A lonely raider working on his project

A lonely raider working on his project

His hardcoded CI

stages:
  - test
  - build

[...]
go_dependency_scanning:
  stage: test
  image:
    name: aquasec/trivy:0.55.2
    entrypoint: [""]
  script:
    - trivy fs --exit-code 1 --severity "MEDIUM,HIGH,CRITICAL" ./

go_sast:
  stage: test
  image: securego/gosec:2.21.3
  script:
    - gosec ./...

build_container_image:
  stage: build
  image:
    name: gcr.io/kaniko-project/executor:v1.23.2-debug
    entrypoint: ['']
  script:
[...]

but there is another raider with an idea

GitLab CI component

• Introduced recently in GitLab (v17.0 - 2024)
• A new approach to build reusable jobs (like GitHub actions)
• Easily extensible, versionned
• You can document them, even test them !

A quick sample

spec:
  inputs:
    stage:
      default: test
---
go_lint:
  stage: $[[ inputs.stage ]]
  image: golangci/golangci-lint:v1.61-alpine
  script:
    - golangci-lint run --timeout 5m -v

When they realized that they add the same goal but they didn't know

Reuse the components

From 57 lines to 14 🤯

stages:
  - test
  - build

include:
  - component: gitlab.com/yodamad-workshops/[...]/go_lint@0.1.1
    inputs:
      stage: build
  - component: gitlab.com/yodamad-workshops/[...]/dockerfile_lint@0.1.0
  - component: gitlab.com/yodamad-workshops/[...]/go_unit-tests@0.1.0
  - component: gitlab.com/yodamad-workshops/[...]/secret_detection@0.1.0
  - component: gitlab.com/yodamad-workshops/[...]/go_dependency_scanning@0.1.0
  - component: gitlab.com/yodamad-workshops/[...]/go_sast@0.1.0
  - component: gitlab.com/yodamad-workshops/[...]/build_container_image@0.1.0

Now, they ride the same boat in the chaos

GitLab native CICD catalog ?

• A dashboard to view all components available on GitLab
• Quick overview of a component and the jobs it contains
• but …
  • it can be not that clear to find what we need
  • it is complicated to know the "good" components (certified by your organization, secure, used..)

They find the Graal ! Innersource approach to save their world

R2Devops to the rescue

• A platform to easily vizualize CICD components catalog within a company
• Track usage of all component to know their maturity

Key points to have a successful InnerSource strategy

• Duplication is an alert sign
• Sharing is easy, reuse is complicated
  • Think extensibility / customizable
  • Think right scope / size
    • too small ➡️ not enough value
    • too big ➡️ complex to integrate, scary to onboard / understand
  • Document clearly
• Measure usage
• CICD can be an easy way to initialize your InnerSource program 💡