    key: maven
    paths:
      - .m2/repository
  script:
    - "./mvnw $MAVEN_CLI_OPTS -DdependencyCheck.NVDApiKey=${NVD_API_KEY} verify"

maven:jdk25:
  stage: build
  image:
    name: maven:3-eclipse-temurin-25-alpine
    entrypoint:
      - "" # Entrypoint is overridden by GitLab anyway
  cache:
    key: maven
    paths:
      - .m2/repository
  script:
    - "./mvnw $MAVEN_CLI_OPTS -DdependencyCheck.skip=true verify"