Build ability to import foreign packages.
Description
Multiple customers have expressed interest in having a pipeline that can import foreign packages from places like pypi and npm public repositories into a centralized GitLab package repository. This problem is difficult as each package type requires a unique process to import them into GitLab. This means we'll need almost a unique pipeline per package type. Each pipeline should follow a flow as described below.
Pipeline Flow (per Job)
-
- Job spins up, connects to a foreign package repository and pulls this package locally. It then stores this package in the local GitLab Package repository.
-
- A job spins up, pulls down local package into local environment (or a cache/artifact from Job #1 (closed)), and Dependency Scanning is applied to it. The report is then saved to the GitLab Security Dashboard, and then the report is artifact.
-
- License scanning spins up and conducts a similar operation to Job #2 (closed).
-
- The license and dependency report artifacts are committed to the repo in a subdirectory with the structure of (PACKAGE_TYPE/PACKAGE_NAME/reports.json)