.gitlab-ci.yml

---
# Copyright 2016-present Thomas Leplus
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
#     http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.

include:
  - template: Security/Secret-Detection.gitlab-ci.yml
  - template: Security/SAST.gitlab-ci.yml

stages:
  - check
  - build

variables:
  MAVEN_OPTS: >
    -Dhttps.protocols=TLSv1.2
    -Dmaven.repo.local=.m2/repository
    -Dorg.slf4j.simpleLogger.log.org.apache.maven.cli.transfer.Slf4jMavenTransferListener=WARN
    -Dorg.slf4j.simpleLogger.showDateTime=true
    -Djava.awt.headless=true
  MAVEN_CLI_OPTS: >
    --batch-mode
    --errors
    --fail-at-end
    --show-version
    -DinstallAtEnd=true
    -DdeployAtEnd=true

cache:
  paths:
    - .m2/repository

sast:
  stage: check

secret_detection:
  stage: check

OSV scanner:
  image:
    name: golang:latest
  stage: check
  before_script:
    - "go install github.com/google/osv-scanner/cmd/osv-scanner@v1"
  script:
    - 'PATH="${PATH}:$(go env GOPATH)/bin" osv-scanner -r .'
  timeout: 10 minutes

super linter:
  image:
    name: ghcr.io/super-linter/super-linter:latest
    entrypoint:
      - ""
  stage: check
  variables:
    RUN_LOCAL: "true"
    DEFAULT_BRANCH: "main"
    USE_FIND_ALGORITHM: "true"
    VALIDATE_ALL_CODEBASE: "true"
    LINTER_RULES_PATH: "."
    FILTER_REGEX_EXCLUDE: "(gradlew|gradlew.bat|gradle/*|mvnw|mvnw.cmd|.m2/*|.mvn/**)"
    JAVA_FILE_NAME: "google_checks.xml"
  before_script:
    - 'ln -s "$(pwd)" /tmp/lint'
  script:
    - "/action/lib/linter.sh"
  timeout: 10 minutes

maven check versions:
  image:
    name: leplusorg/maven-check-versions:3.9.9@sha256:abdd53328be1c87d7bf21b868d47d7934b28dfc66e168d9625877616ab14d6da
  stage: check
  variables:
    IGNORED_VERSIONS: "(?i).+-(alpha|beta).+,(?i).+-m\\d+,(?i).+-rc\\d+"
  script:
    - "/opt/maven-check-versions.sh"
  timeout: 10 minutes

verify:jdk11:
  stage: build
  image: maven:3-openjdk-11-slim
  script:
    - "./mvnw $MAVEN_CLI_OPTS -DdependencyCheck.NVDApiKey=${NVD_API_KEY} verify"

verify:jdk17:
  stage: build
  image: maven:3-openjdk-17-slim
  script:
    - "./mvnw $MAVEN_CLI_OPTS -DdependencyCheck.NVDApiKey=${NVD_API_KEY} verify"

verify:jdk21:
  stage: build
  image: maven:3-eclipse-temurin-21-alpine
  script:
    - "./mvnw $MAVEN_CLI_OPTS -DdependencyCheck.NVDApiKey=${NVD_API_KEY} verify"