.gitlab-ci.yml

# You can override the included template(s) by including variable overrides
# SAST customization: https://docs.gitlab.com/ee/user/application_security/sast/#customizing-the-sast-settings
# Secret Detection customization: https://docs.gitlab.com/ee/user/application_security/secret_detection/#customizing-settings
# Dependency Scanning customization: https://docs.gitlab.com/ee/user/application_security/dependency_scanning/#customizing-the-dependency-scanning-settings
# Container Scanning customization: https://docs.gitlab.com/ee/user/application_security/container_scanning/#customizing-the-container-scanning-settings
# Note that environment variables can be set in several places
# See https://docs.gitlab.com/ee/ci/variables/#cicd-variable-precedence

variables:
  GIT_CLONE_PATH: '$CI_BUILDS_DIR/$CI_PROJECT_NAME/$CI_PIPELINE_ID/$CI_JOB_ID'
  DART_DEFAULT_BRANCH: "dart"
  PYTHON_DEFAULT_BRANCH: "python"
  DEFAULT_BRANCHES_REGEX: '^(dart|python)$'

stages:
  - Report
  - MR checks
  - Base code checks          # 🔎
  - Code analysis             # 🧐
  - test                      # 🔰 Gitlab SAST CI/CD
  - Develop updated           # 🚂 Thomas the merge engine
  - Package deploy

.ssh_dependencies_access_setup: &ssh_dependencies_access_setup
  - if [ -f /.dockerenv ]; then
      echo "Setting up Docker environment 🐳";
      command -v ssh-agent >/dev/null || ( apt update -y && apt install openssh-client -y );
      eval $(ssh-agent -s);
      mkdir -p ~/.ssh;
      echo "$SPARE_SSH_PRIVATE_KEY_64_ENCODED" | base64 --decode | tr -d '\r' > ~/.ssh/id_ed25519;
      chmod 600 ~/.ssh/id_ed25519;
      ssh-keygen -y -f ~/.ssh/id_ed25519 > ~/.ssh/id_ed25519.pub;
      chmod 700 ~/.ssh;
      ssh-keyscan $CI_SERVER_HOST >> ~/.ssh/known_hosts;
      chmod 644 ~/.ssh/known_hosts;
    else
      echo "Skipping Docker environment setup, assuming manual setup is enough... ⏭️";
    fi
  - git remote set-url origin git@$CI_SERVER_HOST:$CI_PROJECT_PATH.git

.pub_env_setup: &pub_env_setup
  - PUB_CACHE=${PUB_CACHE-"$HOME/.pub-cache"}
  - export PATH="$PATH":"$PUB_CACHE/bin"

.version_manager_setup: &version_manager_setup
  - if command -v puro &> /dev/null; then
      dart() { puro dart "$@"; };
      export -f dart;
    fi

.pub_get: &pub_get
  - dart pub get

.flutter_version_check: &flutter_version_check
  - current_version=$(flutter --version | awk 'NR==1 {print $2}' | xargs)
  - if [ ! -f /.dockerenv ] && [ "$current_version" != "$LATEST_FLUTTER_VERSION" ]; then
      echo "Flutter version requirement mismatch 🚨";
      echo "The latest version is $LATEST_FLUTTER_VERSION but you have $current_version.";
      exit 1;
    fi

.dart_project_setup: &dart_project_setup
  - *ssh_dependencies_access_setup
  - *pub_env_setup
  - *version_manager_setup
  - *flutter_version_check
  - *pub_get







Git conventions checks:
  stage: MR checks
  tags:
    - unix
  rules:
    - if: $CI_PIPELINE_SOURCE == "merge_request_event" && $CI_MERGE_REQUEST_TARGET_BRANCH_NAME == $DART_DEFAULT_BRANCH
    - if: $CI_PIPELINE_SOURCE == "merge_request_event" && $CI_MERGE_REQUEST_TARGET_BRANCH_NAME == $PYTHON_DEFAULT_BRANCH
  cache: []
  variables:
    MAX_COMMIT_MESSAGE_LENGTH: 82
  script:
    - git fetch --prune
    - if [ -z "$CI_MERGE_REQUEST_DESCRIPTION" ]; then
        echo "Merge request body is empty";
        exit 1;
      elif ! echo "$CI_MERGE_REQUEST_SOURCE_BRANCH_NAME" | grep -Eq '^(feature|bugfix|chore|refactor|acceptance-test-issues|hotfix)/[a-zA-Z]+-[0-9]+.*$'; then
        echo "Source branch name does not match the regular expression. Can only be one of feature|bugfix|chore|refactor|acceptance-test-issues|hotfix";
        exit 1;
      elif [ $(git log --merges origin/$CI_MERGE_REQUEST_TARGET_BRANCH_NAME.. --pretty=format:"%H" | wc -l) -ne 0 ]; then
        echo "Merge commits found in the merge request.";
        exit 1;
      fi

