346 lines
12 KiB
Groovy
346 lines
12 KiB
Groovy
pipeline {
|
|
agent {
|
|
kubernetes {
|
|
defaultContainer 'go-tester'
|
|
yaml """
|
|
apiVersion: v1
|
|
kind: Pod
|
|
spec:
|
|
nodeSelector:
|
|
kubernetes.io/arch: arm64
|
|
node-role.kubernetes.io/worker: "true"
|
|
containers:
|
|
- name: go-tester
|
|
image: registry.bstein.dev/bstein/golang:1.25-bookworm
|
|
command: ["cat"]
|
|
tty: true
|
|
volumeMounts:
|
|
- name: workspace-volume
|
|
mountPath: /home/jenkins/agent
|
|
- name: publisher
|
|
image: registry.bstein.dev/bstein/python:3.12-slim
|
|
command: ["cat"]
|
|
tty: true
|
|
volumeMounts:
|
|
- name: workspace-volume
|
|
mountPath: /home/jenkins/agent
|
|
- name: quality-tools
|
|
image: registry.bstein.dev/bstein/quality-tools:sonar8.0.1-trivy0.70.0-db20260422-arm64
|
|
command: ["cat"]
|
|
tty: true
|
|
volumeMounts:
|
|
- name: workspace-volume
|
|
mountPath: /home/jenkins/agent
|
|
volumes:
|
|
- name: workspace-volume
|
|
emptyDir: {}
|
|
"""
|
|
}
|
|
}
|
|
|
|
environment {
|
|
SUITE_NAME = 'ananke'
|
|
PUSHGATEWAY_URL = 'http://platform-quality-gateway.monitoring.svc.cluster.local:9091'
|
|
SONARQUBE_HOST_URL = 'http://sonarqube.quality.svc.cluster.local:9000'
|
|
SONARQUBE_PROJECT_KEY = 'ananke'
|
|
SONARQUBE_TOKEN = credentials('sonarqube-token')
|
|
QUALITY_GATE_SONARQUBE_ENFORCE = '0'
|
|
QUALITY_GATE_SONARQUBE_REPORT = 'build/sonarqube-quality-gate.json'
|
|
QUALITY_GATE_IRONBANK_ENFORCE = '0'
|
|
QUALITY_GATE_IRONBANK_REQUIRED = '0'
|
|
QUALITY_GATE_IRONBANK_REPORT = 'build/ironbank-compliance.json'
|
|
}
|
|
|
|
options {
|
|
disableConcurrentBuilds()
|
|
buildDiscarder(logRotator(daysToKeepStr: '30', numToKeepStr: '200', artifactDaysToKeepStr: '30', artifactNumToKeepStr: '120'))
|
|
}
|
|
|
|
triggers {
|
|
pollSCM('H/5 * * * *')
|
|
}
|
|
|
|
stages {
|
|
stage('Checkout') {
|
|
steps {
|
|
checkout scm
|
|
}
|
|
}
|
|
|
|
stage('Collect SonarQube evidence') {
|
|
steps {
|
|
container('quality-tools') {
|
|
sh '''#!/usr/bin/env bash
|
|
set -euo pipefail
|
|
mkdir -p build
|
|
args=(
|
|
"-Dsonar.host.url=${SONARQUBE_HOST_URL}"
|
|
"-Dsonar.login=${SONARQUBE_TOKEN}"
|
|
"-Dsonar.projectKey=${SONARQUBE_PROJECT_KEY}"
|
|
"-Dsonar.projectName=${SONARQUBE_PROJECT_KEY}"
|
|
"-Dsonar.sources=."
