Skip to content

Commit 59fcd7a

Browse files
damienjburksdamienjburks
committed
adding azdo pipelines
1 parent 132087a commit 59fcd7a

File tree

6 files changed

+279
-0
lines changed

6 files changed

+279
-0
lines changed

‎.azdo-pipelines/azure-pipelines.yml‎

Lines changed: 40 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,40 @@
1+
### Manual workflow triggers are built-in to the pipeline
2+
### No need for the workflow_dispatch trigger like in GitHub Actions
3+
## This is the main pipeline file
4+
## This file is used to call all the other templates
5+
variables:
6+
- group: Infrastructure Pipeline Variables
7+
- name: ACR_SERVICE_CONNECTION
8+
- name: image_repo
9+
10+
pool:
11+
vmImage: 'ubuntu-latest'
12+
13+
stages:
14+
- stage: build_image
15+
displayName: 'Build Docker Image'
16+
jobs:
17+
- template: "pipeline_templates/build-image.yml"
18+
19+
- stage: lint_formating
20+
displayName: 'Lint and Format'
21+
jobs:
22+
- template: pipeline_templates/linting.yml
23+
parameters:
24+
python_version: '3.12.6'
25+
26+
27+
- stage: unit_and_security_testing
28+
displayName: 'Unit security testing'
29+
jobs:
30+
- template: "pipeline_templates/unit-sec-scan.yml"
31+
32+
33+
- stage: push_image
34+
displayName: 'Push Docker Image'
35+
jobs:
36+
- template: "pipeline_templates/push-image.yml"
37+
38+
39+
40+

‎.azdo-pipelines/pipeline_templates/build-image.yml‎

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
## Build Docker Image
2+
# parameters:
3+
# - name: imageName
4+
# type: string
5+
# default: 'awesome-fastapi'
6+
7+
8+
9+
jobs:
10+
- job:
11+
steps:
12+
- checkout: self
13+
displayName: 'Checkout repo'
14+
15+
- script: |
16+
echo "Building Docker image..."
17+
docker build -t awesome-fastapi:$(Build.SourceVersion).
18+
displayName: 'Build Docker Image'
19+

‎.azdo-pipelines/pipeline_templates/linting.yml‎

Lines changed: 37 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,37 @@
1+
2+
### Linting and Formatting checks
3+
parameters:
4+
- name: python_version
5+
type: string
6+
default: '3.12.6'
7+
8+
jobs:
9+
- job: lint_formating
10+
displayName: 'Lint and Format'
11+
pool:
12+
vmImage: 'ubuntu-latest'
13+
steps:
14+
- checkout: self
15+
16+
- task: UsePythonVersion@0
17+
inputs:
18+
versionSpec: ${{ parameters.python_version }}
19+
20+
- script: |
21+
echo "Installing dependencies..."
22+
python -m pip install --upgrade pip
23+
pip install -r requirements.txt
24+
25+
- script: |
26+
echo "Running pylint..."
27+
pylint .
28+
29+
- script: |
30+
echo "Running black..."
31+
black --check .
32+
33+
34+
# /.azdo-pipelines/pipeline_templates/linting.yml (Line: 8, Col: 1): While parsing a block mapping, did not find expected key. == "SyntaxError: while parsing a block mapping"
35+
36+
# /.azdo-pipelines/pipeline_templates/linting.yml (Line: 15, Col: 25): A sequence was not expected == ' I did not need the matric and stratgey when using parameters in the template file. I should have used 'parameters' instead of 'matrix' and 'strategy'.'
37+
# /.azdo-pipelines/azure-pipelines.yml (Line: 20, Col: 26): Unexpected parameter 'pythonVersion' == "pythonVersion in the main yaml file was not matching with the one in the template file. It should be 'python-version' instead of 'pythonVersion'."

‎.azdo-pipelines/pipeline_templates/push-image.yml‎

Lines changed: 27 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,27 @@
1+
2+
jobs:
3+
- job: push_image
4+
displayName: 'Build and Push Docker Image'
5+
pool:
6+
vmImage: 'ubuntu-latest'
7+
steps:
8+
- checkout: self
9+
displayName: 'Checkout repo'
10+
### Push the Docker image to Azure Container Registry ###
11+
- task: Docker@2
12+
displayName: 'Build and Push Docker Image to ACR'
13+
inputs:
14+
command: buildAndPush
15+
containerRegistry: $(ACR_SERVICE_CONNECTION) # name of your ADO service connection to ACR
16+
repository: $(image_repo) # e.g. myacr.azurecr.io/myapp
17+
dockerfile: $(src/Dockerfile) # e.g. src/Dockerfile
18+
tags: |
19+
latest
20+
$(Build.BuildId)
21+
22+
23+
# /.azdo-pipelines/pipeline_templates/push-image.yml (Line: 9, Col: 25): While parsing a block mapping, did not find expected key.
24+
25+
26+
# Job push_image: Step input containerRegistry references service connection $(dockerRegistryServiceConnection) which could not be found. The service connection does not exist,
27+
# has been disabled or has not been authorized for use. For authorization details, refer to https://aka.ms/yamlauthz.

