设置.gitlab-ci.yml以启用或配置SAST

.gitlab-ci.yml

+# You can override the included template(s) by including variable overrides
+# See https://docs.gitlab.com/ee/user/application_security/sast/#customizing-the-sast-settings
+# Note that environment variables can be set in several places
+# See https://docs.gitlab.com/ee/ci/variables/#priority-of-environment-variables
 image: node:latest
-
 stages:
-  - build
-  - deploy
-
+- build
+- deploy
+- test
 cache:
   key: resume
   paths:
-    - node_modules/
-    - assets/data/
-    - static/data/
-
+  - node_modules/
+  - assets/data/
+  - static/data/
 before_script:
-  - mkdir -vp ~/.ssh
-  - eval $(ssh-agent -s)
-  - echo "${HOST_NAME}","${HOST_KEY}" > ~/.ssh/known_hosts
-  - chmod 644 ~/.ssh/known_hosts -v
-  - echo "${SSH_PRIVATE_KEY}" > ~/.ssh/key.pem
-  - chmod 600 ~/.ssh/key.pem -v
-
+- mkdir -vp ~/.ssh
+- eval $(ssh-agent -s)
+- echo "${HOST_NAME}","${HOST_KEY}" > ~/.ssh/known_hosts
+- chmod 644 ~/.ssh/known_hosts -v
+- echo "${SSH_PRIVATE_KEY}" > ~/.ssh/key.pem
+- chmod 600 ~/.ssh/key.pem -v
 load_resources:
-  stage: .pre
+  stage: ".pre"
   script:
-    - ssh -i ~/.ssh/key.pem -v ${USER}@${HOST_NAME} "cd ${CICD_DIR} && sh ${SCRIPT_FILENAME}.sh"
-    - rm -rfv ./assets/data
-    - rm -rfv ./static/data
-    - scp -i ~/.ssh/key.pem -rv ${USER}@${HOST_NAME}:${RESOURCES_DIR}/assets-data ./assets/data
-    - scp -i ~/.ssh/key.pem -rv ${USER}@${HOST_NAME}:${RESOURCES_DIR}/static-data ./static/data
-    - RESUME_DATE=`date +%Y-%m-%d`
-    - echo ${RESUME_DATE}
-    - echo sed \"s/\\\"updated\\\":[ ]*\\\"[0-9]\\{4\\}-[0-9]\\{2\\}-[0-9]\\{2\\}\\\"/\\\"updated\\\":\\\"${RESUME_DATE}\\\"/g\" > ./update_time.sh
-    - cat ./update_time.sh
-    - cat ./assets/data/setting.json | sh ./update_time.sh > ./assets/data/setting2.json
-    - mv ./assets/data/setting2.json ./assets/data/setting.json -fv
-    - cat ./assets/data/setting.json
-
+  - ssh -i ~/.ssh/key.pem -v ${USER}@${HOST_NAME} "cd ${CICD_DIR} && sh ${SCRIPT_FILENAME}.sh"
+  - rm -rfv ./assets/data
+  - rm -rfv ./static/data
+  - scp -i ~/.ssh/key.pem -rv ${USER}@${HOST_NAME}:${RESOURCES_DIR}/assets-data ./assets/data
+  - scp -i ~/.ssh/key.pem -rv ${USER}@${HOST_NAME}:${RESOURCES_DIR}/static-data ./static/data
+  - RESUME_DATE=`date +%Y-%m-%d`
+  - echo ${RESUME_DATE}
+  - echo sed \"s/\\\"updated\\\":[ ]*\\\"[0-9]\\{4\\}-[0-9]\\{2\\}-[0-9]\\{2\\}\\\"/\\\"updated\\\":\\\"${RESUME_DATE}\\\"/g\"
+    > ./update_time.sh
+  - cat ./update_time.sh
+  - cat ./assets/data/setting.json | sh ./update_time.sh > ./assets/data/setting2.json
+  - mv ./assets/data/setting2.json ./assets/data/setting.json -fv
+  - cat ./assets/data/setting.json
 install_dependencies:
-  stage: .pre
+  stage: ".pre"
   script:
-    - npm install
-
+  - npm install
 generate:
   stage: build
   script:
-    - cd static/
-    - touch .nojekyll
-    - rm -rfv ./data-sample
-    - cd ../
-    - npm run generate
+  - cd static/
+  - touch .nojekyll
+  - rm -rfv ./data-sample
+  - cd ../
+  - npm run generate
   artifacts:
     paths:
-      - dist/
-
+    - dist/
 resume:
   stage: deploy
   script:
-    - scp -i ~/.ssh/key.pem -rv ./dist/* ${USER}@${HOST_NAME}:${DEPLOY_LOCAL}/
-
+  - scp -i ~/.ssh/key.pem -rv ./dist/* ${USER}@${HOST_NAME}:${DEPLOY_LOCAL}/
 pages:
   stage: deploy
   script:
-    - mkdir -vp ./public
-    - mv ./dist/* ./public/ -v
+  - mkdir -vp ./public
+  - mv ./dist/* ./public/ -v
   artifacts:
     paths:
-      - public
+    - public
   only:
-    - master
-
+  - master
 git:
   stage: deploy
   script:
-    - git config --global  user.email ${GIT_USER_EMAIL}
-    - git config --global  user.name '${GIT_USER_NAME}'
-    - echo https://"${GIT_USER_NAME}":"${GIT_PASSWORD}"@${GIT_DOMAIN} > .git-credentials
-    - git config --global credential.helper store
-    - git clone --progress --verbose https://"${GIT_USER_NAME}":"${GIT_PASSWORD}"@${GIT_DOMAIN}/${GIT_REPO_OWNER}/${GIT_REPO_NAME}
-    - cd ${GIT_REPO_NAME}
-    - rm -rfv ./*
-    - cp -rv ../dist/* ./
-    - git add .
