quality   : sera utilisé pour la publication sur SonarCloud 
smoke     : pour le smoke-test
publish   : pour la publication de l'image dans la registry Docker Hub

stages:
  - test
  - security
  - quality 
  - docker
  - security-image
  - functional
  - performance
  - smoke
  - publish

prod-build:
  stage: test
  services:
    - name: postgres:16.14-alpine3.23
      alias: postgres
  variables:
    POSTGRES_DB: flashcardsdb
    POSTGRES_USER: postgres
    POSTGRES_PASSWORD: $POSTGRES_PASSWORD
    DB_HOST: postgres
    DB_PORT: "5432"
    DB_USER: postgres
    DB_PASSWORD: $POSTGRES_PASSWORD
  cache:
    key: maven
    paths:
      - .m2/repository
    policy: pull-push
  image: maven:3.9.11-eclipse-temurin-17
  script: 
    - ./mvnw spotless:check
    - sleep 10
    - ./mvnw -B clean verify jacoco:report -Pcoverage-main
  artifacts:
    when: always
    paths:
      - target/*.jar
      - target/classes/
      - target/test-classes/
      - target/site/jacoco/
      - target/failsafe-reports/ 
  rules:
    - if: '$CI_COMMIT_BRANCH == "main"'

Résumé des étapes

[INFO] Starting audit...
[INFO] You have 0 Checkstyle violations.
[INFO]...
[INFO] --- spotbugs:4.8.6.2:spotbugs (spotbugs) @ flashcards ---
[INFO] Fork Value is true
[INFO] BugInstance size is 0
[INFO] Error size is 0
[INFO] No errors/warnings found

prod-trivy-fs:
  stage: security
  needs:
    - prod-build
      artifact: true
  image:
    name: aquasec/trivy:0.72.0
    entrypoint: [""]
  cache:
    - key: maven
      paths:
        - .m2/repository
      policy: pull
    - key: trivy-db
      paths:
        - .trivycache
      policy: pull-push
  variables:
    TRIVY_CACHE_DIR: ".trivycache"
  script:
    trivy fs . \
      --severity HIGH,CRITICAL \
      --format table \
      --offline-scan \
      --scanners vuln \
      --exit-code 1 \
      --no-progress
  rules:
    - if: '$CI_COMMIT_BRANCH == "main"'

Résumé des étapes

prod-sonarqube:
  variables:
    GIT_DEPTH: "0"
  stage: quality
  image: maven:3.10.0-eclipse-temurin-21
  needs:
    - job: prod-build
      artifacts: true
  script:
    - chmod +x mvnw
    - ./mvnw -B sonar:sonar \
      -Dsonar.host.url="$SONAR_HOST_URL" \
      -Dsonar.login="$SONAR_TOKEN" \
      -Dsonar.qualitygate.wait=true
  rules:
    - if: '$CI_COMMIT_BRANCH == "main"'

Résumé des étapes

<sonar.projectKey>val7304_flashcards</sonar.projectKey>
<sonar.organization>val7304</sonar.organization>
<sonar.projectName>flashcards</sonar.projectName>

prod-docker-build: 
  stage: docker
  needs:
    - job: prod-build
      artifacts: true
    - job: prod-sonarqube
      optional: true
    - prod-trivy-fs
  image: docker:29.6.1
  services:
    - name: docker:29.6.1-dind
      alias: docker
  variables:
    DOCKER_HOST: tcp://docker:2376
    DOCKER_TLS_CERTDIR: "/certs"
    DOCKER_TLS_VERIFY: "1"
    DOCKER_CERT_PATH: "/certs/client"
  script:
    - docker build \
	  -f "${DOCKERFILE}" \
	  -t "${IMAGE_NAME}:${IMAGE_TAG}" flashcards prod
    - docker save flashcards:prod -o flashcards-prod.tar
  artifacts:
    paths:
      - flashcards-prod.tar
  rules:
    - if: '$CI_COMMIT_BRANCH == "main"'

Résumé des étapes

prod-trivy-image:
  stage: security-image
  needs:
    - job: prod-docker-build
      artifacts: true
  image:
    name: aquasec/trivy:0.72.0
    entrypoint: [""]
  cache:
    - key: maven
      paths:
        - .m2/repository
      policy: pull
    - key: trivy-db
      paths:
        - .trivycache
      policy: pull-push
  variables:
    TRIVY_CACHE_DIR: ".trivycache"
  script:
    trivy image \
        --input "flashcards-prod.tar" \
        --severity HIGH,CRITICAL \
        --exit-code 1 \
        --ignore-unfixed \
        --ignorefile .trivyignore.yaml \
        --timeout 10m \
        --cache-dir ~/.cache/trivy \
        --format table \
        --no-progress
  rules:
    - if: '$CI_COMMIT_BRANCH == "main"'

