name: CI - Staging (GitHub)
jobs:
├── build-test-static-analysis
│   ├── Démarrage de PostgreSQL 16
│   ├── Spotless, Checkstyle et SpotBugs
│   ├── Tests unitaires
│   ├── Tests d'intégration
│   ├── Rapport JaCoCo
│   ├── Construction du fichier JAR
│   ├── Analyse CodeQL
│   └── Scan Trivy du système de fichiers
├── functional-tests
│   ├── Téléchargement du fichier JAR
│   ├── Scan de l'image Docker
│   ├── Démarrage du conteneur Flashcards
│   ├── Vérification de l'endpoint Actuator
│   ├── Installation de Node.js et Newman
│   └── Exécution des tests d'API
└── load-tests
    ├── Téléchargement du fichier JAR
    ├── Démarrage de l'application Spring Boot
    ├── Installation de k6
    └── Exécution des tests de charge

staging-build
     │
     ▼
staging-it
     │
     ├──────────────┐
     ▼              ▼
staging-trivy      semgrep-sast
     │              │
     └──────┬───────┘
            ▼
   staging-docker-build
            │
            ▼
   staging-trivy-image
            │
            ▼
   staging-functional
            │
            ▼
   staging-load-test

Pour cette branche, nous déclarons l'ensemble des étapes pour couvrir tout le cycle de vie de l'image
Ajoutons les stages suivant:

staging-build:
  stage: test
  image: maven:3.9.11-eclipse-temurin-17
  cache:
    key: maven
    paths:
      - .m2/repository
    policy: pull-push
  script:
    - chmod +x mvnw
    - ./mvnw spotless:check
    - ./mvnw -B clean test
  artifacts:
    when: always
    paths:
      - target/site/jacoco/
  rules:
    - if: '$CI_COMMIT_BRANCH == "staging"'

Résumé des étapes

staging-it:
  stage: test
  needs:
    - job: staging-build
      artifacts: true
  cache:
    key: maven
    paths:
      - .m2/repository
    policy: pull-push
  image: maven:3.9.11-eclipse-temurin-17
  services:
    - name: postgres:16.14-alpine3.23
      alias: postgres
  variables:
    SPRING_PROFILES_ACTIVE: it
    POSTGRES_DB: flashcardsdb
    POSTGRES_USER: postgres
    POSTGRES_PASSWORD: $POSTGRES_PASSWORD
    DB_HOST: postgres
    DB_PORT: "5432"
    DB_USER: postgres
    DB_PASSWORD: $POSTGRES_PASSWORD
  script:
    - chmod +x mvnw
    - sleep 10
    - ./mvnw -B verify -DskipUnitTests=true -Pcoverage-staging
  artifacts:
    when: always
    paths:
      - target/site/jacoco/
      - target/*.jar
      - target/failsafe-reports/
      - .m2/repository/
    expire_in: 30 mins
  rules:
    - if: '$CI_COMMIT_BRANCH == "staging"'

Résumé des étapes

staging-trivy:
  stage: security
  needs:
    - job: staging-it
      artifacts: true
  image:
    name: aquasec/trivy:0.72.0
    entrypoint: [""]
  cache:
    - key: maven
      paths:
        - .m2/repository
      policy: pull
    - key: trivy-db
      paths:
        - .trivycache
      policy: pull-push
  variables:
    TRIVY_CACHE_DIR: ".trivycache"
  script:
    - trivy fs \
        --severity HIGH,CRITICAL \
        --format table \
        --scanners vuln,misconfig \
        --skip-dirs ".trivycache" \
        --skip-dirs "target" \
        --cache-dir "$TRIVY_CACHE_DIR" \
        --offline-scan \
        --exit-code 0 \
        --no-progress \
      .
  rules:
    - if: '$CI_COMMIT_BRANCH == "staging"'

Résumé des étapes

staging-docker-build:
  stage: docker
  needs:
    - staging-trivy
    - job: staging-it
      artifacts: true
  image: docker:29.6.1
  services:
    - name: docker:29.6.1-dind
      alias: docker
  variables:
    DOCKER_HOST: tcp://docker:2376
    DOCKER_TLS_CERTDIR: "/certs"
    DOCKER_TLS_VERIFY: "1"
    DOCKER_CERT_PATH: "/certs/client"
  script:
    - chmod +x ci-scripts/docker-build.sh
    - ./ci-scripts/docker-build.sh flashcards staging
    - docker save flashcards:staging -o flashcards-staging.tar
  artifacts:
    paths:
      - flashcards-staging.tar
  rules:
    - if: '$CI_COMMIT_BRANCH == "staging"'

staging-trivy-image:
  stage: security-image
  needs:
    - job: staging-docker-build
      artifacts: true
  image:
    name: aquasec/trivy:0.72.0
    entrypoint: [""]
  cache:
    - key: trivy-db
      paths:
        - .trivycache
      policy: pull-push
  variables:
    TRIVY_CACHE_DIR: ".trivycache"
  script:
	  -  trivy image \
       --input flashcards-staging.tar \
       --severity HIGH,CRITICAL \
       --exit-code 0 \
       --ignore-unfixed \
       --timeout 10m \
       --cache-dir "$TRIVY_CACHE_DIR" \
       --format table \
       --no-progress
  rules:
    - if: '$CI_COMMIT_BRANCH == "staging"'

