ci(jenkins): add multibranch quality gate

ci/Jenkinsfile.titan-iac

@@ -22,7 +22,6 @@ spec:
   environment {
     PIP_DISABLE_PIP_VERSION_CHECK = '1'
     PYTHONUNBUFFERED = '1'
-    DEPLOY_BRANCH = 'deploy'
   }
   stages {
     stage('Checkout') {
@@ -40,7 +39,27 @@ spec:
         sh 'pytest -q ci/tests/glue'
       }
     }
+    stage('Resolve Flux branch') {
+      steps {
+        script {
+          env.FLUX_BRANCH = sh(
+            returnStdout: true,
+            script: "awk '/branch:/{print $2; exit}' clusters/atlas/flux-system/gotk-sync.yaml"
+          ).trim()
+          if (!env.FLUX_BRANCH) {
+            error('Flux branch not found in gotk-sync.yaml')
+          }
+          echo "Flux branch: ${env.FLUX_BRANCH}"
+        }
+      }
+    }
     stage('Promote') {
+      when {
+        expression {
+          def branch = env.BRANCH_NAME ?: (env.GIT_BRANCH ?: '').replaceFirst('origin/', '')
+          return env.FLUX_BRANCH && branch == env.FLUX_BRANCH
+        }
+      }
       steps {
         withCredentials([usernamePassword(credentialsId: 'gitea-pat', usernameVariable: 'GIT_USER', passwordVariable: 'GIT_TOKEN')]) {
           sh '''
@@ -48,7 +67,7 @@ spec:
             git config user.email "jenkins@bstein.dev"
             git config user.name "jenkins"
             git remote set-url origin https://${GIT_USER}:${GIT_TOKEN}@scm.bstein.dev/bstein/titan-iac.git
-            git push origin HEAD:${DEPLOY_BRANCH}
+            git push origin HEAD:${FLUX_BRANCH}
           '''
         }
       }

services/jenkins/configmap-jcasc.yaml

@@ -139,24 +139,33 @@ data:
               }
             }
           }
-          pipelineJob('titan-iac-quality-gate') {
-            triggers {
-              scm('H/5 * * * *')
-            }
-            definition {
-              cpsScm {
-                scm {
+          multibranchPipelineJob('titan-iac-quality-gate') {
+            branchSources {
+              branchSource {
+                source {
                   git {
-                    remote {
-                      url('https://scm.bstein.dev/bstein/titan-iac.git')
-                      credentials('gitea-pat')
-                    }
-                    branches('*/feature/ariadne')
+                    id('titan-iac-quality-gate')
+                    remote('https://scm.bstein.dev/bstein/titan-iac.git')
+                    credentialsId('gitea-pat')
                   }
                 }
+              }
+            }
+            factory {
+              workflowBranchProjectFactory {
                 scriptPath('ci/Jenkinsfile.titan-iac')
               }
             }
+            orphanedItemStrategy {
+              discardOldItems {
+                numToKeep(30)
+              }
+            }
+            triggers {
+              periodicFolderTrigger {
+                interval('12h')
+              }
+            }
           }
   base.yaml: |
     jenkins:

services/jenkins/configmap-plugins.yaml

@@ -9,6 +9,7 @@ data:
     kubernetes
     workflow-aggregator
     git
+    git-branch-source
     pipeline-utility-steps
     configuration-as-code
     configuration-as-code-support

services/maintenance/kustomization.yaml

@@ -26,7 +26,7 @@ resources:
 
 images:
   - name: registry.bstein.dev/bstein/ariadne
-    newTag: 0.1.0-4 # {"$imagepolicy": "maintenance:ariadne"}
+    newTag: 0.1.0-5 # {"$imagepolicy": "maintenance:ariadne"}
 
 configMapGenerator:
   - name: disable-k3s-traefik-script