NEXT-21750 - Add downstream stage and move security into unit stage

Author: pweyck

.gitlab-ci.yml

@@ -7,8 +7,8 @@ stages:
     - E2E
     # quarantined tests
     - quarantine
-    # search for vulnerabilities in code and dependencies
-    - security
+    # downstream pipelines trigger by this pipeline
+    - downstream
     # build artifacts used in deploy
     - build
     # deploy artifacts build in the `build` stage

.gitlab/lib/rules.yml

@@ -5,7 +5,7 @@
           || $CI_MERGE_REQUEST_LABELS =~ /.*unit::skip.*/ && $CI_JOB_STAGE == "unit"
           || $CI_MERGE_REQUEST_LABELS =~ /.*E2E::skip.*/ && $CI_JOB_STAGE == "E2E"
           || $CI_MERGE_REQUEST_LABELS =~ /.*quarantine::skip.*/ && $CI_JOB_STAGE == "quarantine"
-          || $CI_MERGE_REQUEST_LABELS =~ /.*security::skip.*/ && $CI_JOB_STAGE == "security"
+          || $CI_MERGE_REQUEST_LABELS =~ /.*downstream::skip.*/ && $CI_JOB_STAGE == "downstream"
           || $CI_MERGE_REQUEST_LABELS =~ /.*build::skip.*/ && $CI_JOB_STAGE == "build"
           || $CI_MERGE_REQUEST_LABELS =~ /.*deploy::skip.*/ && $CI_JOB_STAGE == "deploy"
           || $CI_MERGE_REQUEST_LABELS =~ /.*visual::skip.*/ && $CI_JOB_STAGE == "visual"
@@ -17,7 +17,7 @@
           || $CI_MERGE_REQUEST_LABELS =~ /.*unit::all.*/ && $CI_JOB_STAGE == "unit"
           || $CI_MERGE_REQUEST_LABELS =~ /.*E2E::all.*/ && $CI_JOB_STAGE == "E2E"
           || $CI_MERGE_REQUEST_LABELS =~ /.*quarantine::all.*/ && $CI_JOB_STAGE == "quarantine"
-          || $CI_MERGE_REQUEST_LABELS =~ /.*security::all.*/ && $CI_JOB_STAGE == "security"
+          || $CI_MERGE_REQUEST_LABELS =~ /.*downstream::all.*/ && $CI_JOB_STAGE == "downstream"
           || $CI_MERGE_REQUEST_LABELS =~ /.*build::all.*/ && $CI_JOB_STAGE == "build"
           || $CI_MERGE_REQUEST_LABELS =~ /.*deploy::all.*/ && $CI_JOB_STAGE == "deploy"
           || $CI_MERGE_REQUEST_LABELS =~ /.*visual::all.*/ && $CI_JOB_STAGE == "visual"'
@@ -28,7 +28,7 @@
               || $CI_MERGE_REQUEST_LABELS =~ /.*unit::all.*/ && $CI_JOB_STAGE == "unit"
               || $CI_MERGE_REQUEST_LABELS =~ /.*E2E::all.*/ && $CI_JOB_STAGE == "E2E"
               || $CI_MERGE_REQUEST_LABELS =~ /.*quarantine::all.*/ && $CI_JOB_STAGE == "quarantine"
-              || $CI_MERGE_REQUEST_LABELS =~ /.*security::all.*/ && $CI_JOB_STAGE == "security"
+              || $CI_MERGE_REQUEST_LABELS =~ /.*downstream::all.*/ && $CI_JOB_STAGE == "downstream"
               || $CI_MERGE_REQUEST_LABELS =~ /.*build::all.*/ && $CI_JOB_STAGE == "build"
               || $CI_MERGE_REQUEST_LABELS =~ /.*deploy::all.*/ && $CI_JOB_STAGE == "deploy"
               || $CI_MERGE_REQUEST_LABELS =~ /.*visual::all.*/ && $CI_JOB_STAGE == "visual")'

