Pipeline COE

Pipeline COE is a central repository of pre-built images which SHIP-HATS users can use in their CI/CD pipelines.

The objective of this is to:

Foster collaborative development environment via innersourcing.
Ensure adherence to security best practices.
Meet compliance requirements.

This feature is based on GitLab DevSecOps Governance Framework (DGF).

Key features

Integrated container scanning: This ensures all images in Container Registry (CR) are scanned in build pipeline.
Chainguard wolfi-base image: Uses a hardened and minimal image that is cleaner and more secure.
Open to innersourcing: This fosters collaboration and knowledge sharing
Regular clean-ups and scans: Curated by deprecating versions with security vulnerabilities with regular clean ups and scans.
Up-to-date & patched base images: Ensures the project uses the latest versions of base images with the necessary security patches.
Notify users on outdated images: We notify users if their projects include an outdated version of Pipeline COE image.

How to use Pipeline COE?

Refer to the following use cases and complete the steps accordingly.

When you contribute to an existing image or contribute a new image, the best practice is to review the project on a monthly basis and ensure that any flagged vulnerabilities are resolved. This is a shared responsibility of SHIP-HATS and the users.

Use pre-built image

Search for an existing image in the Pipeline COE that meets your requirements.
Make a copy of the image from Pipeline COE to your project’s Container Registry (CR) and reference from there, as Pipeline COE only keeps the latest version. For more details, refer to the corresponding README.md of the Pipeline COE repository.

Contribute to an existing image

Identify a suitable base image in Pipeline COE that closely aligns with your requirements.
Create a GitLab issue within the project.
Branch a copy of this base image and modify it to include the necessary changes.
Complete the Approval checklist to increase the chances of your merge request approval.
Submit the Merge Request (MR).
The SHIP-HATS team will review and merge the request as per the approval process.

Contribute new image

If none of the existing images meet your specific needs, you can request to create a new project within Pipeline COE and then contribute an image.

Raise a service request to create the new project within Pipeline COE. SHIP-HATS team creates a new project and notifies you.
Read the README.md of the new project and refer to the corresponding Contributors section for the instructions.
Run the CI/CD pipeline to create the new image.
Refer to the Approval checklist to increase the chances of your merge request approval.
Submit the Merge Request (MR).
The SHIP-HATS team will review and merge the request as per the approval process.

For any additional help, raise a service request.

Approval checklist

For the merge request to be successful, ensure the following:

All scans have passed successfully.
There are no deprecated versions.
Images are reusable and modular.

- If you require unsupported or deprecated versions, copy the image to your own container registries.
- Store highly customised images or those containing specific development work in your own container registries.

Additional resources

Use SHIP-HATS pipeline template

Compliance framework