-
Pierre Smeyers authoredPierre Smeyers authored
kicker.json 10.00 KiB
{
"name": "Python",
"description": "Build, test and analyse your [Python](https://www.python.org/) projects",
"template_path": "templates/gitlab-ci-python.yml",
"kind": "build",
"prefix": "python",
"is_component": true,
"variables": [
{
"name": "PYTHON_IMAGE",
"description": "The Docker image used to run Python - **set the version required by your project**",
"default": "registry.hub.docker.com/library/python:3"
},
{
"name": "PYTHON_PROJECT_DIR",
"description": "Python project root directory",
"default": "."
},
{
"name": "PYTHON_BUILD_SYSTEM",
"description": "Python build-system to use to install dependencies, build and package the project",
"type": "enum",
"values": ["auto", "setuptools", "poetry", "pipenv", "reqfile"],
"default": "auto",
"advanced": true
},
{
"name": "PYTHON_REQS_FILE",
"description": "Main requirements file _(relative to `$PYTHON_PROJECT_DIR`)_\n\nFor [Requirements Files](https://pip.pypa.io/en/stable/user_guide/#requirements-files) build-system only",
"default": "requirements.txt",
"advanced": true
},
{
"name": "PYTHON_EXTRA_REQS_FILES",
"description": "Extra dev requirements file(s) to install _(relative to `$PYTHON_PROJECT_DIR`)_\n\nFor [Requirements Files](https://pip.pypa.io/en/stable/user_guide/#requirements-files) build-system only",
"default": "requirements-dev.txt",
"advanced": true
},
{
"name": "PYTHON_COMPILE_ARGS",
"description": "[`compileall` CLI options](https://docs.python.org/3/library/compileall.html)",
"default": "*",
"advanced": true
},
{
"name": "PIP_OPTS",
"description": "pip extra [options](https://pip.pypa.io/en/stable/cli/pip/#general-options)",
"advanced": true
},
{
"name": "PYTHON_EXTRA_DEPS",
"description": "Extra sets of dependencies to install\n\nFor [Setuptools](https://setuptools.pypa.io/en/latest/userguide/dependency_management.html?highlight=extras#optional-dependencies) or [Poetry](https://python-poetry.org/docs/pyproject/#extras) only"
}
],
"features": [
{
"id":"package",
"name":"package",
"description":"This job allows building your Python project [distribution packages](https://packaging.python.org/en/latest/glossary/#term-Distribution-Package).",
"enable_with": "PYTHON_PACKAGE_ENABLED"
},
{
"id": "py-lint",
"name": "py-lint",
"description": "Code analysis based on [pylint](http://pylint.pycqa.org/en/latest/) Python lib.",
"enable_with": "PYLINT_ENABLED",
"variables": [
{
"name": "PYLINT_ARGS",
"description": "Additional [pylint CLI options](http://pylint.pycqa.org/en/latest/user_guide/run.html#command-line-options)", "advanced": true
},
{
"name": "PYLINT_FILES",
"description": "Files or directories to analyse",
"advanced": true
}
]
},
{
"id": "unittest",
"name": "unittest",
"description": "Unit tests based on [unittest](https://docs.python.org/3/library/unittest.html) framework",
"enable_with": "UNITTEST_ENABLED",
"variables": [
{
"name": "UNITTEST_ARGS",
"description": "Additional xmlrunner/unittest CLI options",
"advanced": true
}
]
},
{
"id": "pytest",
"name": "pytest",
"description": "Unit tests based on [pytest](https://docs.pytest.org/) framework",
"enable_with": "PYTEST_ENABLED",
"variables": [
{
"name": "PYTEST_ARGS",
"description": "Additional [pytest](https://docs.pytest.org/en/stable/usage.html) or [pytest-cov](https://github.com/pytest-dev/pytest-cov#usage) CLI options",
"advanced": true
}
]
},
{
"id": "py-nosetests",
"name": "py-nosetests",
"description": "Unit tests based on [nose](https://nose.readthedocs.io/) framework",
"enable_with": "NOSETESTS_ENABLED",
"variables": [
{
"name": "NOSETESTS_ARGS",
"description": "Additional [nose CLI options](https://nose.readthedocs.io/en/latest/usage.html#options)",
"advanced": true
}
]
},
{
"id": "bandit",
"name": "Bandit",
"description": "[Bandit](https://pypi.org/project/bandit/) analysis (SAST)",
"enable_with": "BANDIT_ENABLED",
"variables": [
{
"name": "BANDIT_ARGS",
"description": "Additional [Bandit CLI options](https://github.com/PyCQA/bandit#usage)",
"default": "--recursive .",
"advanced": true
}
]
},
{
"id": "trivy",
"name": "Trivy",
