378 lines
11 KiB
Groovy
378 lines
11 KiB
Groovy
pipeline {
|
|
agent {
|
|
kubernetes {
|
|
label 'bstein-dev-home'
|
|
defaultContainer 'builder'
|
|
yaml """
|
|
apiVersion: v1
|
|
kind: Pod
|
|
metadata:
|
|
labels:
|
|
app: bstein-dev-home
|
|
spec:
|
|
nodeSelector:
|
|
kubernetes.io/arch: arm64
|
|
node-role.kubernetes.io/worker: "true"
|
|
containers:
|
|
- name: dind
|
|
image: docker:27-dind
|
|
securityContext:
|
|
privileged: true
|
|
env:
|
|
- name: DOCKER_TLS_CERTDIR
|
|
value: ""
|
|
args:
|
|
- --mtu=1400
|
|
- --host=unix:///var/run/docker.sock
|
|
- --host=tcp://0.0.0.0:2375
|
|
volumeMounts:
|
|
- name: dind-storage
|
|
mountPath: /var/lib/docker
|
|
- name: builder
|
|
image: docker:27
|
|
command: ["cat"]
|
|
tty: true
|
|
env:
|
|
- name: DOCKER_HOST
|
|
value: tcp://localhost:2375
|
|
- name: DOCKER_TLS_CERTDIR
|
|
value: ""
|
|
volumeMounts:
|
|
- name: workspace-volume
|
|
mountPath: /home/jenkins/agent
|
|
- name: docker-config-writable
|
|
mountPath: /root/.docker
|
|
- name: harbor-config
|
|
mountPath: /docker-config
|
|
- name: tester
|
|
image: python:3.12-slim
|
|
command: ["cat"]
|
|
tty: true
|
|
volumeMounts:
|
|
- name: workspace-volume
|
|
mountPath: /home/jenkins/agent
|
|
- name: frontend
|
|
image: mcr.microsoft.com/playwright:v1.51.0-jammy
|
|
command: ["cat"]
|
|
tty: true
|
|
volumeMounts:
|
|
- name: workspace-volume
|
|
mountPath: /home/jenkins/agent
|
|
volumes:
|
|
- name: workspace-volume
|
|
emptyDir: {}
|
|
- name: docker-config-writable
|
|
emptyDir: {}
|
|
- name: dind-storage
|
|
emptyDir: {}
|
|
- name: harbor-config
|
|
secret:
|
|
secretName: harbor-bstein-robot
|
|
items:
|
|
- key: .dockerconfigjson
|
|
path: config.json
|
|
"""
|
|
}
|
|
}
|
|
environment {
|
|
REGISTRY = 'registry.bstein.dev/bstein'
|
|
FRONT_IMAGE = "${REGISTRY}/bstein-dev-home-frontend"
|
|
BACK_IMAGE = "${REGISTRY}/bstein-dev-home-backend"
|
|
VERSION_TAG = 'dev'
|
|
SEMVER = 'dev'
|
|
SUITE_NAME = 'bstein_home'
|
|
PUSHGATEWAY_URL = 'http://platform-quality-gateway.monitoring.svc.cluster.local:9091'
|
|
QUALITY_GATE_SONARQUBE_REPORT = 'build/sonarqube-quality-gate.json'
|
|
QUALITY_GATE_IRONBANK_REPORT = 'build/ironbank-compliance.json'
|
|
}
|
|
options {
|
|
disableConcurrentBuilds()
|
|
}
|
|
triggers {
|
|
// Poll every 2 minutes; notifyCommit can also trigger, but polling keeps it moving without webhook tokens.
