mirror of
https://github.com/itplr-kosit/validator.git
synced 2026-07-25 16:15:47 +00:00
599042fb23
scripts/validate.sh is the engine behind both platforms: download the released standalone jar and the validation configuration (SHA-256-verified when pinned), validate each document, print PASS/FAIL with the failing rule ids and fail on any rejection. The GitHub Action (action.yml) maps its inputs onto the script's environment; the GitLab template fetches the same script from this repository at KOSIT_SCRIPT_REF and drives it with the same variables, so both platforms run identical logic. With Docker available the action executes each validation sealed (the "sealed" input, default "auto"): inside an eclipse-temurin:21-jre container without network access, a read-only root, no capabilities and no privilege escalation, run with an init process, a pids limit and the caller's uid; the document, the jar and the configuration are mounted read-only, only the report directory and a bounded /tmp tmpfs are writable. Downloads always happen outside the container, so the validator itself never touches the network, and the host JVM setup is skipped entirely for "sealed: always". The image tag pins the Java 21 JRE contract and floats the patch level: the released jars are the checksummed artifacts, the runtime is a security-patch channel; an "image" input (KOSIT_IMAGE on GitLab) accepts a digest-pinned reference for stricter policies. The GitLab job image is the same runtime, giving both platforms an identical execution environment. The action self-test validates a conformant XRechnung reference instance and asserts a corrupted one is rejected, exercising the sealed path through the empty-input fallback and an explicit image override, plus the host path.
55 lines
2.5 KiB
YAML
55 lines
2.5 KiB
YAML
# Reusable GitLab CI template for the KoSIT validator.
|
|
#
|
|
# Include it and extend the hidden job:
|
|
#
|
|
# include:
|
|
# - remote: "https://raw.githubusercontent.com/itplr-kosit/validator/<ref>/gitlab/validator.gitlab-ci.yml"
|
|
#
|
|
# validate-invoices:
|
|
# extends: .kosit-validate
|
|
# variables:
|
|
# KOSIT_SCRIPT_REF: "<ref>"
|
|
# KOSIT_CONFIGURATION: "https://github.com/itplr-kosit/validator-configuration-xrechnung/releases/download/v2026-01-31/xrechnung-3.0.2-validator-configuration-2026-01-31.zip"
|
|
# KOSIT_FILES: "invoices/"
|
|
#
|
|
# The job fetches scripts/validate.sh — the same engine the GitHub Action
|
|
# runs — from this repository at KOSIT_SCRIPT_REF. Use the same ref for
|
|
# the include and the script, and pin a tag or commit for reproducible
|
|
# pipelines. The variables are the script's interface:
|
|
#
|
|
# KOSIT_VERSION validator release, default 1.6.2
|
|
# KOSIT_CHECKSUM optional SHA-256 of the validator jar
|
|
# KOSIT_CONFIGURATION configuration zip URL, or a path to an
|
|
# unpacked configuration with scenarios.xml
|
|
# KOSIT_CONFIGURATION_CHECKSUM optional SHA-256 of the configuration zip
|
|
# KOSIT_FILES file, directory or glob of XML documents
|
|
# KOSIT_REPORT_DIR report output directory, default validator-reports
|
|
#
|
|
# The job image is the same runtime the GitHub Action uses for its sealed
|
|
# execution, so both platforms run the validator in an identical
|
|
# environment. The tag pins the Java 21 JRE contract and floats the patch
|
|
# level; override KOSIT_IMAGE with a digest-pinned reference for a
|
|
# stricter policy. Docker is not available inside the job container, so
|
|
# the script runs its host path — which here already is the pinned image.
|
|
|
|
.kosit-validate:
|
|
image: $KOSIT_IMAGE
|
|
variables:
|
|
KOSIT_IMAGE: "eclipse-temurin:21-jre"
|
|
KOSIT_SCRIPT_REF: "main"
|
|
KOSIT_VERSION: "1.6.2"
|
|
KOSIT_CHECKSUM: ""
|
|
KOSIT_CONFIGURATION: ""
|
|
KOSIT_CONFIGURATION_CHECKSUM: ""
|
|
KOSIT_FILES: ""
|
|
KOSIT_REPORT_DIR: "validator-reports"
|
|
KOSIT_SEALED: "never"
|
|
KOSIT_CACHE: "$CI_PROJECT_DIR/.kosit-cache"
|
|
script:
|
|
- apt-get update -qq >/dev/null && apt-get install -qqy --no-install-recommends curl unzip >/dev/null
|
|
- curl -fsSL "https://raw.githubusercontent.com/itplr-kosit/validator/$KOSIT_SCRIPT_REF/scripts/validate.sh" -o /tmp/kosit-validate.sh
|
|
- bash /tmp/kosit-validate.sh
|
|
artifacts:
|
|
when: always
|
|
paths:
|
|
- $KOSIT_REPORT_DIR
|