build

.gitlab-ci.yml

@@ -2,11 +2,16 @@
 stages:          # List of stages for jobs, and their order of execution
   - notify1
   - lint
+  - test
+  - security
+  - dast
   - build
   - clean
   - notify
 variables:
   GIT_SSH_COMMAND: "ssh -i /home/gitlab-runner/.ssh/id_rsa -o IdentitiesOnly=yes"
+  CS_IMAGE: r.sectorq.eu/jaydee/builder:amd64
+  
 notify1:
   stage: notify1  # Should be in a later stage than the job that might fail
   when: on_success # <-- This is the key keyword
@@ -31,6 +36,15 @@ lint:
     - rm -rf /home/gitlab-runner/builds/1fLwHSKm2/0/jaydee/portainer.tmp
   rules:
       - if: '$CI_COMMIT_MESSAGE =~ /lint/'
+
+      
+include:
+  - template: Security/SAST.gitlab-ci.yml
+  - template: Security/Dependency-Scanning.gitlab-ci.yml
+  - template: Security/Secret-Detection.gitlab-ci.yml
+  - template: Security/DAST.gitlab-ci.yml
+  - template: Security/Container-Scanning.gitlab-ci.yml
+
 build-job:       # This job runs in the build stage, which runs first.
     stage: build
     image: r.sectorq.eu/jaydee/builder:amd64
@@ -99,4 +113,4 @@ notify2:
       - curl -XPOST http://192.168.77.101:8123/api/webhook/voice-notifications-tC_8YKxMJIAaQRV5riKuC7Zl --data-raw 'message=portainer build job failed'
       - rm -rf /home/gitlab-runner/builds/1fLwHSKm2/0/jaydee/portainer.tmp
   rules:
-      - if: '$CI_COMMIT_MESSAGE =~ /build/'
+      - if: '$CI_COMMIT_MESSAGE =~ /build/'

.gitlab/sast-ruleset.toml

@@ -0,0 +1,2 @@
+[semgrep]
+exclude = ["bandit.B101", "java_deserialization_rule-JacksonUnsafeDeserialization"]

main.py

@@ -46,7 +46,7 @@ def setup_vault():
     # Specify the mount point of your KV engine
     return vclient
 
-VERSION = "0.1.67"
+VERSION = "0.1.75"
 
 
 defaults = {
@@ -258,7 +258,7 @@ def prompt_missing_args(args_in, defaults_in, fields, action=None,stacks=None):
                     if args.action == "create_stack":
                         # input(json.dumps(stacks, indent=2))
                         commands = [
-                            'authentik', 'bitwarden', 'bookstack', 'dockermon', 'duplicati', 'fail2ban', 'filebrowser', 'gitea', 'gitlab', 'grafana', 'grocy',
+                            'api_server', 'authentik', 'bitwarden', 'bookstack', 'dockermon', 'duplicati', 'fail2ban', 'filebrowser', 'gitea', 'gitlab', 'grafana', 'grocy',
                             'hashicorp', 'home-assistant', 'homebox','homepage', 'immich', 'influxdb', 'jupyter', 'kestra', 'kopia', 'linkding', 'linkwarden', 'mailu3',
                             'mealie', 'mediacenter', 'mosquitto', 'motioneye', 'n8n', 'nebula', 'nextcloud', 'nginx',
                             'node-red', 'octoprint', 'ollama', 'onlyoffice', 'paperless-ngx', 'pihole', 'portainer-ce', 'rancher', 'registry',