Initial commit

assets/templates/gitlab-ci/go-ci.yml

@@ -0,0 +1,548 @@
+# GitLab CI/CD Pipeline for Go
+# Optimized with caching, parallel execution, and deployment
+
+stages:
+  - security
+  - validate
+  - test
+  - build
+  - deploy
+
+variables:
+  GO_VERSION: "1.22"
+  GOPATH: "$CI_PROJECT_DIR/.go"
+  GOCACHE: "$CI_PROJECT_DIR/.cache/go-build"
+
+# Global cache configuration
+cache:
+  key:
+    files:
+      - go.mod
+      - go.sum
+  paths:
+    - .go/pkg/mod/
+    - .cache/go-build/
+  policy: pull
+
+# Reusable configuration
+.go_template:
+  image: golang:${GO_VERSION}
+  before_script:
+    - go version
+    - go env
+    - mkdir -p .go
+    - export PATH=$GOPATH/bin:$PATH
+
+# Validation stage
+lint:
+  extends: .go_template
+  stage: validate
+  cache:
+    key:
+      files:
+        - go.mod
+        - go.sum
+    paths:
+      - .go/pkg/mod/
+      - .cache/go-build/
+    policy: pull-push
+  script:
+    # Install golangci-lint
+    - curl -sSfL https://raw.githubusercontent.com/golangci/golangci-lint/master/install.sh | sh -s -- -b $(go env GOPATH)/bin
+    - golangci-lint run --timeout=5m
+
+format-check:
+  extends: .go_template
+  stage: validate
+  script:
+    - test -z "$(gofmt -s -l .)"
+    - go mod tidy
+    - git diff --exit-code go.mod go.sum
+  only:
+    - merge_requests
+    - main
+    - develop
+
+# Security: Secret Scanning
+secret-scan:trufflehog:
+  stage: security
+  image: trufflesecurity/trufflehog:latest
+  script:
+    - trufflehog filesystem . --json --fail > trufflehog-report.json || true
+    - |
+      if [ -s trufflehog-report.json ]; then
+        echo "❌ Secrets detected!"
+        cat trufflehog-report.json
+        exit 1
+      fi
+  artifacts:
+    when: always
+    paths:
+      - trufflehog-report.json
+    expire_in: 30 days
+  allow_failure: false
+  only:
+    - merge_requests
+    - main
+    - develop
+
+secret-scan:gitleaks:
+  stage: security
+  image: zricethezav/gitleaks:latest
+  script:
+    - gitleaks detect --source . --report-format json --report-path gitleaks-report.json
+  artifacts:
+    when: always
+    paths:
+      - gitleaks-report.json
+    expire_in: 30 days
+  allow_failure: true
+  only:
+    - merge_requests
+    - main
+    - develop
+
+# Security: SAST
+sast:semgrep:
+  stage: security
+  image: returntocorp/semgrep
+  script:
+    - semgrep scan --config=auto --sarif --output=semgrep.sarif .
+    - semgrep scan --config=p/owasp-top-ten --json --output=semgrep-owasp.json .
+  artifacts:
+    reports:
+      sast: semgrep.sarif
+    paths:
+      - semgrep.sarif
+      - semgrep-owasp.json
+    expire_in: 30 days
+  allow_failure: false
+  only:
+    - merge_requests
+    - main
+    - develop
+
+security:gosec:
+  extends: .go_template
+  stage: security
+  script:
+    - go install github.com/securego/gosec/v2/cmd/gosec@latest
+    - gosec -fmt json -out gosec-report.json ./... || true
+    - gosec ./...  # Fail on findings
+  artifacts:
+    when: always
+    paths:
+      - gosec-report.json
+    expire_in: 30 days
+  allow_failure: false
+  only:
+    - merge_requests
+    - main
+    - develop
+
+security:govulncheck:
+  extends: .go_template
+  stage: security
+  script:
+    - go install golang.org/x/vuln/cmd/govulncheck@latest
+    - govulncheck ./...
