Merge branch '331631-apifuzzing-update-ci' into 'master'

Promote unstable API Fuzzing CI template to stable (breaking)

See merge request gitlab-org/gitlab!62407

ee/spec/lib/ee/gitlab/ci/templates/templates_spec.rb

@@ -4,12 +4,9 @@ require 'spec_helper'
 
 RSpec.describe "CI YML Templates" do
   using RSpec::Parameterized::TableSyntax
-
   subject { Gitlab::Ci::YamlProcessor.new(content).execute }
 
-  where(:template_name) do
-    Gitlab::Template::GitlabCiYmlTemplate.all.map(&:full_name)
-  end
+  let(:all_templates) { Gitlab::Template::GitlabCiYmlTemplate.all.map(&:full_name) }
 
   before do
     stub_feature_flags(
@@ -19,12 +16,66 @@ RSpec.describe "CI YML Templates" do
       redirect_to_latest_template_jobs_browser_performance_testing: false)
   end
 
+  shared_examples 'require default stages to be included' do
+    it 'require default stages to be included' do
+      expect(subject.stages).to include(*Gitlab::Ci::Config::Entry::Stages.default)
+    end
+  end
+
+  context 'that support autodevops' do
+    non_autodevops_templates = [
+      'Security/DAST-API.gitlab-ci.yml',
+      'Security/API-Fuzzing.gitlab-ci.yml'
+    ]
+
+    where(:template_name) do
+      all_templates - non_autodevops_templates
+    end
+
     with_them do
       let(:content) do
-      if template_name == 'Security/DAST-API.gitlab-ci.yml'
-        # The DAST-API template purposly excludes a stages
+        <<~EOS
+          include:
+            - template: #{template_name}
+
+          concrete_build_implemented_by_a_user:
+            stage: test
+            script: do something
+        EOS
+      end
+
+      it 'are valid with default stages' do
+        expect(subject).to be_valid
+      end
+
+      include_examples 'require default stages to be included'
+    end
+  end
+
+  context 'that do not support autodevops' do
+    context 'when DAST API template' do
+      # The DAST API template purposly excludes a stages
       # definition.
 
+      let(:template_name) { 'Security/DAST-API.gitlab-ci.yml' }
+
+      context 'with default stages' do
+        let(:content) do
+          <<~EOS
+            include:
+              - template: #{template_name}
+
+            concrete_build_implemented_by_a_user:
+              stage: test
+              script: do something
+          EOS
+        end
+
+        it { is_expected.not_to be_valid }
+      end
+
+      context 'with defined stages' do
+        let(:content) do
           <<~EOS
             include:
               - template: #{template_name}
@@ -39,7 +90,22 @@ RSpec.describe "CI YML Templates" do
               stage: test
               script: do something
           EOS
-      else
+        end
+
+        it { is_expected.to be_valid }
+
+        include_examples 'require default stages to be included'
+      end
+    end
+
+    context 'when API Fuzzing template' do
+      # The API Fuzzing template purposly excludes a stages
+      # definition.
+
+      let(:template_name) { 'Security/API-Fuzzing.gitlab-ci.yml' }
+
+      context 'with default stages' do
+        let(:content) do
           <<~EOS
             include:
               - template: #{template_name}
@@ -49,14 +115,32 @@ RSpec.describe "CI YML Templates" do
               script: do something
           EOS
         end
+
+        it { is_expected.not_to be_valid }
       end
 
-    it 'is valid' do
-      expect(subject).to be_valid
+      context 'with defined stages' do
+        let(:content) do
+          <<~EOS
+            include:
+              - template: #{template_name}
+
+            stages:
+              - build
+              - test
+              - deploy
+              - fuzz
+
+            concrete_build_implemented_by_a_user:
+              stage: test
+              script: do something
+          EOS
         end
 
-    it 'require default stages to be included' do
-      expect(subject.stages).to include(*Gitlab::Ci::Config::Entry::Stages.default)
+        it { is_expected.to be_valid }
+
+        include_examples 'require default stages to be included'
+      end
     end
   end
 end

ee/spec/lib/gitlab/ci/templates/api_fuzzing_gitlab_ci_yaml_spec.rb

@@ -5,6 +5,8 @@ require 'spec_helper'
 RSpec.describe 'API-Fuzzing.gitlab-ci.yml' do
   subject(:template) { Gitlab::Template::GitlabCiYmlTemplate.find('API-Fuzzing') }
 