|
|
pollSCM('H/2 * * * *')
|
|
}
|
|
stages {
|
|
stage('Checkout') {
|
|
steps {
|
|
checkout scm
|
|
}
|
|
}
|
|
|
|
stage('Collect SonarQube evidence') {
|
|
steps {
|
|
container('tester') {
|
|
sh '''
|
|
set -euo pipefail
|
|
mkdir -p build
|
|
python3 - <<'PY'
|
|
import base64
|
|
import json
|
|
import os
|
|
import urllib.parse
|
|
import urllib.request
|
|
|
|
host = os.getenv('SONARQUBE_HOST_URL', '').strip().rstrip('/')
|
|
project_key = os.getenv('SONARQUBE_PROJECT_KEY', '').strip()
|
|
token = os.getenv('SONARQUBE_TOKEN', '').strip()
|
|
report_path = os.getenv('QUALITY_GATE_SONARQUBE_REPORT', 'build/sonarqube-quality-gate.json')
|
|
payload = {"status": "ERROR", "note": "missing SONARQUBE_HOST_URL and/or SONARQUBE_PROJECT_KEY"}
|
|
if host and project_key:
|
|
query = urllib.parse.urlencode({"projectKey": project_key})
|
|
request = urllib.request.Request(f"{host}/api/qualitygates/project_status?{query}", method="GET")
|
|
if token:
|
|
encoded = base64.b64encode(f"{token}:".encode("utf-8")).decode("utf-8")
|
|
request.add_header("Authorization", f"Basic {encoded}")
|
|
try:
|
|
with urllib.request.urlopen(request, timeout=12) as response:
|
|
payload = json.loads(response.read().decode("utf-8"))
|
|
except Exception as exc: # noqa: BLE001
|
|
payload = {"status": "ERROR", "error": str(exc)}
|
|
with open(report_path, "w", encoding="utf-8") as handle:
|
|
json.dump(payload, handle, indent=2, sort_keys=True)
|
|
handle.write("\\n")
|
|
PY
|
|
'''
|
|
}
|
|
}
|
|
}
|
|
|
|
stage('Collect Supply Chain evidence') {
|
|
steps {
|
|
container('tester') {
|
|
sh '''
|
|
set -euo pipefail
|
|
mkdir -p build
|
|
python3 - <<'PY'
|
|
import json
|
|
import os
|
|
from pathlib import Path
|
|
|
|
report_path = Path(os.getenv('QUALITY_GATE_IRONBANK_REPORT', 'build/ironbank-compliance.json'))
|
|
if report_path.exists():
|
|
raise SystemExit(0)
|
|
status = os.getenv('IRONBANK_COMPLIANCE_STATUS', '').strip()
|
|
compliant = os.getenv('IRONBANK_COMPLIANT', '').strip().lower()
|
|
payload = {"status": status or "unknown", "compliant": compliant in {"1", "true", "yes", "on"} if compliant else None}
|
|
payload = {k: v for k, v in payload.items() if v is not None}
|
|
if "status" not in payload:
|
|
payload["status"] = "unknown"
|
|
payload["note"] = "Set IRONBANK_COMPLIANCE_STATUS/IRONBANK_COMPLIANT or write build/ironbank-compliance.json in image-building repos."
|
|
report_path.parent.mkdir(parents=True, exist_ok=True)
|
|
report_path.write_text(json.dumps(payload, indent=2, sort_keys=True) + "\\n", encoding="utf-8")
|
|
PY
|
|
'''
|
|
}
|
|
}
|
|
}
|
|
|
|
stage('Prep toolchain') {
|
|
steps {
|
|
container('builder') {
|
|
withCredentials([usernamePassword(credentialsId: 'harbor-robot', usernameVariable: 'HARBOR_USERNAME', passwordVariable: 'HARBOR_PASSWORD')]) {
|
|
sh '''
|
|
set -euo pipefail
|
|
for attempt in 1 2 3 4 5; do
|
|
if apk add --no-cache bash git jq curl; then
|
|
break
|
|
fi
|
|
if [ "$attempt" -eq 5 ]; then
|
|
echo "apk add failed after ${attempt} attempts" >&2
|
|
exit 1
|
|
fi
|
|
sleep $((attempt * 2))
|
|
done
|
|
mkdir -p /root/.docker
|
|
printf '%s' "${HARBOR_PASSWORD}" | docker login registry.bstein.dev -u "${HARBOR_USERNAME}" --password-stdin
|
|
'''
|
|
}
|
|
}
|
|
}
|
|
}
|
|
|
|
stage('Compute version') {
|
|
steps {
|
|
container('builder') {
|
|
script {
|
|
sh '''
|
|
set -euo pipefail
|
|
if git describe --tags --exact-match >/dev/null 2>&1; then
|
|
SEMVER="$(git describe --tags --exact-match)"
|
|
else
|
|
BASE="$(jq -r '.version' frontend/package.json || echo '0.1.0')"
|
|
SEMVER="${BASE}-${BUILD_NUMBER}"
