.onedev-buildspec.yml

version: 32
imports:
- projectPath: onedev
  revision: main
  accessTokenSecret: onedev-token
jobs:
- name: Release
  steps:
  - !CheckoutStep
    name: checkout code
    cloneCredential: !DefaultCredential {}
    withLfs: false
    withSubmodules: true
    condition: ALL_PREVIOUS_STEPS_WERE_SUCCESSFUL
  - !UseTemplateStep
    name: set up cache
    templateName: set up cache
    condition: ALL_PREVIOUS_STEPS_WERE_SUCCESSFUL
  - !UseTemplateStep
    name: set build version
    templateName: set build version
    condition: ALL_PREVIOUS_STEPS_WERE_SUCCESSFUL
  - !CommandStep
    name: build and deploy
    runInContainer: true
    image: '@property:buildEnvironment@'
    interpreter: !DefaultInterpreter
      commands: |
        set -e
        mvn deploy -Dmaven.deploy.username=@job_token@ -Dmaven.deploy.password=@secrets:maven-deploy-password@
    useTTY: false
    condition: ALL_PREVIOUS_STEPS_WERE_SUCCESSFUL
  - !BuildImageStep
    name: build docker image
    output: !RegistryOutput
      tags: 1dev/k8s-helper:@build_version@
    platforms: linux/amd64,linux/arm64
    condition: ALL_PREVIOUS_STEPS_WERE_SUCCESSFUL
  - !CreateTagStep
    name: create tag
    tagName: v@build_version@
    accessTokenSecret: onedev-token
    condition: ALL_PREVIOUS_STEPS_WERE_SUCCESSFUL
  triggers:
  - !BranchUpdateTrigger
    branches: main
  jobDependencies:
  - jobName: Scan Vulnerabilities
    requireSuccessful: true
  retryCondition: never
  maxRetries: 3
  retryDelay: 30
  timeout: 3600
- name: Scan Vulnerabilities
  steps:
  - !CheckoutStep
    name: checkout
    cloneCredential: !DefaultCredential {}
    withLfs: false
    withSubmodules: false
    cloneDepth: 1
    condition: ALL_PREVIOUS_STEPS_WERE_SUCCESSFUL
  - !OsvVulnerScannerStep
    name: scan
    recursive: true
    failThreshold: HIGH
    reportName: Dependency Vulnerabilities
    condition: ALL_PREVIOUS_STEPS_WERE_SUCCESSFUL
  retryCondition: never
  maxRetries: 3
  retryDelay: 30
  timeout: 3600
- name: Sync with GitHub
  steps:
  - !CheckoutStep
    name: checkout
    cloneCredential: !DefaultCredential {}
    withLfs: false
    withSubmodules: true
    condition: ALL_PREVIOUS_STEPS_WERE_SUCCESSFUL
  - !CommandStep
    name: sync
    runInContainer: true
    image: alpine/git:1.0.7
    interpreter: !DefaultInterpreter
      commands: |
        git config --global --unset http.extraHeader
        git push -f https://robinshine:@secrets:github-token@@@github.com/theonedev/k8s-helper HEAD:main
    useTTY: false
    condition: ALL_PREVIOUS_STEPS_WERE_SUCCESSFUL
  triggers:
  - !BranchUpdateTrigger
    branches: main
    projects: onedev/k8s-helper
  retryCondition: never
  maxRetries: 3
  retryDelay: 30
  timeout: 3600