CI Pipeline¶

Reference for Conflux's GitLab CI pipeline.

Stages¶

Stage	Jobs	Output
`quality`	`quality:pint`, `quality:ide-helper`, `quality:phpstan`, `quality:rector`, `quality:adr-numbers`	GitLab Code Quality reports (Pint, PHPStan, Rector)
`test`	`test:pest`	JUnit results, Cobertura coverage
`security`	`security:composer-audit`, `security:npm-audit`, `security:slack-notify`	CVE audit results; Slack alert on schedule failure
`deploy`	`trigger-staging`	Triggers staging deployment

Quality and test jobs are skipped on scheduled pipeline runs (.skip-on-schedule) — the daily schedule only runs the security stage.

PHP CLI Image¶

registry.gitlab.rapidmail.me/platform-integrations/conflux-docker-images/php-cli:8.5-dev-latest

Security Stage¶

security:composer-audit and security:npm-audit run composer audit and npm audit respectively. Both extend the shared .security-audit-rules rules, which set allow_failure per pipeline context:

Context	`allow_failure`	Effect
`$CI_PIPELINE_SOURCE == "schedule"` (daily audit)	`false`	Vulnerability blocks the pipeline
`master` branch	`false`	Vulnerability blocks the pipeline
Everything else (merge requests, feature branches)	`true`	Vulnerability is a non-blocking warning

Vulnerabilities must block on schedule and master since that's what ships, but shouldn't block in-progress MR work over a pre-existing or newly disclosed CVE.

A daily scheduled pipeline runs these same audit jobs. security:slack-notify posts to Slack when the scheduled pipeline fails, or when the schedule sets $SCHEDULE_TYPE == "audit-check"; it does not run otherwise. It requires the SLACK_WEBHOOK secret.

Staging Deployment¶

The trigger-staging job in the deploy stage triggers a downstream pipeline in platform-integrations/conflux-infrastructure (branch master). It runs on pushes to master and never runs on scheduled pipelines. The strategy is depend, so the upstream job waits for the downstream pipeline to complete.

The infrastructure pipeline receives APP_BRANCH (set to the source branch name) so it knows which application branch to deploy. The GitLab environment is named staging with URL https://$APP_HOST.

The APP_HOST variable must be configured in the project's CI/CD settings.

Required Secrets¶

Variable	Purpose
`GROUP_REGISTRY_USER`	GitLab container registry access
`GROUP_REGISTRY_PASSWORD`	GitLab container registry access
`SLACK_WEBHOOK`	Slack notification for `security:slack-notify`

Running Locally¶

The pipeline can be run on a local machine using gitlab-ci-local. Configuration is in .gitlab-ci-local/.

gitlab-ci-local

See the how-to guide for setup steps.