.gitlab-ci.yml

# This file is a template, and might need editing before it works on your project.
# This is a sample GitLab CI/CD configuration file that should run without any modifications.
# It demonstrates a basic 3 stage CI/CD pipeline. Instead of real tests or scripts,
# it uses echo commands to simulate the pipeline execution.
#
# A pipeline is composed of independent jobs that run scripts, grouped into stages.
# Stages run in sequential order, but jobs within stages run in parallel.
#
# For more information, see: https://docs.gitlab.com/ee/ci/yaml/index.html#stages
#
# You can copy and paste this template into a new `.gitlab-ci.yml` file.
# You should not add this template to an existing `.gitlab-ci.yml` file by using the `include:` keyword.
#
# To contribute improvements to CI/CD templates, please follow the Development guide at:
# https://docs.gitlab.com/ee/development/cicd/templates.html
# This specific template is located at:
# https://gitlab.com/gitlab-org/gitlab/-/blob/master/lib/gitlab/ci/templates/Getting-Started.gitlab-ci.yml


stages:          # List of stages for jobs, and their order of execution
  - build-maven
  - security-scanning
  - build-docker
  - test-backend
  - test-ui
  - visualization


include:
  #- 'gitlab-ci/code-quality/code-quality.gitlab-ci.yml'
  - template: Code-Quality.gitlab-ci.yml
  - template: Jobs/SAST.gitlab-ci.yml
  - template: Jobs/Dependency-Scanning.gitlab-ci.yml
  - template: Jobs/Secret-Detection.gitlab-ci.yml
  - template: Jobs/License-Scanning.gitlab-ci.yml


# disable the spotbugs and use sempgrep.
variables:
  DS_INCLUDE_DEV_DEPENDENCIES: "false"
  SAST_EXCLUDED_ANALYZERS: bandit,gosec,eslint,spotbugs
  DS_JAVA_VERSION: 8

code_quality:
  stage: build-maven
  services:            # Shut off Docker-in-Docker
  tags:
    - cq-sans-dind     # Set this job to only run on our new specialized runner
  artifacts:
    paths: [gl-code-quality-report.json]

sast:
  stage: security-scanning
  needs: ["build-maven-job"]
  tags:
    - cq-sans-dind     # Set this job to only run on our new specialized runner

dependency_scanning:
  stage: security-scanning
  needs: ["build-maven-job"]
  tags:
    - cq-sans-dind     # Set this job to only run on our new specialized runner

.secret-analyzer:
  stage: security-scanning
  needs: ["build-maven-job"]
  tags:
    - cq-sans-dind     # Set this job to only run on our new specialized runner