    - commitMessages=$(git log origin/$CI_MERGE_REQUEST_TARGET_BRANCH_NAME.. --pretty=format:%s)
    - while read -r commitMessage; do
        if [ ${#commitMessage} -gt $MAX_COMMIT_MESSAGE_LENGTH ]; then
          echo "Commit message exceeds $MAX_COMMIT_MESSAGE_LENGTH characters -> $commitMessage";
          exit 1;
        fi
        done <<< "$commitMessages";

    - echo "All git conventions followed ✅"

MR requirements:
  stage: MR checks
  tags:
    - unix
  cache: []
  rules:
    - if: $CI_PIPELINE_SOURCE == "merge_request_event" && $CI_MERGE_REQUEST_TARGET_BRANCH_NAME == $DART_DEFAULT_BRANCH
    - if: $CI_PIPELINE_SOURCE == "merge_request_event" && $CI_MERGE_REQUEST_TARGET_BRANCH_NAME == $PYTHON_DEFAULT_BRANCH
  script:
    - sem_labels_count=$(echo "$CI_MERGE_REQUEST_LABELS" | tr ',' '\n' | grep -c '^sem-')
    - if [ "$sem_labels_count" -ne 1 ]; then
        echo "❌ There must be exactly one label starting with 'sem-', but found $sem_labels_count.";
        exit 1;
      fi

    - echo "All MR requirements fulfilled ✅";

Dart format:
  stage: Base code checks
  tags:
    - unix
  rules:
    - if: $CI_PIPELINE_SOURCE == "merge_request_event" && $CI_MERGE_REQUEST_TARGET_BRANCH_NAME == $DART_DEFAULT_BRANCH
  cache:
    - key: dartpub
      paths:
        - $PUB_CACHE
  before_script:
    - *dart_project_setup
  script:
    - dart format --set-exit-if-changed .

Dart analysis:
  stage: Base code checks
  image: ghcr.io/cirruslabs/flutter:$LATEST_FLUTTER_VERSION
  tags:
    - unix
  rules:
    - if: $CI_COMMIT_BRANCH == $DART_DEFAULT_BRANCH
    - if: $CI_PIPELINE_SOURCE == "merge_request_event" && $CI_MERGE_REQUEST_TARGET_BRANCH_NAME == $DART_DEFAULT_BRANCH
  variables:
    # Space-separated list of lints to ignore
    IGNORED_LINTS: "deprecated_member_use_from_same_package"
  cache:
    - key: dartpub
      paths:
        - $PUB_CACHE
  before_script:
    - *dart_project_setup
    - if ! command -v yq &> /dev/null; then
        wget -q https://github.com/mikefarah/yq/releases/latest/download/yq_linux_amd64 -O /usr/local/bin/yq || (echo "Failed to install yq" && exit 1);
        chmod +x /usr/local/bin/yq;
      fi
    - for lint in $IGNORED_LINTS; do
        yq eval ".analyzer.errors.$lint = \"ignore\"" -i "analysis_options.yaml";
      done
  script:
    - dart analyze --fatal-infos .

Code generation:
  stage: Base code checks
  tags:
    - unix
  rules:
    - if: $CI_PIPELINE_SOURCE == "merge_request_event" && $CI_MERGE_REQUEST_TARGET_BRANCH_NAME == $DART_DEFAULT_BRANCH
  cache:
    - key: dartpub
      paths:
        - $PUB_CACHE
        - $PROJECT_PATH/.dart_tool
        - $PROJECT_PATH/build
        - $PROJECT_PATH/pubspec.lock
  before_script:
    - *dart_project_setup
  script:
    - dart run build_runner build --delete-conflicting-outputs --enable-experiment null-aware-elements
    - dart fix --apply && dart format .
    - git diff --exit-code




Update Dart changlelog:
  stage: Develop updated
  tags:
    - maintainer-access
    - unix
  rules:
    - if: $CI_COMMIT_BRANCH == $DART_DEFAULT_BRANCH
  cache:
    - key: dartpub
      paths:
        - $PUB_CACHE
        - $PROJECT_PATH/.dart_tool
        - $PROJECT_PATH/build
        - $PROJECT_PATH/pubspec.lock
  variables:
    TOKEN_HEADER: 'PRIVATE-TOKEN:'
  before_script:
    - *dart_project_setup
    - git config user.name $MR_MANAGER_USERNAME
    - git config user.email "$MR_MANAGER_USERNAME@noreply.$CI_SERVER_HOST"
  script:
    - mr_json_content=$(curl --header "$TOKEN_HEADER $MR_MANAGER_TOKEN" "$CI_API_V4_URL/projects/$CI_PROJECT_ID/repository/commits/$CI_COMMIT_SHA/merge_requests")
    - if [[ "$mr_json_content" == "[]" ]]; then
      echo "No MRs found associated with the last commit ⏩";
      exit 0;
      fi