|
|
"-Dsonar.exclusions=**/.git/**,**/build/**,**/dist/**,**/node_modules/**,**/.venv/**,**/__pycache__/**,**/coverage/**,**/test-results/**,**/playwright-report/**"
|
|
"-Dsonar.test.inclusions=**/tests/**,**/testing/**,**/*_test.go,**/*.test.ts,**/*.test.tsx,**/*.spec.ts,**/*.spec.tsx"
|
|
)
|
|
[ -f build/coverage.out ] && args+=("-Dsonar.go.coverage.reportPaths=build/coverage.out")
|
|
set +e
|
|
sonar-scanner "${args[@]}" | tee build/sonar-scanner.log
|
|
rc=${PIPESTATUS[0]}
|
|
set -e
|
|
printf '%s\n' "${rc}" > build/sonarqube-analysis.rc
|
|
'''
|
|
}
|
|
container('publisher') {
|
|
sh '''
|
|
set -eu
|
|
mkdir -p build
|
|
python3 - <<'PY'
|
|
import base64
|
|
import json
|
|
import os
|
|
import urllib.parse
|
|
import urllib.request
|
|
|
|
host = os.getenv('SONARQUBE_HOST_URL', '').strip().rstrip('/')
|
|
project_key = os.getenv('SONARQUBE_PROJECT_KEY', '').strip()
|
|
token = os.getenv('SONARQUBE_TOKEN', '').strip()
|
|
report_path = os.getenv('QUALITY_GATE_SONARQUBE_REPORT', 'build/sonarqube-quality-gate.json')
|
|
payload = {"status": "ERROR", "note": "missing SONARQUBE_HOST_URL and/or SONARQUBE_PROJECT_KEY"}
|
|
if host and project_key:
|
|
query = urllib.parse.urlencode({"projectKey": project_key})
|
|
request = urllib.request.Request(f"{host}/api/qualitygates/project_status?{query}", method="GET")
|
|
if token:
|
|
encoded = base64.b64encode(f"{token}:".encode("utf-8")).decode("utf-8")
|
|
request.add_header("Authorization", f"Basic {encoded}")
|
|
try:
|
|
with urllib.request.urlopen(request, timeout=12) as response:
|
|
payload = json.loads(response.read().decode("utf-8"))
|
|
except Exception as exc: # noqa: BLE001
|
|
payload = {"status": "ERROR", "error": str(exc)}
|
|
with open(report_path, "w", encoding="utf-8") as handle:
|
|
json.dump(payload, handle, indent=2, sort_keys=True)
|
|
handle.write("\\n")
|
|
PY
|
|
'''
|
|
}
|
|
}
|
|
}
|
|
|
|
stage('Collect Supply Chain evidence') {
|
|
steps {
|
|
container('quality-tools') {
|
|
sh '''#!/usr/bin/env bash
|
|
set -euo pipefail
|
|
mkdir -p build
|
|
set +e
|
|
trivy fs --cache-dir "${TRIVY_CACHE_DIR}" --skip-db-update --timeout 5m --no-progress --format json --output build/trivy-fs.json --scanners vuln,secret,misconfig --severity HIGH,CRITICAL .
|
|
trivy_rc=$?
|
|
set -e
|
|
if [ ! -s build/trivy-fs.json ]; then
|
|
cat > build/ironbank-compliance.json <<EOF
|
|
{"status":"failed","compliant":false,"scanner":"trivy","scan_type":"filesystem","error":"trivy did not produce JSON output","trivy_rc":${trivy_rc}}
|
|
EOF
|
|
exit 0
|
|
fi
|
|
critical="$(jq '[.Results[]? | .Vulnerabilities[]? | select(.Severity=="CRITICAL")] | length' build/trivy-fs.json)"
|
|
high="$(jq '[.Results[]? | .Vulnerabilities[]? | select(.Severity=="HIGH")] | length' build/trivy-fs.json)"
|
|
secrets="$(jq '[.Results[]? | .Secrets[]?] | length' build/trivy-fs.json)"
|
|
misconfigs="$(jq '[.Results[]? | .Misconfigurations[]? | select(.Status=="FAIL" and (.Severity=="CRITICAL" or .Severity=="HIGH"))] | length' build/trivy-fs.json)"
|
|
status=ok
|
|
compliant=true
|
|