-    - CURRENT_TIME=`date +%FT%T%:z`
-    - COMMIT_MESSAGE_HEAD="[GitLab CI/CD] ${CURRENT_TIME}"
-    - COMMIT_MESSAGE_BODY="${CI_PIPELINE_IID} (global ID ${CI_PIPELINE_ID}), triggered by ${CI_PIPELINE_SOURCE}, on commit ${CI_COMMIT_SHORT_SHA} (${CI_COMMIT_TITLE}) at ${CI_COMMIT_TIMESTAMP}, from ${CI_SERVER_HOST} (${CI_SERVER_VERSION}, ${CI_SERVER_REVISION}) ${CI_PROJECT_PATH}, using Runner-${CI_RUNNER_ID} ${CI_RUNNER_SHORT_TOKEN} (${CI_RUNNER_VERSION}, ${CI_RUNNER_REVISION}), by ${GITLAB_USER_NAME}"
-    - echo ${COMMIT_MESSAGE_HEAD}
-    - echo ${COMMIT_MESSAGE_BODY}
-    - git commit -m "${COMMIT_MESSAGE_HEAD}" -m "${COMMIT_MESSAGE_BODY}"
-    - git push --verbose
+  - git config --global  user.email ${GIT_USER_EMAIL}
+  - git config --global  user.name '${GIT_USER_NAME}'
+  - echo https://"${GIT_USER_NAME}":"${GIT_PASSWORD}"@${GIT_DOMAIN} > .git-credentials
+  - git config --global credential.helper store
+  - git clone --progress --verbose https://"${GIT_USER_NAME}":"${GIT_PASSWORD}"@${GIT_DOMAIN}/${GIT_REPO_OWNER}/${GIT_REPO_NAME}
+  - cd ${GIT_REPO_NAME}
+  - rm -rfv ./*
+  - cp -rv ../dist/* ./
+  - git add .
+  - CURRENT_TIME=`date +%FT%T%:z`
+  - COMMIT_MESSAGE_HEAD="[GitLab CI/CD] ${CURRENT_TIME}"
+  - COMMIT_MESSAGE_BODY="${CI_PIPELINE_IID} (global ID ${CI_PIPELINE_ID}), triggered
+    by ${CI_PIPELINE_SOURCE}, on commit ${CI_COMMIT_SHORT_SHA} (${CI_COMMIT_TITLE})
+    at ${CI_COMMIT_TIMESTAMP}, from ${CI_SERVER_HOST} (${CI_SERVER_VERSION}, ${CI_SERVER_REVISION})
+    ${CI_PROJECT_PATH}, using Runner-${CI_RUNNER_ID} ${CI_RUNNER_SHORT_TOKEN} (${CI_RUNNER_VERSION},
+    ${CI_RUNNER_REVISION}), by ${GITLAB_USER_NAME}"
+  - echo ${COMMIT_MESSAGE_HEAD}
+  - echo ${COMMIT_MESSAGE_BODY}
+  - git commit -m "${COMMIT_MESSAGE_HEAD}" -m "${COMMIT_MESSAGE_BODY}"
+  - git push --verbose
+sast:
+  stage: test
+include:
+- template: Security/SAST.gitlab-ci.yml