Résumé des étapes

staging-functional:
  stage: functional
  needs:
    - job: staging-docker-build
      artifacts: true
    - staging-trivy-image
  image: docker:29.6.1
  services:
    - name: docker:29.6.1-dind
      alias: docker
  variables:
    DOCKER_HOST: tcp://docker:2376
    DOCKER_TLS_CERTDIR: "/certs"
    DOCKER_TLS_VERIFY: "1"
    DOCKER_CERT_PATH: "/certs/client"
  script:
    - docker load -i flashcards-staging.tar
    - docker network create flashcards-net
    - |
      docker run -d \
        --name postgres \
        --network flashcards-net \
        -e POSTGRES_DB=flashcardsdb \
        -e POSTGRES_USER=postgres \
        -e POSTGRES_PASSWORD=$POSTGRES_PASSWORD \
        postgres:18.6-alpine3.23
    - |
      until docker exec postgres pg_isready -U postgres; do
        echo "Waiting for PostgreSQL..."
        sleep 2
      done
    - |
      docker run -d \
        --name flashcards-staging \
        --network flashcards-net \
        -e SPRING_PROFILES_ACTIVE=staging \
        -e SPRING_DATASOURCE_URL=jdbc:postgresql://postgres:5432/flashcardsdb \
        -e SPRING_DATASOURCE_USERNAME=postgres \
        -e SPRING_DATASOURCE_PASSWORD=$POSTGRES_PASSWORD \
        flashcards:staging
    - |
      started=false

      for i in $(seq 1 30); do
        if docker logs flashcards-staging 2>&1 | grep -q "Started FlashcardsApplication"; then
          echo "Application started"
          started=true
          break
        fi
        sleep 2
      done

      if [ "$started" != "true" ]; then
        echo "Application failed to start"
        docker logs flashcards-staging
        exit 1
      fi

    - |
      docker run --rm \
        --network flashcards-net \
        -v "$CI_PROJECT_DIR/postman:/etc/newman" \
        postman/newman:alpine \
        run /etc/newman/flashcards.postman_collection.json \
        -e /etc/newman/local.postman_environment.json \
        --env-var "base-url=http://flashcards-staging:8081" \
        --reporters cli,junit \
        --reporter-junit-export /etc/newman/newman-functional.xml

    - |
      docker run --rm \
        --network flashcards-net \
        -v "$CI_PROJECT_DIR/postman:/etc/newman" \
        postman/newman:alpine \
        run /etc/newman/flashcards_error_cases.postman_collection.json \
        -e /etc/newman/local.postman_environment.json \
        --env-var "base-url=http://flashcards-staging:8081" \
        --reporters cli,junit \
        --reporter-junit-export /etc/newman/newman-error.xml
  artifacts:
    when: always
    paths:
      - postman/newman-functional.xml
      - postman/newman-error.xml
      - container.log
    reports:
      junit:
        - postman/newman-functional.xml
        - postman/newman-error.xml
  after_script:
    - docker logs flashcards-staging > container.log 2>&1 || true
    - docker rm -f flashcards-staging || true
    - docker rm -f postgres || true
  rules:
    - if: '$CI_COMMIT_BRANCH == "staging"'

Résumé des étapes

staging-load-test:
  stage: performance
  when: manual
  allow_failure: true
  needs:
    - job: staging-docker-build
      artifacts: true
    - staging-trivy-image
  image: docker:29.6.1
  services:
    - name: docker:29.6.1-dind
      alias: docker
  variables:
    DOCKER_HOST: tcp://docker:2376
    DOCKER_TLS_CERTDIR: "/certs"
    DOCKER_TLS_VERIFY: "1"
    DOCKER_CERT_PATH: "/certs/client"
  script:
    - docker load -i flashcards-staging.tar
    - docker network create flashcards-net
    - |
      docker run -d \
        --name postgres \
        --network flashcards-net \
        -e POSTGRES_DB=flashcardsdb \
        -e POSTGRES_USER=postgres \
        -e POSTGRES_PASSWORD=$POSTGRES_PASSWORD \
        postgres:16.14-alpine3.23
    - |
      until docker exec postgres pg_isready -U postgres; do
        sleep 2
      done
    - |
      docker run -d \
        --name flashcards-staging \
        --network flashcards-net \
        -p 8081:8081 \
        -e SPRING_PROFILES_ACTIVE=staging \
        -e SPRING_DATASOURCE_URL=jdbc:postgresql://postgres:5432/flashcardsdb \
        -e SPRING_DATASOURCE_USERNAME=postgres \
        -e SPRING_DATASOURCE_PASSWORD=$POSTGRES_PASSWORD \
        flashcards:staging
    - |
      for i in $(seq 1 30); do
        if docker logs flashcards-staging 2>&1 | grep -q "Started FlashcardsApplication"; then
          echo "Application ready after ${i} attempt(s)"
          break
        fi
        if [ "$i" -eq 30 ]; then
          echo "Application failed to start after 60 seconds"
          docker logs flashcards-staging
          exit 1
        fi
        sleep 2
      done
    - |
      docker run --rm \
        --network flashcards-net \
        -e BASE_URL=http://flashcards-staging:8081 \
        -v "$CI_PROJECT_DIR/load-test:/scripts" \
        grafana/k6:2.2.0\
        run \
          --vus 50 \
          --duration 2m \
          --out json=/scripts/k6-report.json \
          /scripts/flashcards.js
  artifacts:
    when: always
    paths:
      - load-test/k6-report.json
      - container-loadtest.log
  after_script:
    - docker logs flashcards-staging > container-loadtest.log 2>&1 || true
    - docker rm -f flashcards-staging || true
    - docker rm -f postgres || true
  rules:
    - if: '$CI_COMMIT_BRANCH == "staging"'

Rôle global

Résumé des étapes