Jenkinsfile

pipeline {
    agent {
        label 'high-cpu'
    }

    triggers {
        cron(env.BRANCH_NAME == 'develop' ? '0 19 * * 5' : '')
    }

    options {
        buildDiscarder(logRotator(numToKeepStr: '20'))
        timestamps()
        timeout(time: 120, unit: 'MINUTES')
    }

    parameters {
        booleanParam(defaultValue: false, name: 'forcePushImage', description: 'Pushes the image with the current git commit as tag, even when it is on a branch')
        booleanParam(defaultValue: false, name: 'noCache', description: 'Builds the docker image without cache')
        choice(name: 'chooseProfile', choices: ['full', 'minimal', 'all-profiles', 'full-prefix', 'content-examples', 'operator-full','operator-mandants'], description: 'Starts GOP with given profile only and execute tests which belongs to profile.')
    }

    environment {
        BUILD_USER = sh(script: 'id -u', returnStdout: true).trim()
        BUILD_GROUP = sh(script: 'getent group docker | cut -d: -f3', returnStdout: true).trim()
        DOCKER_REGISTRY_BASE_URL = 'ghcr.io'
        DOCKER_IMAGE_NAME = 'cloudogu/gitops-playground'
        MAVEN_IMAGE = 'maven:3-eclipse-temurin-17'
        GRYPE_IMAGE = 'anchore/grype:v0.109.1'
        SYFT_IMAGE = 'anchore/syft:v1.42.2'
        GOLANG_IMAGE = 'golang:1.25-alpine'
        SHORT_SHA = sh(script: 'git rev-parse --short=8 HEAD', returnStdout: true).trim()
        BUILD_DATE = sh(script: 'date --rfc-3339 ns', returnStdout: true).trim()
        K3D_CLUSTER_NAME = "k3d-gop-cluster-${env.BUILD_ID}"
        FULL_IMAGE_TAG = "${env.DOCKER_REGISTRY_BASE_URL}/${env.DOCKER_IMAGE_NAME}:${env.SHORT_SHA}"
        TAG_NAME = sh(returnStdout: true, script: "git fetch --tags && git --no-pager tag --points-at HEAD").trim()
        // Shared docker args for integration tests
        INTEGRATION_TEST_DOCKER_ARGS = "-e KUBECONFIG=${env.WORKSPACE}/.kubeconfig.yaml -v maven-cache:/root/.m2 -v /var/run/docker.sock:/var/run/docker.sock -u :${env.BUILD_GROUP} --network=host --entrypoint ''"
    }

    stages {

        stage('Build') {

            parallel {

                stage("Unit Test") {
                    agent { docker {
                        image "${env.MAVEN_IMAGE}"
                        args "-v maven-cache:/root/.m2"
                        reuseNode true
                    }}
                    steps {
                        sh 'mvn -B clean test'
                    }
                    post {
                        always {
                            junit testResults: '**/target/surefire-reports/TEST-*.xml'
                            archiveArtifacts artifacts: "**/target/site/jacoco/**"
                        }
                    }
                }

                stage("Build Image") {
                    steps {
                        script {
                            def buildArgs = "--no-cache " +
                                            "--build-arg BUILD_DATE='${env.BUILD_DATE}' " +
                                            "--build-arg VCS_REF='${env.GIT_COMMIT}' "
                            docker.build(env.FULL_IMAGE_TAG, "${buildArgs} .")
                        }
                    }
                }

                stage("SonarScanner") {
                    agent { docker {
                        image "${env.MAVEN_IMAGE}"
                        args "-v maven-cache:/root/.m2"
                        reuseNode true
                    }}
                    steps {
                        withSonarQubeEnv('ces-sonar') {
                            sh "mvn clean verify sonar:sonar -Dsonar.projectKey=gitops-playground -Dsonar.branch.name=${BRANCH_NAME}"
                        }
                    }
                }
            }
        }

        stage('Security & Integration') {

            parallel {

                stage('SBOM & Vulnerability Scan') {
                    steps {
                        sh '''docker run --rm -v $WORKSPACE:/workspace \
                                         -v /var/run/docker.sock:/var/run/docker.sock:ro \
                                         -u :$BUILD_GROUP \
                                         -e NO_COLOR=1 \
                                         $SYFT_IMAGE --output syft-table=/workspace/sbom.txt --output spdx-json=/workspace/sbom.json --quiet $FULL_IMAGE_TAG'''
                        sh '''docker run --rm -v $WORKSPACE:/workspace \
                                         -v /var/run/docker.sock:/var/run/docker.sock:ro \
                                         -u :$BUILD_GROUP \
                                         -e NO_COLOR=1 \
                                         $GRYPE_IMAGE sbom:/workspace/sbom.json \
                                             --output table=/workspace/vulnerabilities.txt \
                                             --output sarif=/workspace/vulnerabilities.sarif \
                                             --quiet --sort-by severity --fail-on critical'''
                        archiveArtifacts artifacts: 'sbom.*, vulnerabilities.*'
                    }
                }

                stage('Integration tests') {
                    steps {
                        script {
                            def profiles = []
                            def isTriggeredByTimer = currentBuild.getBuildCauses('hudson.triggers.TimerTrigger$TimerTriggerCause').size() > 0

                            if (isTriggeredByTimer || params.chooseProfile == 'all-profiles' || env.BRANCH_NAME == 'main') {
                                profiles = ['minimal', 'full', 'full-prefix', 'content-examples', 'operator-full','operator-mandants']
                            } else if (env.BRANCH_NAME == 'develop') {
                                profiles = ['full-prefix', 'operator-mandants', 'operator-full']
                            } else {
                                profiles = [params.chooseProfile]
                            }

