Skip to content
Snippets Groups Projects
gitlab-ci-docker.yml 41.8 KiB
Newer Older
Pierre Smeyers's avatar
Pierre Smeyers committed
# =========================================================================================
Pierre Smeyers's avatar
Pierre Smeyers committed
# Copyright (C) 2021 Orange & contributors
Pierre Smeyers's avatar
Pierre Smeyers committed
#
# This program is free software; you can redistribute it and/or modify it under the terms
# of the GNU Lesser General Public License as published by the Free Software Foundation;
Pierre Smeyers's avatar
Pierre Smeyers committed
# either version 3 of the License, or (at your option) any later version.
#
# This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY;
# without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
# See the GNU Lesser General Public License for more details.
#
# You should have received a copy of the GNU Lesser General Public License along with this
# program; if not, write to the Free Software Foundation, Inc., 51 Franklin Street, Fifth
Pierre Smeyers's avatar
Pierre Smeyers committed
# Floor, Boston, MA  02110-1301, USA.
# =========================================================================================
spec:
  inputs:
    build-tool:
      description: The build tool to use for building container image
      options:
      - kaniko
      - buildah
      - dind
      default: kaniko
    kaniko-image:
      description: |-
        The image used to run kaniko

        _for kaniko build only_
      default: gcr.io/kaniko-project/executor:debug
    buildah-image:
      description: |-
        The image used to run buildah

        _for buildah build only_
      default: quay.io/buildah/stable:latest
    image:
      description: |-
        The image used to run the docker client

        _for Docker-in-Docker(dind) build only_
      default: registry.hub.docker.com/library/docker:latest
    dind-image:
      description: |-
        The image used to run the Docker daemon

        _for Docker-in-Docker(dind) build only_
      default: registry.hub.docker.com/library/docker:dind
    skopeo-image:
      description: The image used to publish docker image with Skopeo
      default: quay.io/skopeo/stable:latest
    file:
      description: The path to your `Dockerfile`
      default: Dockerfile
    context-path:
      description: The Docker [context path](https://docs.docker.com/engine/reference/commandline/build/#build-with-path) (working directory) - _only set if you want a context path different from the Dockerfile location_
      default: ''
    config-file:
      description: Path to the [Docker configuration file](https://docs.docker.com/engine/reference/commandline/cli/#sample-configuration-file) (JSON)
      default: .docker/config.json
    snapshot-image:
      description: Docker snapshot image
      default: $CI_REGISTRY_IMAGE/snapshot:$CI_COMMIT_REF_SLUG
    release-image:
      description: Docker release image
      default: $CI_REGISTRY_IMAGE:$CI_COMMIT_REF_NAME
    release-extra-tags-pattern:
      description: |-
        Defines the image tag pattern that `$DOCKER_RELEASE_IMAGE` should match to push extra tags (supports capturing groups)

        Defaults to [SemVer](https://semver.org/) pattern.
      default: ^v?(?P<major>[0-9]+)\.(?P<minor>[0-9]+)\.(?P<patch>[0-9]+)(?P<suffix>(?P<prerelease>-[0-9A-Za-z-\.]+)?(?P<build>\+[0-9A-Za-z-\.]+)?)$
    release-extra-tags:
      description: |-
        Defines extra tags to publish the _release_ image

        Supports capturing group references from `$DOCKER_RELEASE_EXTRA_TAGS_PATTERN` (ex: `latest \g<major>.\g<minor> \g<major>`)
      default: ''
    build-args:
      description: Additional docker/kaniko/buildah build arguments
      default: ''
    build-cache-disabled:
      description: Disable the build cache
      type: boolean
      default: false
    metadata:
      description: Additional metadata to set as labels
      default: >-
        --label org.opencontainers.image.url=${CI_PROJECT_URL}
        --label org.opencontainers.image.source=${CI_PROJECT_URL}
        --label org.opencontainers.image.title=${CI_PROJECT_PATH}
        --label org.opencontainers.image.ref.name=${CI_COMMIT_REF_NAME}
        --label org.opencontainers.image.revision=${CI_COMMIT_SHA}
        --label org.opencontainers.image.created=${CI_JOB_STARTED_AT}
    publish-args:
      description: Additional [`skopeo copy` arguments](https://github.com/containers/skopeo/blob/master/docs/skopeo-copy.1.md#options)
      default: ''
    prod-publish-strategy:
      description: Defines the publish to production strategy.
      options:
      - none
      - manual
      - auto
      default: manual
    semrel-release-disabled:
      description: Disable integration with the [semantic release template](https://gitlab.com/to-be-continuous/semantic-release/)
      type: boolean
      default: false
    registry-mirror:
      description: |-
        URL of a Docker registry mirror to use instead of default `https://index.docker.io`

        _Used by `kaniko` and `dind` builds only_
      default: ''
    container-registries-config-file:
      description: |-
        The [registries.conf](https://www.redhat.com/sysadmin/manage-container-registries) configuration to be used

        _Used by the `buildah` build only_
      default: ''
    kaniko-snapshot-image-cache:
      description: |-
        Snapshot image repository that will be used to store cached layers.

