1stages:
 2  - build
 3  - test
 4  - deploy
 5
 6variables:
 7  DOCKER_DRIVER: overlay2
 8  DOCKER_TLS_CERTDIR: "/certs"
 9
10build:
11  stage: build
12  image: node:20
13  script:
14    - npm ci
15    - npm run build
16  artifacts:
17    paths:
18      - dist/
19    expire_in: 1 hour
20  cache:
21    key: ${CI_COMMIT_REF_SLUG}
22    paths:
23      - node_modules/
24
25test:
26  stage: test
27  image: node:20
28  script:
29    - npm ci
30    - npm run lint
31    - npm test
32  coverage: '/Lines\s*:\s*(\d+\.\d+)%/'
33  artifacts:
34    reports:
35      coverage_report:
36        coverage_format: cobertura
37        path: coverage/cobertura-coverage.xml
38
39deploy:
40  stage: deploy
41  image: bitnami/kubectl:latest
42  script:
43    - kubectl apply -f k8s/
44    - kubectl rollout status deployment/my-app
45  only:
46    - main
47  environment:
48    name: production
49    url: https://app.example.com

 1build-docker:
 2  stage: build
 3  image: docker:24
 4  services:
 5    - docker:24-dind
 6  before_script:
 7    - docker login -u $CI_REGISTRY_USER -p $CI_REGISTRY_PASSWORD $CI_REGISTRY
 8  script:
 9    - docker build -t $CI_REGISTRY_IMAGE:$CI_COMMIT_SHA .
10    - docker build -t $CI_REGISTRY_IMAGE:latest .
11    - docker push $CI_REGISTRY_IMAGE:$CI_COMMIT_SHA
12    - docker push $CI_REGISTRY_IMAGE:latest
13  only:
14    - main
15    - tags

 1.deploy_template: &deploy_template
 2  image: bitnami/kubectl:latest
 3  before_script:
 4    - kubectl config set-cluster k8s --server="$KUBE_URL" --insecure-skip-tls-verify=true
 5    - kubectl config set-credentials admin --token="$KUBE_TOKEN"
 6    - kubectl config set-context default --cluster=k8s --user=admin
 7    - kubectl config use-context default
 8
 9deploy:staging:
10  <<: *deploy_template
11  stage: deploy
12  script:
13    - kubectl apply -f k8s/ -n staging
14    - kubectl rollout status deployment/my-app -n staging
15  environment:
16    name: staging
17    url: https://staging.example.com
18  only:
19    - develop
20
21deploy:production:
22  <<: *deploy_template
23  stage: deploy
24  script:
25    - kubectl apply -f k8s/ -n production
26    - kubectl rollout status deployment/my-app -n production
27  environment:
28    name: production
29    url: https://app.example.com
30  when: manual
31  only:
32    - main

 1stages:
 2  - validate
 3  - plan
 4  - apply
 5
 6variables:
 7  TF_ROOT: ${CI_PROJECT_DIR}/terraform
 8  TF_VERSION: "1.6.0"
 9
10before_script:
11  - cd ${TF_ROOT}
12  - terraform --version
13
14validate:
15  stage: validate
16  image: hashicorp/terraform:${TF_VERSION}
17  script:
18    - terraform init -backend=false
19    - terraform validate
20    - terraform fmt -check
21
22plan:
23  stage: plan
24  image: hashicorp/terraform:${TF_VERSION}
25  script:
26    - terraform init
27    - terraform plan -out=tfplan
28  artifacts:
29    paths:
30      - ${TF_ROOT}/tfplan
31    expire_in: 1 day
32
33apply:
34  stage: apply
35  image: hashicorp/terraform:${TF_VERSION}
36  script:
37    - terraform init
38    - terraform apply -auto-approve tfplan
39  dependencies:
40    - plan
41  when: manual
42  only:
43    - main

 1include:
 2  - template: Security/SAST.gitlab-ci.yml
 3  - template: Security/Dependency-Scanning.gitlab-ci.yml
 4  - template: Security/Container-Scanning.gitlab-ci.yml
 5
 6trivy-scan:
 7  stage: test
 8  image: aquasec/trivy:latest
 9  script:
10    - trivy image --exit-code 1 --severity HIGH,CRITICAL $CI_REGISTRY_IMAGE:$CI_COMMIT_SHA
11  allow_failure: true

 1# Cache node_modules
 2build:
 3  cache:
 4    key: ${CI_COMMIT_REF_SLUG}
 5    paths:
 6      - node_modules/
 7    policy: pull-push
 8
 9# Global cache
10cache:
11  key: ${CI_COMMIT_REF_SLUG}
12  paths:
13    - .cache/
14    - vendor/
15
16# Separate cache per job
17job1:
18  cache:
19    key: job1-cache
20    paths:
21      - build/
22
23job2:
24  cache:
25    key: job2-cache
26    paths:
27      - dist/

 1generate-pipeline:
 2  stage: build
 3  script:
 4    - python generate_pipeline.py > child-pipeline.yml
 5  artifacts:
 6    paths:
 7      - child-pipeline.yml
 8
 9trigger-child:
10  stage: deploy
11  trigger:
12    include:
13      - artifact: child-pipeline.yml
14        job: generate-pipeline
15    strategy: depend