aws-lambda-python-packager/.gitlab-ci.yml at main · mumblepins/aws-lambda-python-packager · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
image: $DOCKER_REPO/cicd/poetry:3.9
variables:
  GIT_SUBMODULE_STRATEGY: recursive
  GIT_DEPTH: "1"
  GIT_SUBMODULE_DEPTH: "1"

.precommit-cache: &precommit-cache
  key: precommit
  paths:
    - .cache/pre-commit
  unprotect: true

.base:
  variables:
    PIP_CACHE_DIR: "$CI_PROJECT_DIR/.cache/pip"
    POETRY_CACHE_DIR: "$CI_PROJECT_DIR/.cache/poetry"
    PRE_COMMIT_HOME: "$CI_PROJECT_DIR/.cache/pre-commit"
  cache: &poetry_cache
    key: poetry
    paths:
      - .cache/pip
      - .cache/poetry
    unprotect: true
    policy: pull
  tags:
    - arm64
  before_script:
    - python -VV
    - poetry -V
    - poetry install --sync

setup-deps:
  extends: .base
  stage: .pre
  cache:
    policy: pull-push
  script:
    - echo "deps done"

pre_commit:
  extends: .base
  stage: test
  cache:
    - *precommit-cache
    - *poetry_cache
  script:
    - poetry run pre-commit run --all-files

test:
  extends: .base
  stage: test
  rules:
    - if: $CI_COMMIT_BRANCH
      changes:
        - pyproject.toml
        - poetry.lock
        - src/**/*
        - tests/**/*
  script:
    - poetry run pytest "tests/"
      -n 4
      --dist worksteal
      --reruns 3
      --verbose
      --cov=aws_lambda_python_packager
      --pyargs "aws_lambda_python_packager"
      --cov-report=html --cov-report=term --cov-report=xml
      --junitxml=junit.xml
  tags:
    - arm64
  coverage: '/Total coverage: \d+\.\d+%/'
  artifacts:
    paths:
      - htmlcov
    reports:
      coverage_report:
        coverage_format: cobertura
        path: coverage.xml
      junit: junit.xml

build:
  extends: .base
  stage: deploy
  script:
    - poetry build
  rules:
    - if: $CI_COMMIT_BRANCH
  artifacts:
    paths:
      - dist

publish:
  extends: .base
  stage: deploy
  script:
    - rm -rf dist
    - poetry build
    - pip install twine
    - twine upload dist/*.*
  rules:
    - if: $CI_COMMIT_TAG =~ /^v\d+\.\d+\.\d+/

include:
  - template: Jobs/SAST.gitlab-ci.yml
  - template: Jobs/SAST-IaC.gitlab-ci.yml
  - template: Jobs/Secret-Detection.gitlab-ci.yml

sast:
  stage: test
  tags:
    - x86-64

iac-sast:
  tags:
    - x86-64

secret_detection:
  tags:
    - x86-64