‎.azdo-pipelines/pipeline_templates/sample-push.yml‎

Lines changed: 58 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,58 @@
1+
name: Push Docker Image
2+
3+
4+
on:
5+
workflow_call:
6+
7+
env:
8+
# Use docker.io for Docker Hub if empty
9+
REGISTRY: ghcr.io
10+
IMAGE_NAME: 'awesome-fastapi'
11+
12+
13+
jobs:
14+
Push_Image:
15+
runs-on: ubuntu-latest
16+
steps:
17+
- name: Checkout repository
18+
uses: actions/checkout@v4
19+
20+
# Set up Docker Buildx
21+
- name: Set up Docker Buildx
22+
id: buildx
23+
uses: docker/setup-buildx-action@f95db51fddba0c2d1ec667646a06c2ce06100226
24+
25+
# Extract metadata (tags, labels) for Docker
26+
- name: Extract metadata for Docker
27+
id: meta
28+
uses: docker/metadata-action@v3
29+
with:
30+
images: ghcr.io/${{ github.repository_owner }}/${{ env.IMAGE_NAME }}
31+
32+
# Login against a Docker registry
33+
- name: Log into registry ${{ env.REGISTRY }}
34+
if: github.event_name != 'pull_request'
35+
uses: docker/login-action@343f7c4344506bcbf9b4de18042ae17996df046d # v3.0.0
36+
with:
37+
registry: ${{ env.REGISTRY }}
38+
username: ${{ github.actor }}
39+
password: ${{ secrets.GITHUB_TOKEN }}
40+
41+
42+
# Build and tag Docker Image
43+
- name: Build Docker Image
44+
run: |
45+
docker build -t ghcr.io/${{ github.repository_owner }}/${{ env.IMAGE_NAME }}:${{ github.sha }} .
46+
47+
- name: Tag Docker Image
48+
run: |
49+
docker tag ghcr.io/${{ github.repository_owner }}/${{ env.IMAGE_NAME }}:${{ github.sha }} ghcr.io/${{ github.repository_owner }}/${{ env.IMAGE_NAME }}:latest
50+
docker tag ghcr.io/${{ github.repository_owner }}/${{ env.IMAGE_NAME }}:${{ github.sha }} ghcr.io/${{ github.repository_owner }}/${{ env.IMAGE_NAME }}:testing
51+
52+
53+
# Push the Docker image to the registry
54+
- name: Push Docker Image to GHCR
55+
run: |
56+
docker push ghcr.io/${{ github.repository_owner }}/${{ env.IMAGE_NAME }}:${{ github.sha }}
57+
docker push ghcr.io/${{ github.repository_owner }}/${{ env.IMAGE_NAME }}:latest
58+
docker push ghcr.io/${{ github.repository_owner }}/${{ env.IMAGE_NAME }}:testing

‎.azdo-pipelines/pipeline_templates/unit-sec-scan.yml‎

Lines changed: 98 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,98 @@
1+
2+
3+
jobs:
4+
- job: testing_phase
5+
displayName: 'Run unit test'
6+
pool:
7+
vmImgae: ubuntu-latest
8+
9+
steps:
10+
- checkout: self
11+
displayName: 'Checkout repo'
12+
13+
14+
- script:
15+
- bash: |
16+
echo "installing dependencies..."
17+
pip install -r requirements.txt
18+
displayName: 'Install dependencies'
19+
20+
21+
- script:
22+
echo "running py tests..."
23+
pytest test/
24+
displayName: 'Run python tests'
25+
26+
- job: trivy_scan
27+
displayName: 'Run Trivy security scanner against the image'
28+
pool:
29+
vmImage: ubuntu-latest
30+
31+
steps:
32+
- checkout: self
33+
displayName: 'Checkout repo'
34+
35+
- script: |
36+
echo "Building Docker image..."
37+
docker build -t awesome-fastapi:$(Build.SourceVersion).
38+
displayName: 'Build Docker Image'
39+
40+
- task: trivy@2
41+
inputs:
42+
version: 'latest'
43+
type: 'image'
44+
image: awesome-fastapi:$(Build.SourceVersion).
45+
severities: 'HIGH, CRITICAL'
46+
reports: 'sarif'
47+
publish: true
48+
displayName: 'Run Trivy Vulnerability Scanner'
49+
env:
50+
GITHUB_TOKEN: $(GITHUB_TOKEN)
51+
52+
- job: owasp_zap_scan
53+
pool:
54+
vmImage: ubuntu-latest
55+
displayName: 'Run OWASP ZAP security scanner'
56+
steps:
57+
- checkout: self
58+
displayName: 'Checkout repo'
59+
60+
# Build and Tag Image
61+
# Run Docker Image in detached mode
62+
- script: |
63+
echo "Building Docker image..."
64+
docker build -t awesome-fastapi:$(Build.SourceVersion) .
65+
docker run -d -p 8080:80 awesome-fastapi:$(Build.SourceVersion) .
66+
displayName: 'Build Docker Image'
67+
68+
- script: sleep 30
69+
displayName: 'Wait for Docker container to be ready'
70+
71+
- script: docker ps
72+
displayName: 'Confirm Docker container is running'
73+
- script: |
74+
docker run --rm -v $(System.DefaultWorkingDirectory):/zap/wrk/:rw \
75+
owasp/zap2docker-stable zap-full-scan.py \
76+
-t http://host.docker.internal:8080 \
77+
-x zap-report.xml \
78+
-r zap-report.html \
79+
|| true
80+
displayName: 'Run OWASP ZAP Security Scanner'
81+
### work in progress
82+
# - task: OwaspZapScan@0
83+
# inputs:
84+
# ZapApiUrl: 'http://localhost:$(ProxyPort)'
85+
# TargetUrl: 'http://0.0.0.0:8080'
86+
# NewContext: true
87+
# zapImageName: 'awesome-fastapi:$(Build.SourceVersion) .'
88+
# ShowContextListConfig: true
89+
# ExecuteAjaxSpiderScan: true
90+
# ExecuteSpiderScan: true
91+
# displayName: 'Run OWASP ZAP Security Scanner
92+
- task: PublishTestResults@2
93+
inputs:
94+
testResultsFormat: 'NUnit'
95+
testResultsFiles: '**/zap-full-scan.xml'
96+
failIfNoTests: true
97+
displayName: 'Publish OWASP ZAP Test Results'
98+

0 commit comments

Comments
 (0)