if [ "${critical}" -gt 0 ] || [ "${secrets}" -gt 0 ] || [ "${misconfigs}" -gt 0 ]; then
|
|
status=failed
|
|
compliant=false
|
|
fi
|
|
jq -n --arg status "${status}" --argjson compliant "${compliant}" --argjson critical "${critical}" --argjson high "${high}" --argjson secrets "${secrets}" --argjson misconfigs "${misconfigs}" --argjson trivy_rc "${trivy_rc}" \
|
|
'{status:$status, compliant:$compliant, category:"artifact_security", scan_type:"filesystem", scanner:"trivy", critical_vulnerabilities:$critical, high_vulnerabilities:$high, secrets:$secrets, high_or_critical_misconfigurations:$misconfigs, trivy_rc:$trivy_rc, high_vulnerability_policy:"observe"}' > build/ironbank-compliance.json
|
|
'''
|
|
}
|
|
container('publisher') {
|
|
sh '''
|
|
set -eu
|
|
mkdir -p build
|
|
python3 - <<'PY'
|
|
import json
|
|
import os
|
|
from pathlib import Path
|
|
|
|
report_path = Path(os.getenv('QUALITY_GATE_IRONBANK_REPORT', 'build/ironbank-compliance.json'))
|
|
if report_path.exists():
|
|
raise SystemExit(0)
|
|
status = os.getenv('IRONBANK_COMPLIANCE_STATUS', '').strip()
|
|
compliant = os.getenv('IRONBANK_COMPLIANT', '').strip().lower()
|
|
payload = {"status": status or "unknown", "compliant": compliant in {"1", "true", "yes", "on"} if compliant else None}
|
|
payload = {k: v for k, v in payload.items() if v is not None}
|
|
if "status" not in payload:
|
|
payload["status"] = "unknown"
|
|
payload["note"] = "Set IRONBANK_COMPLIANCE_STATUS/IRONBANK_COMPLIANT or write build/ironbank-compliance.json in image-building repos."
|
|
report_path.parent.mkdir(parents=True, exist_ok=True)
|
|
report_path.write_text(json.dumps(payload, indent=2, sort_keys=True) + "\\n", encoding="utf-8")
|
|
PY
|
|
'''
|
|
}
|
|
}
|
|
}
|
|
|
|
stage('Run quality gate') {
|
|
steps {
|
|
container('go-tester') {
|
|
sh '''
|
|
set -eu
|
|
mkdir -p build
|
|
set +e
|
|
export GOFLAGS='-buildvcs=false'
|
|
ANANKE_QUALITY_METRICS_ENABLED=0 \
|
|
ANANKE_QUALITY_PUSHGATEWAY_ENABLED=0 \
|
|
ANANKE_QUALITY_STATE_FILE="$PWD/build/quality-gate.state" \
|
|
./scripts/quality_gate.sh > build/quality-gate.out 2>&1
|
|
gate_rc=$?
|
|
set -e
|
|
cat build/quality-gate.out
|
|
printf '%s\\n' "${gate_rc}" > build/quality-gate.rc
|
|
'''
|
|
}
|
|
}
|
|
}
|
|
|
|
stage('Publish test metrics') {
|
|
steps {
|
|
container('publisher') {
|
|
sh '''
|
|
set -eu
|
|
ok_runs="$(awk -F= '$1=="ok"{print $2}' build/quality-gate.state 2>/dev/null | tail -n1)"
|
|
failed_runs="$(awk -F= '$1=="failed"{print $2}' build/quality-gate.state 2>/dev/null | tail -n1)"
|
|
[ -n "${ok_runs}" ] || ok_runs=0
|
|
[ -n "${failed_runs}" ] || failed_runs=0
|
|
coverage_percent="$(python3 - <<'PY'
|
|
import re
|
|
from pathlib import Path
|
|
|
|
log_path = Path("build/quality-gate.out")
|
|
text = log_path.read_text(encoding="utf-8", errors="ignore") if log_path.exists() else ""
|
|
values = [float(match.group(1)) for match in re.finditer(r"([0-9]+(?:\\.[0-9]+)?)%", text)]
|
|
print(values[-1] if values else 0.0)
|
|
PY
|
|
)"
|
|
printf '%s\n' "${coverage_percent}" > build/coverage-percent.txt
|
|
python3 scripts/publish_quality_metrics.py \
