diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml index 88bd5afd..df74ebb5 100644 --- a/.gitlab-ci.yml +++ b/.gitlab-ci.yml @@ -41,14 +41,13 @@ cache: before_script: - apt-get update - apt-get install -y --no-install-recommends git unzip curl libzip-dev libpng-dev libonig-dev libxml2-dev libsqlite3-dev - - docker-php-ext-install pdo pdo_sqlite mbstring zip gd + - docker-php-ext-install pdo_sqlite mbstring zip gd - php -r "copy('https://getcomposer.org/installer', 'composer-setup.php');" - php composer-setup.php --install-dir=/usr/local/bin --filename=composer - rm composer-setup.php - composer install --prefer-dist --no-interaction --no-progress - - cp .env.example .env || true - | - cat > .env <<'EOF' + cat > .env <&1 | tee reports/composer-validate.log' + - bash -o pipefail -c 'php -v 2>&1 | tee reports/php-version.log' + - bash -o pipefail -c 'php artisan --version 2>&1 | tee reports/artisan-version.log' + artifacts: + when: always + expire_in: 7 days + paths: + - reports/ + - storage/logs/ laravel_pint: extends: .php_laravel_job stage: validate script: - - vendor/bin/pint --test + - mkdir -p reports + - bash -o pipefail -c 'vendor/bin/pint --test 2>&1 | tee reports/pint.log' + artifacts: + when: always + expire_in: 7 days + paths: + - reports/ + - storage/logs/ phpunit: extends: .php_laravel_job stage: test script: - - php artisan migrate --force - - php artisan test --testsuite=Feature --no-interaction - - php artisan test --testsuite=Unit --no-interaction + - mkdir -p reports + - bash -o pipefail -c 'php artisan migrate --force 2>&1 | tee reports/migrate.log' + - bash -o pipefail -c 'php artisan test --testsuite=Feature --no-interaction --log-junit reports/phpunit-feature.xml 2>&1 | tee reports/phpunit-feature.log' + - bash -o pipefail -c 'php artisan test --testsuite=Unit --no-interaction --log-junit reports/phpunit-unit.xml 2>&1 | tee reports/phpunit-unit.log' artifacts: when: always expire_in: 7 days + reports: + junit: + - reports/phpunit-feature.xml + - reports/phpunit-unit.xml paths: + - reports/ - storage/logs/ build_frontend: @@ -108,17 +127,27 @@ build_frontend: before_script: - npm ci script: - - npm run build + - mkdir -p reports + - sh -c 'npm run build 2>&1 | tee reports/npm-build.log' artifacts: + when: always expire_in: 7 days paths: - public/build/ + - reports/ composer_audit: extends: .php_laravel_job stage: security script: - - composer audit --locked --no-interaction + - mkdir -p reports + - bash -o pipefail -c 'composer audit --locked --no-interaction 2>&1 | tee reports/composer-audit.log' + artifacts: + when: always + expire_in: 7 days + paths: + - reports/ + - storage/logs/ npm_audit: image: node:22-alpine @@ -126,7 +155,13 @@ npm_audit: before_script: - npm ci script: - - npm audit --audit-level=high + - mkdir -p reports + - sh -c 'npm audit --audit-level=high 2>&1 | tee reports/npm-audit.log' + artifacts: + when: always + expire_in: 7 days + paths: + - reports/ allow_failure: true secret_detection_basic: @@ -135,15 +170,21 @@ secret_detection_basic: before_script: - apk add --no-cache git grep script: + - mkdir -p reports - | - echo "Scanning for obvious committed secrets..." + echo "Scanning for obvious committed secrets..." | tee reports/secret-detection-basic.log ! grep -RInE "(APP_KEY=base64:|DB_PASSWORD=.+|JWT_SECRET=.+|MAIL_PASSWORD=.+|PAYPAL_(CLIENT|SECRET|MODE)|AKIA[0-9A-Z]{16}|-----BEGIN (RSA|OPENSSH|PRIVATE) KEY-----)" \ --exclude-dir=.git \ --exclude-dir=vendor \ --exclude-dir=node_modules \ --exclude=.env.example \ --exclude=.env.prod.example \ - . + . 2>&1 | tee -a reports/secret-detection-basic.log + artifacts: + when: always + expire_in: 7 days + paths: + - reports/ allow_failure: false # Optional GitLab-native security scanners. @@ -151,4 +192,4 @@ secret_detection_basic: include: - template: Jobs/SAST.gitlab-ci.yml - template: Jobs/Secret-Detection.gitlab-ci.yml - - template: Jobs/Dependency-Scanning.gitlab-ci.yml + - template: Jobs/Dependency-Scanning.gitlab-ci.yml \ No newline at end of file diff --git a/database/database.sqlite b/database/database.sqlite new file mode 100644 index 00000000..c00c33ec Binary files /dev/null and b/database/database.sqlite differ diff --git a/database/database.sqlite-journal b/database/database.sqlite-journal new file mode 100644 index 00000000..aa4a8e40 Binary files /dev/null and b/database/database.sqlite-journal differ