image: docker:latest
 
services:
  - docker:dind
 
stages:
  - build
  - test
  - preprod
  - integration
  - prod
 
build:
  stage: build
  image: python:3.6
  before_script:
   - pip3 install --upgrade virtualenv
  script:
   - virtualenv env
   - source env/bin/activate
   - pip install -r requirements.txt
   - python manage.py check
 
 
sast:
  stage: build
  script:
   # Download bandit docker container
   - docker pull secfigo/bandit
   - docker run --user $(id -u):$(id -g) -v $(pwd):/src --rm secfigo/bandit bandit -r /src -f json -o /src/bandit-output.json
  artifacts:
    paths: [bandit-output.json]
    when: always
  allow_failure: true
 
test:
  stage: test
  image: python:3.6
  before_script:
   - pip3 install --upgrade virtualenv
  script:
   - virtualenv env
   - source env/bin/activate
   - pip install -r requirements.txt
   - python manage.py test taskManager
 
oast:
  stage: test
  script:
    - docker pull hysnsec/safety  # We are going to pull the hysnsec/safety image to run the safety scanner
    # third party components are stored in requirements.txt for python, so we will scan this particular file with safety.
    - docker run -v $(pwd):/src --rm hysnsec/safety check -r requirements.txt --json > oast-results.json
  artifacts:
    paths: [oast-results.json]
    when: always 
  allow_failure: true
 
oast-frontend:
  stage: test
  image: node:latest
  script:
    - rm -rf package-lock.json && npm install --unsafe-perm
    - npm install -g retire
    - retire --outputformat json --outputpath retirejs-report.json --severity high --exitwith 0
  artifacts:
    paths: [retirejs-report.json]
    when: always 
    expire_in: one week
  allow_failure: true
 
preprod:
  stage: preprod
  script:
    - echo "Deploying to preprod"
 
zap-baseline:
  stage: integration
  script:
    - docker pull owasp/zap2docker-stable
    - docker run --user $(id -u):$(id -g) -w /zap -v $(pwd):/zap/wrk:rw --rm owasp/zap2docker-stable zap-baseline.py -t https://demo.testfire.net -J zap-output.json
  after_script:
    - docker rmi owasp/zap2docker-stable  
  artifacts:
    paths: [zap-output.json]
    when: always 
  allow_failure: true 
 
nikto:
  stage: integration
  script:
    - docker pull hysnsec/nikto
    - docker run --rm -v $(pwd):/tmp hysnsec/nikto -h http://demo.testfire.net -o /tmp/nikto-output.xml
  artifacts:
    paths: [nikto-output.xml]
    when: always
  allow_failure: true
 
sslscan:
  stage: integration
  script:
    - docker pull hysnsec/sslyze
    - docker run --rm -v $(pwd):/tmp hysnsec/sslyze --regular demo.testfire.net:443 --json_out /tmp/sslyze-output.json
  artifacts:
    paths: [sslyze-output.json]
    when: always
  allow_failure: true
 
nmap:
  stage: integration
  script:
    - docker pull hysnsec/nmap
    - docker run --rm -v $(pwd):/tmp hysnsec/nmap demo.testfire.net -oX /tmp/nmap-output.xml
  artifacts:
    paths: [nmap-output.xml]
    when: always
  allow_failure: true
 
prod:
  stage: prod
  script:
    - echo "Deploying to prod"
  when: manual # Continuous Delivery