+  specify { expect(template).not_to be_nil }
+
   describe 'the template file' do
     let(:template_filename) { Rails.root.join("lib/gitlab/ci/templates/" + template.full_name) }
     let(:contents) { File.read(template_filename) }
@@ -36,6 +38,7 @@ RSpec.describe 'API-Fuzzing.gitlab-ci.yml' do
     let(:pipeline) { service.execute!(:push) }
     let(:build_names) { pipeline.builds.pluck(:name) }
 
+    context 'when no stages' do
       before do
         stub_ci_pipeline_yaml_file(template.content)
         allow_next_instance_of(Ci::BuildScheduleWorker) do |worker|
@@ -44,6 +47,26 @@ RSpec.describe 'API-Fuzzing.gitlab-ci.yml' do
         allow(project).to receive(:default_branch).and_return(default_branch)
       end
 
+      context 'when project has no stages' do
+        it 'includes no jobs' do
+          expect(build_names).to be_empty
+        end
+      end
+    end
+
+    context 'when stages includes fuzz' do
+      let(:ci_pipeline_yaml) { "stages: [\"fuzz\"]\n" }
+
+      before do
+        stub_ci_pipeline_yaml_file(ci_pipeline_yaml + template.content)
+
+        allow_next_instance_of(Ci::BuildScheduleWorker) do |worker|
+          allow(worker).to receive(:perform).and_return(true)
+        end
+
+        allow(project).to receive(:default_branch).and_return(default_branch)
+      end
+
       context 'when project has no license' do
         before do
           create(:ci_variable, project: project, key: 'FUZZAPI_HAR', value: 'testing.har')
@@ -51,7 +74,7 @@ RSpec.describe 'API-Fuzzing.gitlab-ci.yml' do
         end
 
         it 'includes job to display error' do
-        expect(build_names).to match_array(%w[apifuzzer_fuzz_unlicensed])
+          expect(build_names).to match_array(%w[apifuzzer_fuzz])
         end
       end
 
@@ -101,19 +124,6 @@ RSpec.describe 'API-Fuzzing.gitlab-ci.yml' do
           end
         end
 
-      context 'when FUZZAPI_D_TARGET_IMAGE is present' do
-        before do
-          create(:ci_variable, project: project, key: 'FUZZAPI_D_TARGET_IMAGE', value: 'imagename:latest')
-          create(:ci_variable, project: project, key: 'FUZZAPI_HAR', value: 'testing.har')
-          create(:ci_variable, project: project, key: 'FUZZAPI_TARGET_URL', value: 'http://example.com')
-        end
-
-        it 'includes dnd job' do
-          expect(build_names).to match_array(%w[apifuzzer_fuzz_dnd])
-        end
-      end
-    end
-
         context 'when API_FUZZING_DISABLED=1' do
           before do
             create(:ci_variable, project: project, key: 'API_FUZZING_DISABLED', value: '1')
@@ -125,17 +135,6 @@ RSpec.describe 'API-Fuzzing.gitlab-ci.yml' do
             expect { pipeline }.to raise_error(Ci::CreatePipelineService::CreateError)
           end
         end
-
-    context 'when API_FUZZING_DISABLED=1 with DnD' do
-      before do
-        create(:ci_variable, project: project, key: 'API_FUZZING_DISABLED', value: '1')
-        create(:ci_variable, project: project, key: 'FUZZAPI_D_TARGET_IMAGE', value: 'imagename:latest')
-        create(:ci_variable, project: project, key: 'FUZZAPI_HAR', value: 'testing.har')
-        create(:ci_variable, project: project, key: 'FUZZAPI_TARGET_URL', value: 'http://example.com')
-      end
-
-      it 'includes no jobs' do
-        expect { pipeline }.to raise_error(Ci::CreatePipelineService::CreateError)
       end
     end
   end

spec/lib/gitlab/ci/templates/templates_spec.rb

@@ -6,33 +6,104 @@ RSpec.describe 'CI YML Templates' do
   subject { Gitlab::Ci::YamlProcessor.new(content).execute }
 
   let(:all_templates) { Gitlab::Template::GitlabCiYmlTemplate.all.map(&:full_name) }
-
   let(:excluded_templates) do
     all_templates.select do |name|
       Gitlab::Template::GitlabCiYmlTemplate.excluded_patterns.any? { |pattern| pattern.match?(name) }
     end
   end
 
