|
| 1 | +when: |
| 2 | + - event: [push, manual] |
| 3 | + branch: |
| 4 | + exclude: [main] |
| 5 | + - event: [pull_request] |
| 6 | + # Only run when PR targets development or other branches (not main) |
| 7 | + evaluate: 'CI_COMMIT_TARGET_BRANCH != "main"' |
| 8 | + # Build the source branch |
| 9 | + branch: |
| 10 | + exclude: [main] |
| 11 | + - event: [pull_request] |
| 12 | + # Also build latest image when development branch creates PR to main |
| 13 | + evaluate: 'CI_COMMIT_TARGET_BRANCH == "main" && CI_COMMIT_BRANCH == "development"' |
| 14 | + branch: [development] |
| 15 | + |
| 16 | +variables: |
| 17 | + - &docker_repo 'josaorg/contributions-web' |
| 18 | + - &slack_channel 'builds' |
| 19 | + # Docker build arguments template |
| 20 | + - &build_args_template |
| 21 | + - CI_COMMIT_SHA=${CI_COMMIT_SHA} |
| 22 | + - CI_BUILD_NUMBER=${CI_BUILD_NUMBER} |
| 23 | + - CI_BUILD_LINK=${CI_BUILD_LINK} |
| 24 | + - CI_COMMIT_LINK=${CI_COMMIT_LINK} |
| 25 | + - CI_REPO_LINK=${CI_REPO_LINK} |
| 26 | + - CI_BUILD_FINISHED=${CI_BUILD_FINISHED} |
| 27 | + # Success message template |
| 28 | + - &success_message > |
| 29 | + ✅ *SUCCESS* - Latest Build #{{ build.number }} |
| 30 | + |
| 31 | + 📁 *Repository:* {{ repo.name }} |
| 32 | + 🌿 *Branch:* {{ build.branch }} |
| 33 | + 📝 *Commit:* {{ truncate build.commit 8 }} |
| 34 | + 👤 *Author:* {{ build.author }} |
| 35 | + |
| 36 | + 🔗 *Links:* |
| 37 | + • <{{ build.link }}|View Build> |
| 38 | + # Failure message template |
| 39 | + - &failure_message > |
| 40 | + ❌ *FAILED* - Latest Build #{{ build.number }} |
| 41 | + |
| 42 | + 📁 *Repository:* {{ repo.name }} |
| 43 | + 🌿 *Branch:* {{ build.branch }} |
| 44 | + 📝 *Commit:* {{ truncate build.commit 8 }} |
| 45 | + 👤 *Author:* {{ build.author }} |
| 46 | + |
| 47 | + 🔗 *Links:* |
| 48 | + • <{{ build.link }}|View Build> |
| 49 | + |
| 50 | +steps: |
| 51 | + # Security check - scan for secrets/credentials |
| 52 | + - name: check-for-leaks |
| 53 | + image: zricethezav/gitleaks:v8.18.4 |
| 54 | + commands: |
| 55 | + - gitleaks detect --source . --verbose |
| 56 | + |
| 57 | + # Build latest image (development and other branches) |
| 58 | + - name: build-latest-image |
| 59 | + image: woodpeckerci/plugin-docker-buildx |
| 60 | + settings: |
| 61 | + repo: *docker_repo |
| 62 | + dockerfile: ./Dockerfile |
| 63 | + tags: |
| 64 | + - ${CI_COMMIT_SHA:-latest} |
| 65 | + - latest |
| 66 | + username: |
| 67 | + from_secret: DOCKER_HUB_USERNAME |
| 68 | + password: |
| 69 | + from_secret: DOCKER_HUB_PASSWORD |
| 70 | + build_args: *build_args_template |
| 71 | + depends_on: |
| 72 | + - check-for-leaks |
| 73 | + |
| 74 | + # Slack notification for latest build success |
| 75 | + - name: notify-slack-latest-success |
| 76 | + image: plugins/slack |
| 77 | + settings: |
| 78 | + webhook: |
| 79 | + from_secret: SLACK_WEBHOOK |
| 80 | + channel: *slack_channel |
| 81 | + template: *success_message |
| 82 | + when: |
| 83 | + - status: success |
| 84 | + depends_on: |
| 85 | + - check-for-leaks |
| 86 | + - build-latest-image |
| 87 | + |
| 88 | + # Slack notification for latest build failure |
| 89 | + - name: notify-slack-latest-failure |
| 90 | + image: plugins/slack |
| 91 | + settings: |
| 92 | + webhook: |
| 93 | + from_secret: SLACK_WEBHOOK |
| 94 | + channel: *slack_channel |
| 95 | + template: *failure_message |
| 96 | + when: |
| 97 | + - status: failure |
| 98 | + depends_on: |
| 99 | + - check-for-leaks |
| 100 | + - build-latest-image |
0 commit comments