1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
# You can override the included template(s) by including variable overrides
#
# SAST customization:
# https://docs.gitlab.com/user/application_security/sast/#available-cicd-variables
#
# Secret Detection customization:
# https://docs.gitlab.com/user/application_security/secret_detection/pipeline/configure/
#
# Dependency Scanning customization:
# https://docs.gitlab.com/user/application_security/dependency_scanning_sbom/#customizing-analyzer-behavior
#
# Container Scanning customization:
# https://docs.gitlab.com/user/application_security/container_scanning/#customizing-analyzer-behavior
#
# Note that environment variables can be set in several places.
#
# See:
# https://docs.gitlab.com/ci/variables/#cicd-variable-precedence
#############################
# Pipeline stages
#############################
#
# Stages execute sequentially.
# Jobs within the same stage can run in parallel.
stages:
- rust
- security
#############################
# Global CI image
#############################
#
# Use the same Rust version as rust-toolchain.toml.
image: rust:1.96
#############################
# Global variables
#############################
variables:
# Store Cargo downloaded dependencies inside
# the project directory so GitLab can cache them.
CARGO_HOME: "$CI_PROJECT_DIR/.cargo"
# Enable GitLab secret scanning.
SECRET_DETECTION_ENABLED: "true"
#############################
# Cargo cache
#############################
#
# Cache dependencies and build artifacts between
# pipeline runs to make CI faster.
cache:
key:
files:
- Cargo.lock
paths:
- .cargo/
- target/
#############################
# Rust formatting
#############################
#
# Ensures code is formatted using rustfmt.
rust_fmt:
stage: rust
script:
- cargo fmt --all --check
#############################
# Rust linting
#############################
#
# Runs clippy with every enabled feature.
rust_clippy:
stage: rust
script:
- rustup component add clippy
- cargo clippy --all-targets --all-features
#############################
# Rust compile check
#############################
#
# Checks that the crate compiles with all features.
rust_check:
stage: rust
script:
- cargo check --all-features
#############################
# Rust tests
#############################
#
# Runs unit and integration tests with all features.
rust_tests:
stage: rust
script:
- cargo test --all-features
#############################
# Rust doc
#############################
#
# Runs rustdoc to catch rustdoc lint errors
rust_docs:
stage: rust
script:
- cargo doc --no-deps
#############################
# Rust unused dep detection
#############################
#
# Runs cargo-shear to catch unused dependencies
# these can often give false positives: thus allowed to fail
cargo-shear:
stage: rust
script:
- cargo install cargo-shear
- cargo shear
allow_failure: true
#############################
# GitLab Security Templates
#############################
#
# These templates add GitLab-managed security jobs.
include:
- template: Security/SAST.gitlab-ci.yml
- template: Security/Secret-Detection.gitlab-ci.yml
#############################
# Static Application Security Testing
#############################
#
# Scans the repository for security issues.
sast:
stage: security
#############################
# Secret Detection
#############################
#
# Detects accidentally committed secrets,
# such as API keys or credentials.
secret_detection:
stage: security