                            def dumpKubernetesDebugInfo = { profile ->
                                def dumpDir = "target/k8s-debug/${profile}"

                                docker.image("${env.GOLANG_IMAGE}").inside(env.INTEGRATION_TEST_DOCKER_ARGS) {
                                    sh(script: """
                                        set +e
                                        apk add --no-cache kubectl
                                        mkdir -p '${dumpDir}'
                                        export KUBECONFIG='${env.WORKSPACE}/.kubeconfig.yaml'

                                        kubectl cluster-info > '${dumpDir}/cluster-info.txt' 2>&1
                                        kubectl get nodes -o wide > '${dumpDir}/nodes.txt' 2>&1
                                        kubectl get namespaces -o wide > '${dumpDir}/namespaces.txt' 2>&1
                                        kubectl get pods -A -o wide > '${dumpDir}/pods.txt' 2>&1
                                        kubectl get events -A --sort-by=.lastTimestamp > '${dumpDir}/events.txt' 2>&1
                                        kubectl get pvc,pv -A -o wide > '${dumpDir}/volumes.txt' 2>&1
                                        kubectl get ingress -A -o wide > '${dumpDir}/ingress.txt' 2>&1
                                        kubectl describe all -A > '${dumpDir}/describe-all.txt' 2>&1

                                        : > '${dumpDir}/container-logs.txt'
                                        kubectl get pods -A --no-headers \\
                                          -o custom-columns=NAMESPACE:.metadata.namespace,NAME:.metadata.name |
                                        while read -r namespace pod; do
                                          echo "===== \${namespace}/\${pod} current =====" >> '${dumpDir}/container-logs.txt'
                                          kubectl logs -n "\${namespace}" "\${pod}" --all-containers=true --tail=200 --prefix=true >> '${dumpDir}/container-logs.txt' 2>&1

                                          echo >> '${dumpDir}/container-logs.txt'
                                          echo "===== \${namespace}/\${pod} previous =====" >> '${dumpDir}/container-logs.txt'
                                          kubectl logs -n "\${namespace}" "\${pod}" --all-containers=true --previous --tail=200 --prefix=true >> '${dumpDir}/container-logs.txt' 2>&1
                                          echo >> '${dumpDir}/container-logs.txt'
                                        done
                                    """, returnStatus: true)
                                }

                                  archiveArtifacts artifacts: "${dumpDir}/**", allowEmptyArchive: true
                              }

                            def withK3dCluster = { profile, body ->
                                try {
                                    sh "yes | KUBECONFIG=${env.WORKSPACE}/.kubeconfig.yaml ./scripts/init-cluster.sh --cluster-name=${env.K3D_CLUSTER_NAME}"
                                    body()
                                } catch(Throwable t) {
                                    dumpKubernetesDebugInfo(profile)
                                    throw t
                                } finally {
                                    sh "KUBECONFIG=${env.WORKSPACE}/.kubeconfig.yaml $HOME/.local/bin/k3d cluster delete ${env.K3D_CLUSTER_NAME}"
                                }}

                            profiles.each { profile ->
                                withK3dCluster(profile) {

                                    if (profile.startsWith('operator')) {
                                        docker.image("${env.GOLANG_IMAGE}").inside(env.INTEGRATION_TEST_DOCKER_ARGS) {
                                            sh 'apk add --no-cache make bash curl git kubectl && make install-operator'
                                        }
                                    }

                                    docker.image("${env.FULL_IMAGE_TAG}").inside(env.INTEGRATION_TEST_DOCKER_ARGS) {
                                        sh "java -jar /app/gitops-playground.jar --profile=${profile}"
                                    }
                                    docker.image("${env.MAVEN_IMAGE}").inside(env.INTEGRATION_TEST_DOCKER_ARGS) {
                                        sh "mvn -B failsafe:integration-test failsafe:verify -Dmicronaut.environments=${profile} -Dsurefire.reportNameSuffix=${profile} && chown $BUILD_USER:$BUILD_GROUP ./* -R"
                                    }
                                }

                            }
                        }
                    }
                    post {
                        always {
                            junit testResults: "**/target/failsafe-reports/TEST-*.xml",
                                    allowEmptyResults: true
                        }
                    }
                }
            }
        }

        stage('Push Image') {
            when {
                anyOf {
                    branch 'main'
                    branch 'develop'
                    buildingTag()
                    expression { return params.forcePushImage }
                }
                not {
                    triggeredBy 'TimerTrigger'
                }
            }
            steps {
                script {
                    def image = docker.image(env.FULL_IMAGE_TAG)

                    docker.withRegistry("https://${DOCKER_REGISTRY_BASE_URL}", 'cesmarvin-ghcr') {

                        currentBuild.description = "Image: ${env.FULL_IMAGE_TAG}"
                        image.push()

                        if (env.TAG_NAME) {
                            image.push('latest')
                            image.push(env.TAG_NAME)
                            currentBuild.description += "\nImage: ${env.DOCKER_REGISTRY_BASE_URL}/${env.DOCKER_IMAGE_NAME}:latest"
                            currentBuild.description += "\nRelease: ${env.TAG_NAME}"
                        }
                    }
                }
            }
        }

    }

    post {
        changed {
            emailext(
                subject: "${currentBuild.result}: ${env.JOB_NAME} #${env.BUILD_NUMBER}",
                body: '${SCRIPT, template="groovy-html.template"}',
                mimeType: 'text/html',
                recipientProviders: [
                    [$class: 'DevelopersRecipientProvider'],
                    [$class: 'RequesterRecipientProvider']
                ]
            )
        }
    }
}