145 lines
3.8 KiB
YAML
145 lines
3.8 KiB
YAML
image: node:22
|
|
|
|
# We use stages for clarity of intent, and "needs" for dependencies and sequencing.
|
|
# "needs" should work in parallel where acceptable, and get any artifacts directly from the source step.
|
|
stages:
|
|
- download (untrusted)
|
|
- prepare
|
|
- deploy
|
|
|
|
# Install dependencies.
|
|
install:
|
|
stage: download (untrusted)
|
|
|
|
# NOTE: We ignore lifecycle scripts as they are a common attack vector.
|
|
script:
|
|
- npm ci --ignore-scripts
|
|
|
|
# Carry over the installed dependencies as artifacts in the pipeline.
|
|
artifacts:
|
|
paths:
|
|
# Hoisted / Shared dependencies.
|
|
- node_modules/
|
|
# Include all the package-specific node_modules directories.
|
|
# Lerna will try to hoist these dependencies to the root node_modules directory, but if there are conflicts (versions, etc)
|
|
# then it will put them in the package-specific node_modules directories.
|
|
- packages/stack/node_modules/
|
|
- packages/primitives/node_modules/
|
|
- packages/json-payment-protocol-v2/node_modules/
|
|
- packages/docs/node_modules/
|
|
|
|
# Verify that installed dependencies are free from known security issues.
|
|
audit:
|
|
stage: download (untrusted)
|
|
|
|
needs:
|
|
- install
|
|
|
|
script:
|
|
# Check for moderate, high and critical issues but ignore low impact issues.
|
|
- npm audit --audit-level=moderate
|
|
# Check for supply chain tampering with downloaded packages.
|
|
- npm audit signatures
|
|
|
|
build:
|
|
stage: prepare
|
|
|
|
needs:
|
|
- install
|
|
- audit
|
|
|
|
script:
|
|
- npm run build
|
|
|
|
# Carry over the build application in the pipeline.
|
|
artifacts:
|
|
paths:
|
|
- packages/docs/dist/
|
|
- packages/json-payment-protocol-v2/dist/
|
|
- packages/primitives/dist/
|
|
- packages/stack/dist/
|
|
|
|
# NOTE: Some tests depend on the build output, so we run tests after build.
|
|
test:
|
|
stage: prepare
|
|
|
|
needs:
|
|
- install
|
|
- audit
|
|
- build
|
|
|
|
script:
|
|
# Run tests
|
|
- npm run test
|
|
# Ensure no circular dependencies
|
|
- npm run madge
|
|
|
|
publish:development:
|
|
stage: deploy
|
|
|
|
needs:
|
|
- install
|
|
- audit
|
|
- build
|
|
- test
|
|
|
|
only:
|
|
- development
|
|
|
|
# Configure what tag to use for this publication.
|
|
variables:
|
|
NPM_TAG: 'development'
|
|
GITLAB_USER_EMAIL: 'ci@stack.xo.cash'
|
|
GITLAB_USER_NAME: 'GitLab CI'
|
|
|
|
script:
|
|
# Setup git config
|
|
- git config --global user.email "${GITLAB_USER_EMAIL}"
|
|
- git config --global user.name "${GITLAB_USER_NAME}"
|
|
|
|
# Configure git to push with CI token
|
|
- git remote set-url origin "https://gitlab-ci-token:$GL_TOKEN@$CI_SERVER_HOST/$CI_PROJECT_PATH.git"
|
|
|
|
# Ensure full Git history so Lerna can detect changes
|
|
- git fetch --unshallow
|
|
- git fetch origin development
|
|
|
|
# Check the current HEAD and the associated branch
|
|
- 'echo "CI_COMMIT_SHA: ${CI_COMMIT_SHA}"'
|
|
- git log -1
|
|
|
|
# Setup npm config for npmjs.com
|
|
- npm config set registry https://registry.npmjs.org/
|
|
- npm config set //registry.npmjs.org/:_authToken ${NPM_AUTH_TOKEN}
|
|
|
|
# Version and publish
|
|
- npm run publish
|
|
|
|
# TODO: Document the Lerna Recursive problem when we run lerna version on our main branch.
|
|
# NOTE: The "lerna version" command will create a new commit and push it to our main branch.
|
|
# This can create a problem where our CI on the "main" branch is recursively triggered.
|
|
# To prevent this, we add [ci skip] to our Lerna Version commit message.
|
|
# This is supported OOTB by GitLab (and GitHub).
|
|
# See: https://docs.gitlab.com/ee/ci/pipelines/#skip-a-pipeline
|
|
|
|
# Publish the documentation to GitLab Pages (for now).
|
|
publish:docs:
|
|
stage: deploy
|
|
|
|
# After this job successfully completes, GitLab will initiates a Pages deployment, publishing the contents in the specified artifacts directory.
|
|
pages: true
|
|
|
|
needs:
|
|
- build
|
|
- test
|
|
|
|
only:
|
|
- development
|
|
|
|
script:
|
|
- mv packages/docs/dist public
|
|
|
|
artifacts:
|
|
paths:
|
|
- public
|