|
|
--pushgateway-url "${PUSHGATEWAY_URL}" \
|
|
--job-name platform-quality-ci \
|
|
--suite "${SUITE_NAME}" \
|
|
--trigger jenkins \
|
|
--local-ok "${ok_runs}" \
|
|
--local-failed "${failed_runs}" \
|
|
--coverage-percent-file build/coverage-percent.txt
|
|
'''
|
|
}
|
|
}
|
|
}
|
|
|
|
stage('Enforce quality gate') {
|
|
steps {
|
|
container('publisher') {
|
|
sh '''
|
|
set -eu
|
|
gate_rc="$(cat build/quality-gate.rc 2>/dev/null || echo 1)"
|
|
fail=0
|
|
if [ "${gate_rc}" -ne 0 ]; then
|
|
echo "quality gate failed with rc=${gate_rc}" >&2
|
|
fail=1
|
|
fi
|
|
|
|
enabled() {
|
|
case "$(printf '%s' "${1:-}" | tr '[:upper:]' '[:lower:]')" in
|
|
1|true|yes|on) return 0 ;;
|
|
*) return 1 ;;
|
|
esac
|
|
}
|
|
|
|
if enabled "${QUALITY_GATE_SONARQUBE_ENFORCE:-1}"; then
|
|
sonar_status="$(python3 - <<'PY'
|
|
import json
|
|
from pathlib import Path
|
|
|
|
path = Path("build/sonarqube-quality-gate.json")
|
|
if not path.exists():
|
|
print("missing")
|
|
raise SystemExit(0)
|
|
try:
|
|
payload = json.loads(path.read_text(encoding="utf-8"))
|
|
except Exception: # noqa: BLE001
|
|
print("error")
|
|
raise SystemExit(0)
|
|
status = (payload.get("status") or payload.get("projectStatus", {}).get("status") or payload.get("qualityGate", {}).get("status") or "").strip().lower()
|
|
print(status or "missing")
|
|
PY
|
|
)"
|
|
case "${sonar_status}" in
|
|
ok|pass|passed|success) ;;
|
|
*)
|
|
echo "sonarqube gate failed: ${sonar_status}" >&2
|
|
fail=1
|
|
;;
|
|
esac
|
|
fi
|
|
|
|
ironbank_required="${QUALITY_GATE_IRONBANK_REQUIRED:-0}"
|
|
if [ "${PUBLISH_IMAGES:-false}" = "true" ]; then
|
|
ironbank_required=1
|
|
fi
|
|
if enabled "${QUALITY_GATE_IRONBANK_ENFORCE:-1}"; then
|
|
supply_status="$(python3 - <<'PY'
|
|
import json
|
|
from pathlib import Path
|
|
|
|
path = Path("build/ironbank-compliance.json")
|
|
if not path.exists():
|
|
print("missing")
|
|
raise SystemExit(0)
|
|
try:
|
|
payload = json.loads(path.read_text(encoding="utf-8"))
|
|
except Exception: # noqa: BLE001
|
|
print("error")
|
|
raise SystemExit(0)
|
|
compliant = payload.get("compliant")
|
|
if compliant is True:
|
|
print("ok")
|
|
elif compliant is False:
|
|
print("failed")
|
|
else:
|
|
status = str(payload.get("status") or payload.get("result") or payload.get("compliance") or "").strip().lower()
|
|
print(status or "missing")
|
|
PY
|
|
)"
|
|
case "${supply_status}" in
|
|
ok|pass|passed|success|compliant) ;;
|
|
not_applicable|na|n/a)
|
|
if enabled "${ironbank_required}"; then
|
|
echo "supply chain gate required but status=${supply_status}" >&2
|
|
fail=1
|
|
fi
|
|
;;
|
|
*)
|
|
if enabled "${ironbank_required}"; then
|
|
echo "supply chain gate failed: ${supply_status}" >&2
|
|
fail=1
|
|
else
|
|
echo "supply chain gate not passing (${supply_status}) but not required for this run" >&2
|
|
fi
|
|
;;
|
|
esac
|
|
fi
|
|
|
|
exit "${fail}"
|
|
'''
|
|
}
|
|
}
|
|
}
|
|
}
|
|
|
|
post {
|
|
always {
|
|
archiveArtifacts artifacts: 'build/*.json,build/*.out,build/*.rc,build/*.txt,build/*.xml', allowEmptyArchive: true, fingerprint: true
|
|
}
|
|
}
|
|
}
|