ohdearapp / gitlab-ci-pipeline-for-laravel

A Gitlab CI/CD pipeline optimized for use with Laravel applications
https://ohdear.app
331 stars 108 forks source link

Composer v1 #10

Closed alxhlz closed 3 years ago

alxhlz commented 3 years ago

Hi, today I wanted to run the pipeline and it failed at the security stage. I found out that the problem was caused by an old composer version.

Do you maybe have an idea how to solve this? I took a look at the repo of the used plugin and it turned out that it isn't maintained anymore and got replaced by fabpot/local-php-security-checker.

Maybe it would be a good idea to update the pipeline accordingly?

I tried to do it by fetching the binary from the new go version but sadly the binary failed to execute on my local machine everytime I tried to run it.

sensiolabs:
  stage: security
  script:
    - 'curl -s https://api.github.com/repos/fabpot/local-php-security-checker/releases/latest | grep "browser_download_url.*linux_amd64" | cut -d: -f 2,3 | tr -d \" | wget -o local-php-security-checker -qi -'
    - chmod +x local-php-security-checker
    - ./local-php-security-checker
  dependencies: []
  cache:
    paths:
      - security-checker/

Regards, Alex

alxhlz commented 3 years ago

Btw this is the final workarround I came up with:

sensiolabs:
  stage: security
  script:
    - sudo apt update && sudo apt install wget
    - 'curl -s https://api.github.com/repos/fabpot/local-php-security-checker/releases/latest | grep "browser_download_url.*linux_amd64" | cut -d: -f 2,3 | tr -d \" | wget -o local-php-security-checker -qi -'
    - chmod +x local-php-security-checker
    - ./local-php-security-checker --update-cache
    - ./local-php-security-checker ./composer.lock
  dependencies: []
  cache:
    paths:
      - security-checker/
mattiasgeniar commented 3 years ago

Hi all,

We've long migrated away from Gitlab CI and haven't been able to support this repo as well as we should have. We'll be archiving this and putting it in read-only mode, anyone that's willing to further maintain the code is free to fork this to their own version.

Thanks for the contributions & discussions from all involved!

Mattias