+  allow_failure: false
+  only:
+    - merge_requests
+    - main
+    - develop
+
+# Test stage with matrix
+test:
+  extends: .go_template
+  stage: test
+  parallel:
+    matrix:
+      - GO_VERSION: ["1.21", "1.22"]
+  services:
+    - postgres:15
+    - redis:7-alpine
+  variables:
+    POSTGRES_DB: testdb
+    POSTGRES_USER: testuser
+    POSTGRES_PASSWORD: testpass
+    DATABASE_URL: "postgresql://testuser:testpass@postgres:5432/testdb?sslmode=disable"
+    REDIS_URL: "redis://redis:6379"
+  script:
+    - go mod download
+    - go test -v -race -coverprofile=coverage.out -covermode=atomic ./...
+    - go tool cover -func=coverage.out
+  coverage: '/total:.*?(\d+\.\d+)%/'
+  artifacts:
+    when: always
+    reports:
+      coverage_report:
+        coverage_format: cobertura
+        path: coverage.out
+    paths:
+      - coverage.out
+    expire_in: 30 days
+
+benchmark:
+  extends: .go_template
+  stage: test
+  script:
+    - go test -bench=. -benchmem ./... | tee benchmark.txt
+  artifacts:
+    paths:
+      - benchmark.txt
+    expire_in: 7 days
+  only:
+    - main
+    - merge_requests
+
+# Build stage - multi-platform
+build:linux:amd64:
+  extends: .go_template
+  stage: build
+  variables:
+    GOOS: linux
+    GOARCH: amd64
+    CGO_ENABLED: "0"
+  script:
+    - |
+      go build \
+        -ldflags="-s -w -X main.version=$CI_COMMIT_SHORT_SHA -X main.buildTime=$(date -u +%Y-%m-%dT%H:%M:%SZ)" \
+        -o myapp-linux-amd64 \
+        ./cmd/myapp
+    - ls -lh myapp-linux-amd64
+  artifacts:
+    paths:
+      - myapp-linux-amd64
+    expire_in: 7 days
+  only:
+    - main
+    - develop
+    - tags
+
+build:linux:arm64:
+  extends: .go_template
+  stage: build
+  variables:
+    GOOS: linux
+    GOARCH: arm64
+    CGO_ENABLED: "0"
+  script:
+    - |
+      go build \
+        -ldflags="-s -w -X main.version=$CI_COMMIT_SHORT_SHA -X main.buildTime=$(date -u +%Y-%m-%dT%H:%M:%SZ)" \
+        -o myapp-linux-arm64 \
+        ./cmd/myapp
+    - ls -lh myapp-linux-arm64
+  artifacts:
+    paths:
+      - myapp-linux-arm64
+    expire_in: 7 days
+  only:
+    - main
+    - develop
+    - tags
+
+build:darwin:amd64:
+  extends: .go_template
+  stage: build
+  variables:
+    GOOS: darwin
+    GOARCH: amd64
+    CGO_ENABLED: "0"
+  script:
+    - |
+      go build \
+        -ldflags="-s -w -X main.version=$CI_COMMIT_SHORT_SHA -X main.buildTime=$(date -u +%Y-%m-%dT%H:%M:%SZ)" \
+        -o myapp-darwin-amd64 \
+        ./cmd/myapp
+    - ls -lh myapp-darwin-amd64
+  artifacts:
+    paths:
+      - myapp-darwin-amd64
+    expire_in: 7 days
+  only:
+    - tags
+
+build:darwin:arm64:
+  extends: .go_template
+  stage: build
+  variables:
+    GOOS: darwin
+    GOARCH: arm64
+    CGO_ENABLED: "0"
+  script:
+    - |
+      go build \
+        -ldflags="-s -w -X main.version=$CI_COMMIT_SHORT_SHA -X main.buildTime=$(date -u +%Y-%m-%dT%H:%M:%SZ)" \
+        -o myapp-darwin-arm64 \
+        ./cmd/myapp
+    - ls -lh myapp-darwin-arm64
+  artifacts:
+    paths:
+      - myapp-darwin-arm64
+    expire_in: 7 days
+  only:
+    - tags
+
+build:windows:amd64:
+  extends: .go_template
+  stage: build
+  variables:
+    GOOS: windows
+    GOARCH: amd64
+    CGO_ENABLED: "0"
+  script:
+    - |
+      go build \
+        -ldflags="-s -w -X main.version=$CI_COMMIT_SHORT_SHA -X main.buildTime=$(date -u +%Y-%m-%dT%H:%M:%SZ)" \
+        -o myapp-windows-amd64.exe \
+        ./cmd/myapp
+    - ls -lh myapp-windows-amd64.exe
+  artifacts:
+    paths:
+      - myapp-windows-amd64.exe
+    expire_in: 7 days
+  only:
+    - tags
+
+# Build Docker image
+build:docker:
+  stage: build
+  image: docker:24-cli
+  services:
+    - docker:24-dind
+  variables:
+    IMAGE_TAG: $CI_REGISTRY_IMAGE:$CI_COMMIT_SHORT_SHA
+  before_script:
+    - echo $CI_REGISTRY_PASSWORD | docker login -u $CI_REGISTRY_USER --password-stdin $CI_REGISTRY
+  script:
+    # Multi-stage build with Go
+    - docker pull $CI_REGISTRY_IMAGE:latest || true
+    - |
+      docker build \
+        --cache-from $CI_REGISTRY_IMAGE:latest \
+        --tag $IMAGE_TAG \
+        --tag $CI_REGISTRY_IMAGE:latest \
+        --build-arg GO_VERSION=$GO_VERSION \
+        --build-arg VERSION=$CI_COMMIT_SHORT_SHA \
+        --build-arg BUILD_TIME=$(date -u +%Y-%m-%dT%H:%M:%SZ) \
+        .