Résumé des étapes

prod-smoke:
  stage: smoke
  needs:
    - job: prod-docker-build
      artifacts: true
  image: docker:29.6.1
  services:
    - name: docker:29.6.1-dind
      alias: docker
  variables:
    DOCKER_HOST: tcp://docker:2376
    DOCKER_TLS_CERTDIR: "/certs"
    DOCKER_TLS_VERIFY: "1"
    DOCKER_CERT_PATH: "/certs/client"
  script:
    - docker load -i flashcards-prod.tar
    - docker network create flashcards-net
    - |
      docker run -d \
        --name postgres \
        --network flashcards-net \
        -e POSTGRES_DB=flashcardsdb \
        -e POSTGRES_USER=postgres \
        -e POSTGRES_PASSWORD=$POSTGRES_PASSWORD \
        postgres:16.14-alpine3.23
    - |
      until docker exec postgres pg_isready -U postgres; do
        sleep 2
      done
    - |
      docker run -d \
        --name flashcards-prod \
        --network flashcards-net \
        -e SPRING_PROFILES_ACTIVE=prod \
        -e SPRING_DATASOURCE_URL=jdbc:postgresql://postgres:5432/flashcardsdb \
        -e SPRING_DATASOURCE_USERNAME=postgres \
        -e SPRING_DATASOURCE_PASSWORD=$POSTGRES_PASSWORD \
        flashcards:prod
    - |
      started=false
      for i in $(seq 1 60); do
        if docker logs flashcards-prod 2>&1 | grep -q "Started FlashcardsApplication"; then
          started=true
          break
        fi
        sleep 2
      done

      if [ "$started" != "true" ]; then
        echo "Application did not start"
        docker logs flashcards-prod
        exit 1
      fi
      
    - |
      for i in $(seq 1 30); do
        if docker run --rm \
            --network flashcards-net \
            curlimages/curl:8.13.0 \
            curl -fs http://flashcards-prod:8080/actuator/health; then
          echo "Health endpoint OK"
          break
        fi
        sleep 2
        if [ "$i" -eq 30 ]; then
          echo "Health endpoint never became available"
          docker logs flashcards-prod
          exit 1
        fi
      done
  after_script:
    - docker logs flashcards-prod > container-prod.log 2>&1 || true
    - docker rm -f flashcards-prod || true
    - docker rm -f postgres || true
  artifacts:
    when: always
    paths:
      - container-prod.log
  rules:
    - if: '$CI_COMMIT_BRANCH == "main"'

Résumé des étapes

Une fois connecté, on utilise une double validation pour déclarer le succès du test:

{"status":"UP","groups":["liveness","readiness"]}Health endpoint OK

prod-publish:
  stage: publish
  needs:
    - job: prod-docker-build
      artifacts: true
    - job: prod-smoke
    - job: prod-trivy-image
  image: docker:29.6.1
  services:
    - name: docker:29.6.1-dind
      alias: docker
  variables:
    DOCKER_HOST: tcp://docker:2376
    DOCKER_TLS_CERTDIR: "/certs"
    DOCKER_TLS_VERIFY: "1"
    DOCKER_CERT_PATH: "/certs/client"
  script:
    - docker load -i flashcards-prod.tar
    - echo "$CI_REGISTRY_PASSWORD" | docker login "$CI_REGISTRY" -u "$CI_REGISTRY_USER" --password-stdin
    - docker tag "${IMAGE_NAME}:${SOURCE_TAG}" "${CI_REGISTRY_IMAGE}:sha-${CI_COMMIT_SHORT_SHA}"
    - docker tag "${IMAGE_NAME}:${SOURCE_TAG}" "${CI_REGISTRY_IMAGE}:${CI_COMMIT_TAG}"
    - docker tag "${IMAGE_NAME}:${SOURCE_TAG}" "${CI_REGISTRY_IMAGE}:latest"
    - docker push "${CI_REGISTRY_IMAGE}:sha-${CI_COMMIT_SHORT_SHA}"
    - docker push "${CI_REGISTRY_IMAGE}:${CI_COMMIT_TAG}"
    - docker push "${CI_REGISTRY_IMAGE}:latest"
    - echo "Docker image successfully pushed to GitLab Container Registry"
  rules:
    - if: '$CI_COMMIT_TAG =~ /^v\d+\.\d+\.\d+$/'

Résumé des étapes