diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml index 472bd6f43dd89dc39fd4648c69808381047bd5d1..fc74ee2db1a7bf3220c24489ea52080909ef5031 100644 --- a/.gitlab-ci.yml +++ b/.gitlab-ci.yml @@ -10,7 +10,7 @@ include: file: '/templates/validation.yml' - project: 'to-be-continuous/bash' ref: '3.3' - file: 'templates/gitlab-ci-bash.yml' + file: '/templates/gitlab-ci-bash.yml' - project: 'to-be-continuous/semantic-release' ref: '3.7' file: '/templates/gitlab-ci-semrel.yml' diff --git a/README.md b/README.md index 89d5aa8299d3c13dbdfb16ac4a154812907621ad..b27e7367bc747020ff4cd8cf4cb473dde426bd28 100644 --- a/README.md +++ b/README.md @@ -9,13 +9,36 @@ When run on other branches, Gitleaks will run a quick analysis on the current br ## Usage -In order to include this template in your project, add the following to your `gitlab-ci.yml`: +This template can be used both as a [CI/CD component](https://docs.gitlab.com/ee/ci/components/#use-a-component-in-a-cicd-configuration) +or using the legacy [`include:project`](https://docs.gitlab.com/ee/ci/yaml/index.html#includeproject) syntax. + +### Use as a CI/CD component + +Add the following to your `gitlab-ci.yml`: ```yaml include: + # 1: include the component + - component: gitlab.com/to-be-continuous/gitleaks/gitlab-ci-gitleaks@2.3.0 + # 2: set/override component inputs + inputs: + args: "--no-banner" # ⚠ this is only an example +``` + +### Use as a CI/CD template (legacy) + +Add the following to your `gitlab-ci.yml`: + +```yaml +include: + # 1: include the template - project: 'to-be-continuous/gitleaks' ref: '2.3.0' file: '/templates/gitlab-ci-gitleaks.yml' + +variables: + # 2: set/override template variables + GITLEAKS_ARGS: "--no-banner" # ⚠ this is only an example ``` ## `gitleaks` jobs configuration @@ -23,11 +46,11 @@ include: Those jobs trigger a Gitleaks analysis (either on the complete repository, either on the current branch). They use the following configuration. -| Name | Description | Default value | +| Input / Variable | Description | Default value | | --------------------- | -------------------------------------- | ----------------- | -| `GITLEAKS_IMAGE` | The Docker image used to run Gitleaks | `registry.hub.docker.com/zricethezav/gitleaks:latest` | -| `GITLEAKS_RULES` | Gitleaks [configuration rules](https://github.com/zricethezav/gitleaks#configuration) to use (you may also provide your own `.gitleaks.toml` configuration file in your project). | _none_ (uses default rules) | -| `GITLEAKS_ARGS` | [Options](https://github.com/zricethezav/gitleaks/wiki/Options) for a full Gitleaks analysis (on master or develop branches) | `--verbose` | +| `image` / `GITLEAKS_IMAGE` | The Docker image used to run Gitleaks | `registry.hub.docker.com/zricethezav/gitleaks:latest` | +| `rules` / `GITLEAKS_RULES` | Gitleaks [configuration rules](https://github.com/zricethezav/gitleaks#configuration) to use (you may also provide your own `.gitleaks.toml` configuration file in your project). | _none_ (uses default rules) | +| `args` / `GITLEAKS_ARGS` | [Options](https://github.com/zricethezav/gitleaks/wiki/Options) for a full Gitleaks analysis (on master or develop branches) | `--verbose` | ### Configuring Gitleaks rules diff --git a/bumpversion.sh b/bumpversion.sh index f06829a406ca8da98e570e8ad7d8bb22367b668d..ed44d7b68b0e09f6d2cf557f7a15e52553246341 100755 --- a/bumpversion.sh +++ b/bumpversion.sh @@ -27,13 +27,13 @@ if [[ "$curVer" ]]; then log_info "Bump version from \\e[33;1m${curVer}\\e[0m to \\e[33;1m${nextVer}\\e[0m (release type: $relType)..." # replace in README - sed -e "s/ref: '$curVer'/ref: '$nextVer'/" README.md > README.md.next + sed -e "s/ref: *'$curVer'/ref: '$nextVer'/" -e "s/ref: *\"$curVer\”/ref: \”$nextVer\”/" -e "s/component: *\(.