CWG-75: Protect Gitlab secrets, raise awareness

README.md

@@ -22,5 +22,13 @@ cookiecutter https://git.astron.nl/templates/cpp-project.git
 # Next follow a set of prompts (such as the name and description of the package)
 ```
 
+## Gitlab security, secrets and role configuration
+
+When using these templates for a repository on git.astron.nl please read the following
+pages to configure Gitlab appropriately:
+
+1. [Gitlab Repository Configuration](https://git.astron.nl/groups/templates/-/wikis/Gitlab-Repository-Configuration)
+2. [Continuous delivery guideline](https://git.astron.nl/groups/templates/-/wikis/Continuous%20Delivery%20Guideline)
+
 ## License
 This project is licensed under the Apache License Version 2.0

{{cookiecutter.project_slug}}/.gitlab-ci.yml

@@ -129,10 +129,21 @@ pages:
     paths:
       - build/doc/*
 
+release_job:
+  stage: publish
+  image: registry.gitlab.com/gitlab-org/release-cli:latest
+  rules:
+    - if: '$CI_COMMIT_TAG && $CI_COMMIT_REF_PROTECTED == "true"'
+  script:
+    - echo "running release_job"
+  release:
+    tag_name: '$CI_COMMIT_TAG'
+    description: '$CI_COMMIT_TAG'
+
 abi-deploy:
   stage: publish
   needs: ["trigger_prepare"]
-  environment: production
+  environment: abi
   script:
     - cmake --version
     - mkdir build && cd build
@@ -143,4 +154,5 @@ abi-deploy:
     # The syntax is described at https://docs.gitlab.com/ee/user/packages/generic_packages/index.html
     - 'curl --header "JOB-TOKEN: $CI_JOB_TOKEN" --upload-file ${APPLICATION_LAST_RELEASE}.dump "${CI_API_V4_URL}/projects/${CI_PROJECT_ID}/packages/generic/ABI/${APPLICATION_LAST_RELEASE}/abi.dump"'
   rules:
-    -  when: manual
+    - if: '$CI_COMMIT_TAG && $CI_COMMIT_REF_PROTECTED == "true"'
+    - when: manual