        _Used by the `kaniko` build only_
      default: ${DOCKER_SNAPSHOT_IMAGE%:*}/cache
    hadolint-disabled:
      description: Disable Hadolint
      type: boolean
      default: false
    hadolint-image:
      description: The docker image to lint your Dockerfile with Hadolint
      default: registry.hub.docker.com/hadolint/hadolint:latest-alpine
    hadolint-args:
      description: Additional `hadolint` arguments
      default: ''
    healthcheck-disabled:
      description: Disable Health Check
      type: boolean
      default: false
    healthcheck-timeout:
      description: When testing an image, how long (in seconds) wait for the HealthCheck status
      type: number
      default: 60
    healthcheck-options:
      description: Docker options for health check such as port mapping, environment...
      default: ''
    healthcheck-container-args:
      description: Arguments sent to the running container for health check
      default: ''
    trivy-disabled:
      description: Disable Trivy
      type: boolean
      default: false
    trivy-image:
      description: The docker image used to scan images with Trivy
      default: registry.hub.docker.com/aquasec/trivy:latest
    trivy-addr:
      description: The Trivy server address
      default: ''
    trivy-security-level-threshold:
      description: 'Severities of vulnerabilities to be displayed (comma separated values: `UNKNOWN`, `LOW`, `MEDIUM`, `HIGH`, `CRITICAL`)'
      options:
      - UNKNOWN,LOW,MEDIUM,HIGH,CRITICAL
      - LOW,MEDIUM,HIGH,CRITICAL
      - MEDIUM,HIGH,CRITICAL
      - HIGH,CRITICAL
      - CRITICAL
      default: UNKNOWN,LOW,MEDIUM,HIGH,CRITICAL
    trivy-args:
      description: Additional `trivy client` arguments
      default: --ignore-unfixed --vuln-type os --exit-on-eol 1
    trivy-db-repository:
      description: Custom DB repository path 
      default: ''
    sbom-disabled:
      description: Disable Software Bill of Materials
      type: boolean
      default: false
    sbom-image:
      default: registry.hub.docker.com/anchore/syft:debug
    sbom-opts:
      description: Options for syft used for SBOM analysis
      default: --override-default-catalogers rpm-db-cataloger,alpm-db-cataloger,apk-db-cataloger,dpkg-db-cataloger,portage-cataloger
Pierre Smeyers's avatar
Pierre Smeyers committed
# default workflow rules: Merge Request pipelines
workflow:
  rules:
Pierre Smeyers's avatar
Pierre Smeyers committed
    # prevent branch pipeline when an MR is open (prefer MR pipeline)
    - if: '$CI_COMMIT_BRANCH && $CI_OPEN_MERGE_REQUESTS'
      when: never
    - if: '$CI_COMMIT_MESSAGE =~ "/\[(ci skip|skip ci) on ([^],]*,)*tag(,[^],]*)*\]/" && $CI_COMMIT_TAG'
      when: never
    - if: '$CI_COMMIT_MESSAGE =~ "/\[(ci skip|skip ci) on ([^],]*,)*branch(,[^],]*)*\]/" && $CI_COMMIT_BRANCH'
      when: never
    - if: '$CI_COMMIT_MESSAGE =~ "/\[(ci skip|skip ci) on ([^],]*,)*mr(,[^],]*)*\]/" && $CI_MERGE_REQUEST_ID'
      when: never
    - if: '$CI_COMMIT_MESSAGE =~ "/\[(ci skip|skip ci) on ([^],]*,)*default(,[^],]*)*\]/" && $CI_COMMIT_REF_NAME =~ $CI_DEFAULT_BRANCH'
      when: never
    - if: '$CI_COMMIT_MESSAGE =~ "/\[(ci skip|skip ci) on ([^],]*,)*prod(,[^],]*)*\]/" && $CI_COMMIT_REF_NAME =~ $PROD_REF'
Loading
Loading full blame...