*\)@$curVer/component: \1@$nextVer/" README.md > README.md.next mv -f README.md.next README.md # replace in template and variants for tmpl in templates/*.yml do - sed -e "s/\"$curVer\"/\"$nextVer\"/" "$tmpl" > "$tmpl.next" + sed -e "s/command: *\[\"--service\", \"\(.*\)\", \"$curVer\"\]/command: [\"--service\", \"\1\", \"$nextVer\"]/" "$tmpl" > "$tmpl.next" mv -f "$tmpl.next" "$tmpl" done else diff --git a/kicker.json b/kicker.json index 3aa95d8c5b2a1fc8dbe91f4034c47c92ba5a62e4..6856fba516b85ee55d3d061fa490410136156173 100644 --- a/kicker.json +++ b/kicker.json @@ -3,6 +3,8 @@ "description": "Detect and prevent hardcoded secrets in your Git repository with [Gitleaks](https://github.com/zricethezav/gitleaks/wiki)", "template_path": "templates/gitlab-ci-gitleaks.yml", "kind": "analyse", + "prefix": "gitleaks", + "is_component": true, "variables": [ { "name": "GITLEAKS_IMAGE", diff --git a/logo.png b/logo.png index 7f4a16cd2a821e36f2bcdc128ee947bf2fb5dd30..8f63671e075fe46a512fea40e2eab02824cc3edc 100644 Binary files a/logo.png and b/logo.png differ diff --git a/templates/gitlab-ci-gitleaks.yml b/templates/gitlab-ci-gitleaks.yml index 39370821a67ea20d61fe19bd461953011d9aa9b3..f3c6d99fde77de88cd082c032d80d04d62aee50b 100644 --- a/templates/gitlab-ci-gitleaks.yml +++ b/templates/gitlab-ci-gitleaks.yml @@ -14,6 +14,25 @@ # Floor, Boston, MA 02110-1301, USA. # ========================================================================================= # default workflow rules: Merge Request pipelines +spec: + inputs: + image: + description: The Docker image used to run Gitleaks + default: registry.hub.docker.com/zricethezav/gitleaks:latest + rules: + description: Gitleaks [configuration rules](https://github.com/zricethezav/gitleaks/wiki/Configuration) to use (you may also provide your own `.gitleaks.toml` configuration file in your project). + default: '' + args: + description: '[Options](https://github.com/zricethezav/gitleaks/wiki/Options) for a full Gitleaks analysis (on master or develop branches)' + default: --verbose + quick-args: + description: '[Options](https://github.com/zricethezav/gitleaks/wiki/Options) for a quick Gitleaks analysis (on feature branches)' + default: --verbose + quick-depth: + description: Number of commits to scan (on feature branches) + type: number + default: 10 +--- workflow: rules: # prevent branch pipeline when an MR is open (prefer MR pipeline) @@ -56,16 +75,19 @@ workflow: variables: # variabilized tracking image - TBC_TRACKING_IMAGE: "registry.gitlab.com/to-be-continuous/tools/tracking:master" + TBC_TRACKING_IMAGE: registry.gitlab.com/to-be-continuous/tools/tracking:master # Default Docker image (can be overridden) - GITLEAKS_IMAGE: "registry.hub.docker.com/zricethezav/gitleaks:latest" - GITLEAKS_ARGS: "--verbose" - + GITLEAKS_IMAGE: $[[ inputs.image ]] + GITLEAKS_ARGS: $[[ inputs.args ]] + GITLEAKS_RULES: $[[ inputs.rules ]] + GITLEAKS_QUICK_ARGS: $[[ inputs.quick-args ]] + GITLEAKS_QUICK_DEPTH: $[[ inputs.quick-depth ]] + # default production ref name (pattern) - PROD_REF: '/^(master|main)$/' + PROD_REF: /^(master|main)$/ # default integration ref name (pattern) - INTEG_REF: '/^develop$/' + INTEG_REF: /^develop$/ stages: - build