53 lines
2.0 KiB
YAML
53 lines
2.0 KiB
YAML
stages:
|
|
- test
|
|
- deploy
|
|
|
|
# -----------------------------------------------------------------
|
|
# Global Notification Logic (Runs after every job execution)
|
|
# -----------------------------------------------------------------
|
|
.notify_template: ¬ify_template
|
|
after_script:
|
|
- |
|
|
# Check if Telegram token is available before sending
|
|
if [ -n "$TELEGRAM_BOT_TOKEN" ] && [ -n "$TELEGRAM_CHAT_ID" ]; then
|
|
MESSAGE="🚀 *GitOps Pipeline Status Notification*
|
|
--------------------------------------
|
|
*Project:* ${CI_PROJECT_NAME}
|
|
*Stage:* ${CI_JOB_STAGE}
|
|
*Status:* ${CI_JOB_STATUS}
|
|
*Branch:* ${CI_COMMIT_REF_NAME}
|
|
*Author:* ${CI_COMMIT_AUTHOR}
|
|
*Commit:* ${CI_COMMIT_TITLE}
|
|
--------------------------------------
|
|
[View Pipeline Details](${CI_PIPELINE_URL})"
|
|
|
|
curl -s -X POST "https://api.telegram.org/bot${TELEGRAM_BOT_TOKEN}/sendMessage" \
|
|
-d "chat_id=${TELEGRAM_CHAT_ID}" \
|
|
-d "parse_mode=Markdown" \
|
|
-d "text=${MESSAGE}"
|
|
fi
|
|
|
|
# -----------------------------------------------------------------
|
|
# Stage 1: DevSecOps Vulnerability Scanning
|
|
# -----------------------------------------------------------------
|
|
security_scan:
|
|
stage: test
|
|
image:
|
|
name: aquasec/trivy:0.49.1
|
|
entrypoint: [""]
|
|
script:
|
|
# Scan the application docker image for High and Critical vulnerabilities
|
|
- trivy image --severity HIGH,CRITICAL nginxdemos/hello:plain-text
|
|
|
|
# -----------------------------------------------------------------
|
|
# Stage 2: Automated GitOps Deployment
|
|
# -----------------------------------------------------------------
|
|
deploy_application:
|
|
stage: deploy
|
|
image: docker:24.0.7-cli
|
|
script:
|
|
- docker pull nginxdemos/hello:plain-text
|
|
- docker compose -f ./stacks/hello-world/docker-compose.yml up -d
|
|
# Added bonus: Re-running ansible safely in pipeline if configuration changes
|
|
# - echo "$ANSIBLE_VAULT_PASSWORD" > .vault_pass
|
|
# - ansible-playbook -i hosts.ini main.yml --vault-password-file .vault_pass |