+    - docker push $IMAGE_TAG
+    - docker push $CI_REGISTRY_IMAGE:latest
+    - echo "IMAGE_FULL_NAME=$IMAGE_TAG" >> build.env
+  artifacts:
+    reports:
+      dotenv: build.env
+  only:
+    - main
+    - develop
+    - tags
+  tags:
+    - docker
+
+# Integration tests
+integration-test:
+  extends: .go_template
+  stage: test
+  needs: [build:linux:amd64]
+  dependencies:
+    - build:linux:amd64
+  services:
+    - postgres:15
+  variables:
+    POSTGRES_DB: testdb
+    POSTGRES_USER: testuser
+    POSTGRES_PASSWORD: testpass
+    DATABASE_URL: "postgresql://testuser:testpass@postgres:5432/testdb?sslmode=disable"
+    BINARY_PATH: "./myapp-linux-amd64"
+  script:
+    - chmod +x myapp-linux-amd64
+    - go test -v -tags=integration ./tests/integration/...
+  only:
+    - main
+    - merge_requests
+
+# Deploy to staging
+deploy:staging:
+  stage: deploy
+  image: bitnami/kubectl:latest
+  needs: [build:docker]
+  environment:
+    name: staging
+    url: https://staging.example.com
+    on_stop: stop:staging
+  before_script:
+    - kubectl config use-context staging-cluster
+  script:
+    - kubectl set image deployment/myapp myapp=$IMAGE_FULL_NAME --namespace=staging --record
+    - kubectl rollout status deployment/myapp --namespace=staging --timeout=5m
+    # Health check
+    - |
+      POD=$(kubectl get pod -n staging -l app=myapp -o jsonpath="{.items[0].metadata.name}")
+      kubectl exec -n staging $POD -- /myapp version
+      kubectl exec -n staging $POD -- curl -f http://localhost:8080/health || exit 1
+  only:
+    - develop
+  when: manual
+
+stop:staging:
+  stage: deploy
+  image: bitnami/kubectl:latest
+  environment:
+    name: staging
+    action: stop
+  script:
+    - kubectl scale deployment/myapp --replicas=0 --namespace=staging
+  when: manual
+  only:
+    - develop
+
+# Deploy to production
+deploy:production:
+  stage: deploy
+  image: bitnami/kubectl:latest
+  needs: [build:docker, integration-test]
+  environment:
+    name: production
+    url: https://api.example.com
+  before_script:
+    - kubectl config use-context production-cluster
+  script:
+    - echo "Deploying to production..."
+    - kubectl set image deployment/myapp myapp=$IMAGE_FULL_NAME --namespace=production --record
+    - kubectl rollout status deployment/myapp --namespace=production --timeout=5m
+
+    # Health check
+    - sleep 10
+    - |
+      for i in {1..10}; do
+        POD=$(kubectl get pod -n production -l app=myapp -o jsonpath="{.items[0].metadata.name}")
+        if kubectl exec -n production $POD -- curl -f http://localhost:8080/health; then
+          echo "Health check passed"
+          exit 0
+        fi
+        echo "Attempt $i failed, retrying..."
