add templates for gitlab training

Author: schlapzz

templates/Secret-Detection.yml

@@ -0,0 +1,58 @@
+# Read more about this feature here: https://docs.gitlab.com/ee/user/application_security/secret_detection
+#
+# Configure the scanning tool through the environment variables.
+# List of the variables: https://gitlab.com/gitlab-org/security-products/secret_detection#available-variables
+# How to set: https://docs.gitlab.com/ee/ci/yaml/#variables
+
+variables:
+  SECURE_ANALYZERS_PREFIX: "registry.gitlab.com/gitlab-org/security-products/analyzers"
+  SECRETS_ANALYZER_VERSION: "3"
+  SECRET_DETECTION_EXCLUDED_PATHS: ""
+
+
+.secret-analyzer:
+  stage: test
+  image: "$SECURE_ANALYZERS_PREFIX/secrets:$SECRETS_ANALYZER_VERSION"
+  services: []
+  allow_failure: false
+  # `rules` must be overridden explicitly by each child job
+  # see https://gitlab.com/gitlab-org/gitlab/-/issues/218444
+  before_script:
+    - wget https://github.com/stedolan/jq/releases/download/jq-1.6/jq-linux64
+    - chmod +x ./jq-linux64
+    - ls -lah
+    - mv ./jq-linux64 /usr/local/bin/jq
+  artifacts:
+    reports:
+      secret_detection: gl-secret-detection-report.json
+
+secret_detection_default_branch:
+  extends: .secret-analyzer
+  rules:
+    - if: $SECRET_DETECTION_DISABLED
+      when: never
+    - if: $CI_DEFAULT_BRANCH == $CI_COMMIT_BRANCH
+  script:
+    - /analyzer run
+    - vul=$(cat gl-secret-detection-report.json | jq '.vulnerabilities | length')
+    - >
+      if [ "$vul" -gt "0" ]; then
+        echo "$vul Vulnerabilities found!";
+        echo "check gl-secret-detection-report.json for details"
+        exit 1
+      fi
+
+
+
+secret_detection:
+  extends: .secret-analyzer
+  rules:
+    - if: $SECRET_DETECTION_DISABLED
+      when: never
+    - if: $CI_COMMIT_BRANCH && $CI_COMMIT_BRANCH != $CI_DEFAULT_BRANCH
+  script:
+    - git fetch origin $CI_DEFAULT_BRANCH $CI_COMMIT_REF_NAME
+    - git log --left-right --cherry-pick --pretty=format:"%H" refs/remotes/origin/$CI_DEFAULT_BRANCH...refs/remotes/origin/$CI_COMMIT_REF_NAME > "$CI_COMMIT_SHA"_commit_list.txt
+    - export SECRET_DETECTION_COMMITS_FILE="$CI_COMMIT_SHA"_commit_list.txt
+    - /analyzer run
+    - rm "$CI_COMMIT_SHA"_commit_list.txt

templates/k8s.yml

@@ -0,0 +1,12 @@
+.kubectl:
+  image: registry.puzzle.ch/docker.io/alpine:latest
+  before_script:
+  - "[[ -z ${KUBECONFIG_CONTENT} ]] && echo 'no set yet'"
+  - wget https://storage.googleapis.com/kubernetes-release/release/v1.20.0/bin/linux/amd64/kubectl
+  - chmod +x ./kubectl
+  - mv ./kubectl /usr/local/bin/kubectl
+  - mkdir -p ~/.kube/
+  - echo $KUBECONFIG_CONTENT | base64 -d > ~/.kube/config
+
+
+