k3nny
f5f8546bcf
Bundles three patch releases (v0.2.16–v0.2.18): v0.2.18 — output formats (--format flag on glint check): - json: stable JSON report (schema_version: 1, findings array, summary) - sarif: SARIF 2.1.0 for GitHub Code Scanning / GitLab SAST - junit: JUnit XML for CI test-report artifacts (artifacts:reports:junit) - github: GitHub Actions ::error:: / ::warning:: annotation lines - Unknown --format value exits 2 with a helpful error message - Summary line routed to stderr in structured formats; context suppressed v0.2.17 — include resolution improvements: - Recursive include depth capped at 100 (matches GitLab's own limit) - project: and component: includes tracked in visited set (cycle detection) - $[[ inputs.KEY ]] / $[[ inputs.KEY | default(…) ]] substituted from with: - --cache-dir: persist fetched remote templates to disk (SHA-256 keyed) - --offline: serve from cache only; defaults to ~/.cache/glint v0.2.16 — new lint rules (GL034–GL041): - GL034: services map form requires name; alias must be valid DNS label - GL035: rules:changes / rules:exists absolute path detection - GL036: timeout format validation (job-level + default.timeout) - GL037: id_tokens entries must have an aud key - GL038: secrets entries must declare a provider (vault / gcp / azure) - GL039: pages: keyword + artifacts.paths consistency - GL040: duplicate stage names in stages: list - GL041: cache.key.files must be exact paths, not globs Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
117 lines
2.0 KiB
YAML
117 lines
2.0 KiB
YAML
stages:
|
|
- build
|
|
- test
|
|
- deploy
|
|
|
|
variables:
|
|
DEPLOY_ENV: staging
|
|
|
|
# GL034: services — string form and map form with name are both valid
|
|
service-string:
|
|
stage: build
|
|
script: [echo ok]
|
|
services:
|
|
- redis:latest
|
|
- postgres:14
|
|
|
|
service-map:
|
|
stage: build
|
|
script: [echo ok]
|
|
services:
|
|
- name: postgres:14
|
|
alias: db
|
|
- name: redis:latest
|
|
alias: cache-svc
|
|
|
|
# GL035: rules:changes/exists — relative paths are valid
|
|
rules-relative:
|
|
stage: test
|
|
script: [echo test]
|
|
rules:
|
|
- if: '$CI_COMMIT_BRANCH == "main"'
|
|
changes:
|
|
- src/**/*.go
|
|
- tests/*.go
|
|
- exists:
|
|
- Dockerfile
|
|
- docker-compose.yml
|
|
when: on_success
|
|
|
|
# GL036: timeout — valid duration strings
|
|
timeout-short:
|
|
stage: build
|
|
script: [echo build]
|
|
timeout: 30m
|
|
|
|
timeout-long:
|
|
stage: build
|
|
script: [echo build]
|
|
timeout: 1h 30m
|
|
|
|
timeout-words:
|
|
stage: test
|
|
script: [echo test]
|
|
timeout: 90 minutes
|
|
|
|
timeout-combined:
|
|
stage: deploy
|
|
script: [echo deploy]
|
|
timeout: 2 hours 30 minutes
|
|
|
|
# GL037: id_tokens — entry with valid aud
|
|
token-job:
|
|
stage: build
|
|
script: [echo build]
|
|
id_tokens:
|
|
VAULT_TOKEN:
|
|
aud: https://vault.example.com
|
|
SIGSTORE_TOKEN:
|
|
aud: sigstore
|
|
|
|
# GL038: secrets — valid provider keys
|
|
secret-vault:
|
|
stage: deploy
|
|
script: [echo deploy]
|
|
secrets:
|
|
DB_PASSWORD:
|
|
vault: production/db/password@ops
|
|
|
|
secret-gcp:
|
|
stage: deploy
|
|
script: [echo deploy]
|
|
secrets:
|
|
API_KEY:
|
|
gcp_secret_manager:
|
|
name: my-api-key
|
|
version: latest
|
|
|
|
# GL039: pages keyword — publish dir present in artifacts.paths
|
|
pages-keyword:
|
|
stage: deploy
|
|
script: [mkdocs build]
|
|
pages:
|
|
publish: site
|
|
artifacts:
|
|
paths:
|
|
- site
|
|
|
|
pages-keyword-default:
|
|
stage: deploy
|
|
script: [make docs]
|
|
pages: true
|
|
artifacts:
|
|
paths:
|
|
- public
|
|
|
|
# GL040: no duplicate stages (unique stages defined above)
|
|
|
|
# GL041: cache.key.files — list of exact paths
|
|
cache-key-job:
|
|
stage: build
|
|
script: [echo build]
|
|
cache:
|
|
key:
|
|
files:
|
|
- go.sum
|
|
- go.mod
|