+  before do
+    stub_feature_flags(
+      redirect_to_latest_template_terraform: false,
+      redirect_to_latest_template_security_api_fuzzing: false,
+      redirect_to_latest_template_security_dast: false)
+  end
+
+  shared_examples 'require default stages to be included' do
+    it 'require default stages to be included' do
+      expect(subject.stages).to include(*Gitlab::Ci::Config::Entry::Stages.default)
+    end
+  end
+
+  context 'that support autodevops' do
+    non_autodevops_templates = [
+      'Security/DAST-API.gitlab-ci.yml',
+      'Security/API-Fuzzing.gitlab-ci.yml'
+    ]
+
     context 'when including available templates in a CI YAML configuration' do
       using RSpec::Parameterized::TableSyntax
 
       where(:template_name) do
-      all_templates - excluded_templates
+        all_templates - excluded_templates - non_autodevops_templates
       end
 
-    before do
-      stub_feature_flags(
-        redirect_to_latest_template_terraform: false,
-        redirect_to_latest_template_security_api_fuzzing: false,
-        redirect_to_latest_template_security_dast: false)
+      with_them do
+        let(:content) do
+          <<~EOS
+            include:
+              - template: #{template_name}
+
+            concrete_build_implemented_by_a_user:
+              stage: test
+              script: do something
+          EOS
+        end
+
+        it { is_expected.to be_valid }
+
+        include_examples 'require default stages to be included'
+      end
+    end
+
+    context 'when including unavailable templates in a CI YAML configuration' do
+      using RSpec::Parameterized::TableSyntax
+
+      where(:template_name) do
+        excluded_templates
       end
 
       with_them do
         let(:content) do
-        if template_name == 'Security/DAST-API.gitlab-ci.yml'
-          # The DAST-API template purposly excludes a stages
+          <<~EOS
+            include:
+              - template: #{template_name}
+
+            concrete_build_implemented_by_a_user:
+              stage: test
+              script: do something
+          EOS
+        end
+
+        it { is_expected.not_to be_valid }
+      end
+    end
+  end
+
+  describe 'that do not support autodevops' do
+    context 'when DAST API template' do
+      # The DAST API template purposly excludes a stages
       # definition.
 
+      let(:template_name) { 'Security/DAST-API.gitlab-ci.yml' }
+
+      context 'with default stages' do
+        let(:content) do
+          <<~EOS
+            include:
+              - template: #{template_name}
+
+            concrete_build_implemented_by_a_user:
+              stage: test
+              script: do something
+          EOS
+        end
+
+        it { is_expected.not_to be_valid }
+      end
+
+      context 'with defined stages' do
+        let(:content) do
           <<~EOS
             include:
               - template: #{template_name}
@@ -47,7 +118,22 @@ RSpec.describe 'CI YML Templates' do
               stage: test
               script: do something
           EOS
-        else
+        end
+
+        it { is_expected.to be_valid }
+
+        include_examples 'require default stages to be included'
+      end
+    end
+
+    context 'when API Fuzzing template' do
+      # The API Fuzzing template purposly excludes a stages
+      # definition.
+
+      let(:template_name) { 'Security/API-Fuzzing.gitlab-ci.yml' }
+
+      context 'with default stages' do
+        let(:content) do
           <<~EOS
             include:
               - template: #{template_name}
@@ -57,39 +143,31 @@ RSpec.describe 'CI YML Templates' do
               script: do something
           EOS
         end
-      end
 
-      it 'is valid' do
-        expect(subject).to be_valid
+        it { is_expected.not_to be_valid }
       end
 
-      it 'require default stages to be included' do
-        expect(subject.stages).to include(*Gitlab::Ci::Config::Entry::Stages.default)
-      end
-    end
-  end
-
-  context 'when including unavailable templates in a CI YAML configuration' do
-    using RSpec::Parameterized::TableSyntax
-
-    where(:template_name) do
-      excluded_templates
-    end
-
-    with_them do
+      context 'with defined stages' do
         let(:content) do
           <<~EOS
             include:
               - template: #{template_name}
 
+            stages:
+              - build
+              - test
+              - deploy
+              - fuzz
+
             concrete_build_implemented_by_a_user:
               stage: test
               script: do something
           EOS
         end
 
-      it 'is not valid' do
-        expect(subject).not_to be_valid
+        it { is_expected.to be_valid }
+
+        include_examples 'require default stages to be included'
       end
     end
   end