+        sleep 10
+      done
+      echo "Health check failed"
+      exit 1
+  only:
+    - main
+  when: manual
+
+# Deploy to Cloud Run
+deploy:cloudrun:
+  stage: deploy
+  image: google/cloud-sdk:alpine
+  needs: [build:docker]
+  environment:
+    name: production
+    url: https://myapp.run.app
+  before_script:
+    - echo $GCP_SERVICE_KEY | base64 -d > ${HOME}/gcp-key.json
+    - gcloud auth activate-service-account --key-file ${HOME}/gcp-key.json
+    - gcloud config set project $GCP_PROJECT_ID
+  script:
+    - |
+      gcloud run deploy myapp \
+        --image $IMAGE_FULL_NAME \
+        --region us-central1 \
+        --platform managed \
+        --allow-unauthenticated \
+        --memory 512Mi \
+        --cpu 1 \
+        --max-instances 10
+
+    # Health check
+    - |
+      URL=$(gcloud run services describe myapp --region us-central1 --format 'value(status.url)')
+      curl -f $URL/health || exit 1
+  only:
+    - main
+  when: manual
+
+# Create release
+release:
+  stage: deploy
+  image: registry.gitlab.com/gitlab-org/release-cli:latest
+  needs:
+    - build:linux:amd64
+    - build:linux:arm64
+    - build:darwin:amd64
+    - build:darwin:arm64
+    - build:windows:amd64
+  dependencies:
+    - build:linux:amd64
+    - build:linux:arm64
+    - build:darwin:amd64
+    - build:darwin:arm64
+    - build:windows:amd64
+  before_script:
+    - apk add --no-cache coreutils
+  script:
+    # Create checksums
+    - sha256sum myapp-* > checksums.txt
+    - cat checksums.txt
+  release:
+    tag_name: $CI_COMMIT_TAG
+    description: |
+      Go Binary Release
+
+      Binaries for multiple platforms:
+      - Linux (amd64, arm64)
+      - macOS (amd64, arm64/Apple Silicon)
+      - Windows (amd64)
+
+      Docker Image: $CI_REGISTRY_IMAGE:$CI_COMMIT_TAG
+
+      Checksums: See attached checksums.txt
+  assets:
+    links:
+      - name: 'Linux AMD64'
+        url: '${CI_PROJECT_URL}/-/jobs/artifacts/${CI_COMMIT_TAG}/raw/myapp-linux-amd64?job=build:linux:amd64'
+      - name: 'Linux ARM64'
+        url: '${CI_PROJECT_URL}/-/jobs/artifacts/${CI_COMMIT_TAG}/raw/myapp-linux-arm64?job=build:linux:arm64'
+      - name: 'macOS AMD64'
+        url: '${CI_PROJECT_URL}/-/jobs/artifacts/${CI_COMMIT_TAG}/raw/myapp-darwin-amd64?job=build:darwin:amd64'
+      - name: 'macOS ARM64'
+        url: '${CI_PROJECT_URL}/-/jobs/artifacts/${CI_COMMIT_TAG}/raw/myapp-darwin-arm64?job=build:darwin:arm64'
+      - name: 'Windows AMD64'
+        url: '${CI_PROJECT_URL}/-/jobs/artifacts/${CI_COMMIT_TAG}/raw/myapp-windows-amd64.exe?job=build:windows:amd64'
+      - name: 'Checksums'
+        url: '${CI_PROJECT_URL}/-/jobs/artifacts/${CI_COMMIT_TAG}/raw/checksums.txt?job=release'
+  only:
+    - tags
+
+# GitLab built-in security templates
+include:
+  - template: Security/Dependency-Scanning.gitlab-ci.yml
+  - template: Security/SAST.gitlab-ci.yml
+
+# Override GitLab template stages
+dependency_scanning:
+  stage: security
+
+sast:
+  stage: security
+
+# Workflow rules
+workflow:
+  rules:
+    - if: '$CI_PIPELINE_SOURCE == "merge_request_event"'
+    - if: '$CI_COMMIT_BRANCH == "main"'
+    - if: '$CI_COMMIT_BRANCH == "develop"'
+    - if: '$CI_COMMIT_TAG'
+
+# Interruptible jobs
+.interruptible_template:
+  interruptible: true
+
+lint:
+  extends: [.go_template, .interruptible_template]
+
+test:
+  extends: [.go_template, .interruptible_template]
+
+integration-test:
+  extends: [.go_template, .interruptible_template]