    - mr_sem_label="$(echo $mr_json_content | jq -r '.[0].labels[] | select(startswith("sem-"))')"
    - case $mr_sem_label in
      "sem-skip") echo "Skipping changelog update ⏩";  exit 0 ;;
      "sem-add") sem_log_type="added" ;;
      "sem-change") sem_log_type="changed" ;;
      "sem-deprecate") sem_log_type="deprecated" ;;
      "sem-remove") sem_log_type="removed" ;;
      "sem-bugfix") sem_log_type="fixed" ;;
      "sem-security") sem_log_type="security" ;;
      esac
    - mr_title="$(echo $mr_json_content | jq -r '.[0].title')"

    - git pull origin $DART_DEFAULT_BRANCH --rebase
    - dart pub global activate cider
    - cider log "$sem_log_type" "$mr_title"
    - git commit -am 'Changelog updated'
    - git push origin HEAD:$DART_DEFAULT_BRANCH -o ci.skip  # prevent triggering pipeline again




Nuget deploy:
  stage: Package deploy
  image: mcr.microsoft.com/dotnet/sdk:6.0-windowsservercore-ltsc2022
  tags:
    - windows
  rules:
    - if: '$CI_COMMIT_BRANCH =~ /^[0-9]+\.[0-9]+\/csharp$/'
    - if: '$CI_COMMIT_BRANCH == "latest/csharp"'
  before_script: iex "& { $(irm https://aka.ms/install-artifacts-credprovider.ps1) }"
  script: dotnet pack src/Dimerce.CombipacClient/Dimerce.CombipacClient.csproj -c Release;
    dotnet nuget add source "${CI_API_V4_URL}/projects/${CI_PROJECT_ID}/packages/nuget/index.json" --name $CI_COMMIT_BRANCH --username gitlab-ci-token --password $CI_JOB_TOKEN --store-password-in-clear-text;
    dotnet nuget push "src\Dimerce.CombipacClient\bin\Release\*.nupkg" --source $CI_COMMIT_BRANCH;




semgrep-sast:
  stage: test
  tags:
    - docker
    - unix
  rules:
    - if: $CI_COMMIT_BRANCH == $DART_DEFAULT_BRANCH
    - if: $CI_COMMIT_BRANCH == $PYTHON_DEFAULT_BRANCH
    - if: $CI_PIPELINE_SOURCE == "merge_request_event" && $CI_MERGE_REQUEST_TARGET_BRANCH_NAME == $DART_DEFAULT_BRANCH
    - if: $CI_PIPELINE_SOURCE == "merge_request_event" && $CI_MERGE_REQUEST_TARGET_BRANCH_NAME == $PYTHON_DEFAULT_BRANCH
  artifacts:
    paths:
      - gl-sast-report.json

secret_detection:
  stage: test
  tags:
    - docker
    - unix
  rules:
    - if: $CI_COMMIT_BRANCH == $DART_DEFAULT_BRANCH
    - if: $CI_COMMIT_BRANCH == $PYTHON_DEFAULT_BRANCH
    - if: $CI_PIPELINE_SOURCE == "merge_request_event" && $CI_MERGE_REQUEST_TARGET_BRANCH_NAME == $DART_DEFAULT_BRANCH
    - if: $CI_PIPELINE_SOURCE == "merge_request_event" && $CI_MERGE_REQUEST_TARGET_BRANCH_NAME == $PYTHON_DEFAULT_BRANCH

SAST Wiki deploy:
  stage: test
  tags:
    - docker
    - unix
  needs:
    - job: semgrep-sast
      artifacts: true
  allow_failure: true
  image: python:3.13
  rules:
    - if: $CI_COMMIT_BRANCH == $DART_DEFAULT_BRANCH
    - if: $CI_COMMIT_BRANCH == $PYTHON_DEFAULT_BRANCH
    - if: $CI_PIPELINE_SOURCE == "merge_request_event" && $CI_MERGE_REQUEST_TARGET_BRANCH_NAME == $DART_DEFAULT_BRANCH
    - if: $CI_PIPELINE_SOURCE == "merge_request_event" && $CI_MERGE_REQUEST_TARGET_BRANCH_NAME == $PYTHON_DEFAULT_BRANCH
  before_script:
    - *ssh_dependencies_access_setup
    - git clone --depth 1 --branch release/shallow https://gitlab-ci-token:${CI_JOB_TOKEN}@${CI_SERVER_HOST}/didata-automatisering/app-tech/sast-wiki-dashboard.git
    - pip install --upgrade pip
    - pip install python-gitlab
  script:
    - python sast-wiki-dashboard/deploy_wiki_sast_report.py

include:
  - template: Jobs/SAST.latest.gitlab-ci.yml
  - template: Jobs/Secret-Detection.gitlab-ci.yml