.gitlab/stages/01-lint.yml .gitlab/stages/10-lint.yml

@@ -193,61 +193,3 @@ NPM CI:
             - "12-alpine"
             - "14-alpine"
             - "16-alpine"
-
-rufus:
-  stage: lint
-  variables:
-    RUFUS_BRANCH: trunk
-    PLATFORM_BRANCH: '${CI_COMMIT_BRANCH}${CI_MERGE_REQUEST_SOURCE_BRANCH_NAME}'
-  rules:
-    - !reference [ .rules, skip ]
-    # target branch is release branch -> rufus should have the same branch
-    - if: $CI_MERGE_REQUEST_TARGET_BRANCH_NAME =~ /^6\.\d+\.\d+\.\d+/
-      variables:
-        RUFUS_BRANCH: $CI_MERGE_REQUEST_TARGET_BRANCH_NAME
-    # release branch -> rufus should also be a release branch
-    - if: $CI_COMMIT_BRANCH =~ /^6\.\d+\.\d+\.\d+/
-      variables:
-        RUFUS_BRANCH: $CI_COMMIT_BRANCH
-    - !reference [ .rules, run ]
-    - if: '$CI_PIPELINE_SOURCE != "merge_request_event"'
-    - if: '$CI_MERGE_REQUEST_TARGET_BRANCH_NAME == $CI_DEFAULT_BRANCH'
-    - when: manual
-      allow_failure: true
-  inherit:
-    variables:
-      - PLATFORM_BRANCH
-      - RUFUS_BRANCH
-  trigger:
-      project: shopware/6/product/rufus
-      branch: $RUFUS_BRANCH
-      strategy: depend
-
-commercial:
-  stage: lint
-  variables:
-    COMMERCIAL_BRANCH: trunk
-    PLATFORM_BRANCH: '${CI_COMMIT_BRANCH}${CI_MERGE_REQUEST_SOURCE_BRANCH_NAME}'
-  rules:
-    - !reference [ .rules, skip ]
-    # target branch is release branch -> commercial should have the same branch
-    - if: $CI_MERGE_REQUEST_TARGET_BRANCH_NAME =~ /^6\.\d+\.\d+\.\d+/
-      variables:
-        COMMERCIAL_BRANCH: $CI_MERGE_REQUEST_TARGET_BRANCH_NAME
-    # release branch -> commercial should also be a release branch
-    - if: $CI_COMMIT_BRANCH =~ /^6\.\d+\.\d+\.\d+/
-      variables:
-        COMMERCIAL_BRANCH: $CI_COMMIT_BRANCH
-    - !reference [ .rules, run ]
-    - if: '$CI_PIPELINE_SOURCE != "merge_request_event"'
-    - if: '$CI_MERGE_REQUEST_TARGET_BRANCH_NAME == $CI_DEFAULT_BRANCH'
-    - when: manual
-      allow_failure: true
-  inherit:
-    variables:
-      - PLATFORM_BRANCH
-      - COMMERCIAL_BRANCH
-  trigger:
-    project: shopware/6/product/commercial
-    branch: $COMMERCIAL_BRANCH
-    strategy: depend

.gitlab/stages/02-unit.yml .gitlab/stages/20-unit.yml

@@ -2,7 +2,7 @@
 
 Symfony security check:
     extends: .long-running
-    stage: security
+    stage: unit
     needs: []
     image: shopware/development:7.4-composer-2
     before_script: []

.gitlab/stages/04-security.yml .gitlab/stages/21-security.yml

@@ -0,0 +1,60 @@
+
+rufus:
+  stage: downstream
+  needs: []
+  variables:
+    RUFUS_BRANCH: trunk
+    PLATFORM_BRANCH: '${CI_COMMIT_BRANCH}${CI_MERGE_REQUEST_SOURCE_BRANCH_NAME}'
+  rules:
+    - !reference [ .rules, skip ]
+    # target branch is release branch -> rufus should have the same branch
+    - if: $CI_MERGE_REQUEST_TARGET_BRANCH_NAME =~ /^6\.\d+\.\d+\.\d+/
+      variables:
+        RUFUS_BRANCH: $CI_MERGE_REQUEST_TARGET_BRANCH_NAME
+    # release branch -> rufus should also be a release branch
+    - if: $CI_COMMIT_BRANCH =~ /^6\.\d+\.\d+\.\d+/
+      variables:
+        RUFUS_BRANCH: $CI_COMMIT_BRANCH
+    - !reference [ .rules, run ]
+    - if: '$CI_PIPELINE_SOURCE != "merge_request_event"'
+    - if: '$CI_MERGE_REQUEST_TARGET_BRANCH_NAME == $CI_DEFAULT_BRANCH'
+    - when: manual
+      allow_failure: true
+  inherit:
+    variables:
+      - PLATFORM_BRANCH
+      - RUFUS_BRANCH
+  trigger:
+    project: shopware/6/product/rufus
+    branch: $RUFUS_BRANCH
+    strategy: depend
+
+commercial:
+  stage: downstream
+  needs: []
+  variables:
+    COMMERCIAL_BRANCH: trunk
+    PLATFORM_BRANCH: '${CI_COMMIT_BRANCH}${CI_MERGE_REQUEST_SOURCE_BRANCH_NAME}'
+  rules:
+    - !reference [ .rules, skip ]
+    # target branch is release branch -> commercial should have the same branch
+    - if: $CI_MERGE_REQUEST_TARGET_BRANCH_NAME =~ /^6\.\d+\.\d+\.\d+/
+      variables:
+        COMMERCIAL_BRANCH: $CI_MERGE_REQUEST_TARGET_BRANCH_NAME
+    # release branch -> commercial should also be a release branch
+    - if: $CI_COMMIT_BRANCH =~ /^6\.\d+\.\d+\.\d+/
+      variables:
+        COMMERCIAL_BRANCH: $CI_COMMIT_BRANCH
+    - !reference [ .rules, run ]
+    - if: '$CI_PIPELINE_SOURCE != "merge_request_event"'
+    - if: '$CI_MERGE_REQUEST_TARGET_BRANCH_NAME == $CI_DEFAULT_BRANCH'
+    - when: manual
+      allow_failure: true
+  inherit:
+    variables:
+      - PLATFORM_BRANCH
+      - COMMERCIAL_BRANCH
+  trigger:
+    project: shopware/6/product/commercial
+    branch: $COMMERCIAL_BRANCH
+    strategy: depend