|
|
fi
|
|
# Accept bare semver or leading v (with optional prerelease).
|
|
if ! echo "$SEMVER" | grep -Eq '^v?[0-9]+\\.[0-9]+\\.[0-9]+([-.][0-9A-Za-z]+)?$'; then
|
|
SEMVER="0.1.0-${BUILD_NUMBER}"
|
|
fi
|
|
echo "SEMVER=${SEMVER}" > build.env
|
|
'''
|
|
def props = readProperties file: 'build.env'
|
|
env.SEMVER = props['SEMVER'] ?: "0.1.0-${env.BUILD_NUMBER}"
|
|
env.VERSION_TAG = env.SEMVER
|
|
}
|
|
}
|
|
}
|
|
}
|
|
|
|
stage('Buildx setup') {
|
|
steps {
|
|
container('builder') {
|
|
sh '''
|
|
set -euo pipefail
|
|
ready=0
|
|
for i in $(seq 1 10); do
|
|
if docker info >/dev/null 2>&1; then
|
|
ready=1
|
|
break
|
|
fi
|
|
sleep 2
|
|
done
|
|
if [ "${ready}" -ne 1 ]; then
|
|
echo "docker daemon did not become ready on ${DOCKER_HOST}" >&2
|
|
docker version || true
|
|
exit 1
|
|
fi
|
|
BUILDER_NAME="bstein-builder-${BUILD_NUMBER}"
|
|
docker buildx rm "${BUILDER_NAME}" >/dev/null 2>&1 || true
|
|
docker buildx create --name "${BUILDER_NAME}" --driver docker-container \
|
|
--driver-opt image=moby/buildkit:buildx-stable-1 \
|
|
--bootstrap --use
|
|
docker buildx inspect "${BUILDER_NAME}" --bootstrap
|
|
'''
|
|
}
|
|
}
|
|
}
|
|
|
|
stage('Backend unit tests') {
|
|
steps {
|
|
container('tester') {
|
|
sh '''
|
|
set -euo pipefail
|
|
mkdir -p build
|
|
export PYTHONPATH="${WORKSPACE}/backend:${PYTHONPATH:-}"
|
|
python -m pip install --no-cache-dir -r backend/requirements.txt -r backend/requirements-dev.txt
|
|
python -m pytest backend/tests -q --cov=backend/atlas_portal --cov-report=xml:build/backend-coverage.xml --junitxml=build/junit-backend.xml
|
|
'''
|
|
}
|
|
}
|
|
}
|
|
|
|
stage('Frontend tests') {
|
|
steps {
|
|
container('frontend') {
|
|
sh '''
|
|
set -euo pipefail
|
|
mkdir -p build
|
|
cd frontend
|
|
npm ci
|
|
npm run lint
|
|
npm run test:unit
|
|
npm run test:component
|
|
npm run test:e2e
|
|
'''
|
|
}
|
|
}
|
|
}
|
|
|
|
stage('Run quality gate') {
|
|
steps {
|
|
container('tester') {
|
|
sh '''
|
|
set -euo pipefail
|
|
export PYTHONPATH="${WORKSPACE}:${PYTHONPATH:-}"
|
|
set +e
|
|
python -m testing.ci.quality_gate \
|
|
--backend-coverage build/backend-coverage.xml \
|
|
--frontend-coverage frontend/coverage/coverage-summary.json \
|
|
--report build/quality-gate.json
|
|
gate_rc=$?
|
|
set -e
|
|
printf '%s\n' "${gate_rc}" > build/quality-gate.rc
|
|
'''
|
|
}
|
|
}
|
|
}
|
|
|
|
stage('Publish test metrics') {
|
|
steps {
|
|
container('tester') {
|
|
sh '''
|
|
set -euo pipefail
|
|
gate_rc="$(cat build/quality-gate.rc 2>/dev/null || echo 1)"
|
|
status="ok"
|
|
if [ "${gate_rc}" -ne 0 ]; then
|
|
status="failed"
|
|
fi
|
|
python -m testing.ci.publish_metrics \
|
|
--gateway "${PUSHGATEWAY_URL}" \
|
|
--suite "${SUITE_NAME}" \
|
|
--job platform-quality-ci \
|
|
--status "${status}" \
|
|
--quality-report build/quality-gate.json \
|
|
--junit build/junit-backend.xml build/junit-frontend-unit.xml build/junit-frontend-component.xml build/junit-frontend-e2e.xml
|
|
'''
|
|
}
|
|
}
|
|
}
|
|
|
|
stage('Enforce quality gate') {
|
|
steps {
|
|
container('tester') {
|
|
sh '''
|
|
set -euo pipefail
|
|
test "$(cat build/quality-gate.rc 2>/dev/null || echo 1)" -eq 0
|
|
'''
|
|
}
|
|
}
|
|
}
|
|
|
|
stage('Build & push frontend') {
|
|
steps {
|
|
container('builder') {
|
|
sh '''
|
|
set -euo pipefail
|
|
VERSION_TAG="$(cut -d= -f2 build.env)"
|
|
docker buildx build \
|
|
--platform linux/arm64 \
|
|
--tag "${FRONT_IMAGE}:${VERSION_TAG}" \
|
|
--tag "${FRONT_IMAGE}:latest" \
|
|
--file Dockerfile.frontend \
|
|
--push \
|
|
.
|
|
'''
|
|
}
|
|
}
|
|
}
|
|
|
|
stage('Build & push backend') {
|
|
steps {
|
|
container('builder') {
|
|
sh '''
|
|
set -euo pipefail
|
|
VERSION_TAG="$(cut -d= -f2 build.env)"
|
|
docker buildx build \
|
|
--platform linux/arm64 \
|
|
--tag "${BACK_IMAGE}:${VERSION_TAG}" \
|
|
--tag "${BACK_IMAGE}:latest" \
|
|
--file Dockerfile.backend \
|
|
--push \
|
|
.
|
|
'''
|
|
}
|
|
}
|
|
}
|
|
}
|
|
|
|
post {
|
|
always {
|
|
script {
|
|
def props = fileExists('build.env') ? readProperties(file: 'build.env') : [:]
|
|
echo "Build complete for ${props['SEMVER'] ?: env.VERSION_TAG}"
|
|
}
|
|
archiveArtifacts artifacts: 'build/junit-backend.xml,build/junit-frontend-unit.xml,build/junit-frontend-component.xml,build/junit-frontend-e2e.xml,build/quality-gate.json', allowEmptyArchive: true
|
|
}
|
|
}
|
|
}
|