GitLab CI, GitHub Actions oder Azure DevOps: Welche Pipeline zu deinem Unternehmen passt

# GitHub: Workflows und die Laeufe der letzten Wochen
gh api /repos/plattform/app/actions/workflows --jq '.workflows[].path'
gh api '/repos/plattform/app/actions/runs?per_page=100' \
  --jq '.workflow_runs[] | [.name, .conclusion, .run_started_at] | @tsv'

# GitLab: Pipelines je Projekt
glab api 'projects/plattform%2Fapp/pipelines?per_page=100' \
  | jq -r '.[] | [.id, .status, .created_at] | @tsv'

# Azure DevOps: Definitionen und letzte Laeufe
az pipelines list --organization https://dev.azure.com/beispiel \
  --project Plattform -o table
az pipelines runs list --organization https://dev.azure.com/beispiel \
  --project Plattform --top 50 -o table

stages: [build, test]

variables:
  IMAGE: $CI_REGISTRY_IMAGE:$CI_COMMIT_SHORT_SHA

build:
  stage: build
  image: quay.io/buildah/stable:v1.38
  script:
    - buildah login -u "$CI_REGISTRY_USER" -p "$CI_REGISTRY_PASSWORD" "$CI_REGISTRY"
    - buildah bud --format docker -t "$IMAGE" .
    - buildah push "$IMAGE"
  interruptible: true

test:
  stage: test
  image: golang:1.24
  script:
    - go test ./...
  cache:
    key: $CI_COMMIT_REF_SLUG
    paths: [.cache/go-build]

name: build
on:
  push:
    branches: [main]

permissions:
  contents: read
  packages: write

concurrency:
  group: build-${{ github.ref }}
  cancel-in-progress: true

jobs:
  build:
    runs-on: ubuntu-24.04
    steps:
      - uses: actions/checkout@v4
      - uses: docker/login-action@v3
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}
      - uses: docker/build-push-action@v6
        with:
          push: true
          tags: ghcr.io/plattform/app:${{ github.sha }}

trigger:
  branches:
    include: [main]

pool:
  vmImage: ubuntu-24.04

steps:
  - task: Docker@2
    inputs:
      containerRegistry: 'acr-plattform'
      repository: 'app'
      command: 'buildAndPush'
      Dockerfile: '**/Dockerfile'
      tags: '$(Build.SourceVersion)'

aws iam create-open-id-connect-provider \
  --url https://token.actions.githubusercontent.com \
  --client-id-list sts.amazonaws.com

cat > trust.json <<'JSON'
{
  "Version": "2012-10-17",
  "Statement": [{
    "Effect": "Allow",
    "Principal": {
      "Federated": "arn:aws:iam::123456789012:oidc-provider/token.actions.githubusercontent.com"
    },
    "Action": "sts:AssumeRoleWithWebIdentity",
    "Condition": {
      "StringEquals": {
        "token.actions.githubusercontent.com:aud": "sts.amazonaws.com",
        "token.actions.githubusercontent.com:sub": "repo:plattform/app:ref:refs/heads/main"
      }
    }
  }]
}
JSON

aws iam create-role --role-name ci-deploy \
  --assume-role-policy-document file://trust.json

az ad app create --display-name ci-gitlab-plattform
APP_ID=$(az ad app list --display-name ci-gitlab-plattform --query '[0].appId' -o tsv)

cat > fed.json <<'JSON'
{
  "name": "gitlab-main",
  "issuer": "https://gitlab.example.de",
  "subject": "project_path:plattform/app:ref_type:branch:ref:main",
  "audiences": ["https://gitlab.example.de"]
}
JSON

az ad app federated-credential create --id "$APP_ID" --parameters fed.json
az role assignment create --assignee "$APP_ID" --role Contributor \
  --scope /subscriptions/<abo-id>/resourceGroups/rg-plattform

curl -L --output /usr/local/bin/gitlab-runner \
  https://gitlab-runner-downloads.s3.amazonaws.com/latest/binaries/gitlab-runner-linux-amd64
chmod +x /usr/local/bin/gitlab-runner

gitlab-runner register --non-interactive \
  --url https://gitlab.example.de/ \
  --token glrt-XXXXXXXXXXXXXXXXXXXX \
  --executor docker \
  --docker-image alpine:3.21 \
  --docker-volumes /cache

# /etc/gitlab-runner/config.toml
# concurrent = 4
# check_interval = 3

# GitLab-Pipeline aus einem bestehenden Jenkins-Job ausloesen
curl --fail --request POST \
  --header "PRIVATE-TOKEN: ${GITLAB_TOKEN}" \
  --form "ref=main" \
  "https://gitlab.example.de/api/v4/projects/1234/pipeline"

# GitHub Actions anstossen und auf das Ergebnis warten
gh workflow run build.yml --ref main --repo plattform/app
gh run watch --repo plattform/app