"description": "Detect security vulnerabilities with [Trivy](https://github.com/aquasecurity/trivy/) (dependencies analysis)",
"enable_with": "PYTHON_TRIVY_ENABLED",
"variables": [
{
"name": "PYTHON_TRIVY_IMAGE", "description": "The Docker image used to run Trivy",
"default": "registry.hub.docker.com/aquasec/trivy:latest",
"advanced": true
},
{
"name": "PYTHON_TRIVY_ARGS",
"description": "Additional [Trivy CLI options](https://aquasecurity.github.io/trivy/v0.21.1/getting-started/cli/fs/)",
"default": "--vuln-type library",
"advanced": true
}
]
},
{
"id": "sbom",
"name": "Software Bill of Materials",
"description": "This job generates a file listing all dependencies using [syft](https://github.com/anchore/syft)",
"disable_with": "PYTHON_SBOM_DISABLED",
"variables": [
{
"name": "PYTHON_SBOM_SYFT_URL",
"description": "Url to the `tar.gz` package for `linux_amd64` of Syft to use\n\n_When unset, the latest version will be used_",
"advanced": true
},
{
"name": "PYTHON_SBOM_NAME",
"description": "Component name of the emitted SBOM",
"default": "$CI_PROJECT_PATH/$PYTHON_PROJECT_DIR",
"advanced": true
},
{
"name": "PYTHON_SBOM_OPTS",
"description": "Options for syft used for SBOM analysis",
"default": "--override-default-catalogers python-package-cataloger",
"advanced": true
}
]
},
{
"id": "release",
"name": "Release",
"description": "Manually trigger a release of your code (uses [bumpversion](https://pypi.org/project/bumpversion/))",
"enable_with": "PYTHON_RELEASE_ENABLED",
"variables": [
{
"name": "PYTHON_RELEASE_NEXT",
"type": "enum",
"values": [
"",
"major",
"minor",
"patch"
],
"description": "The part of the version to increase (one of: `major`, `minor`, `patch`)",
"default": "minor",
"advanced": true
},
{
"name": "PYTHON_SEMREL_RELEASE_DISABLED",
"description": "Disable semantic-release integration",
"type": "boolean",
"advanced": true
},
{
"name": "PYTHON_RELEASE_COMMIT_MESSAGE",
"description": "The Git commit message to use on the release commit. This is templated using the [Python Format String Syntax](http://docs.python.org/2/library/string.html#format-string-syntax). Available in the template context are current_version and new_version.",
"default": "chore(python-release): {current_version} → {new_version}",
"advanced": true
},
{
"name": "GIT_USERNAME", "description": "Git username for Git push operations",
"secret": true
},
{
"name": "GIT_PASSWORD",
"description": "Git password for Git push operations",
"secret": true
},
{
"name": "GIT_PRIVATE_KEY",
"description": "SSH key for Git push operations",
"secret": true
},
{
"name": "PYTHON_REPOSITORY_URL",
"type": "url",
"description": "Target PyPI repository to publish packages.\n\n_defaults to [GitLab project's packages repository](https://docs.gitlab.com/ee/user/packages/pypi_repository/)_",
"default": "${CI_SERVER_URL}/api/v4/projects/${CI_PROJECT_ID}/packages/pypi"
},
{
"name": "PYTHON_REPOSITORY_USERNAME",
"description": "Target PyPI repository username credential",
"secret": true,
"default": "gitlab-ci-token"
},
{
"name": "PYTHON_REPOSITORY_PASSWORD",
"description": "Target PyPI repository password credential",
"secret": true,
"default": "$CI_JOB_TOKEN"
}
]
}
],
"variants": [
{
"id": "vault",
"name": "Vault",
"description": "Retrieve secrets from a [Vault](https://www.vaultproject.io/) server",
"template_path": "templates/gitlab-ci-python-vault.yml",
"variables": [
{
"name": "TBC_VAULT_IMAGE",
"description": "The [Vault Secrets Provider](https://gitlab.com/to-be-continuous/tools/vault-secrets-provider) image to use",
"default": "registry.gitlab.com/to-be-continuous/tools/vault-secrets-provider:master",
"advanced": true
},
{
"name": "VAULT_BASE_URL",
"description": "The Vault server base API url",
"mandatory": true
},
{
"name": "VAULT_OIDC_AUD",
"description": "The `aud` claim for the JWT",
"default": "$CI_SERVER_URL"
},
{
"name": "VAULT_ROLE_ID",
"description": "The [AppRole](https://www.vaultproject.io/docs/auth/approle) RoleID",
"mandatory": true,
"secret": true
},
{
"name": "VAULT_SECRET_ID",
"description": "The [AppRole](https://www.vaultproject.io/docs/auth/approle) SecretID",
"mandatory": true,
"secret": true
}
] }
]
}