atlas-iac/ci/Jenkinsfile.hermes-agent-image

pipeline {
  agent {
    kubernetes {
      defaultContainer 'python'
      yaml """
apiVersion: v1
kind: Pod
metadata:
  labels:
    atlas.bstein.dev/workload: hermes-agent-image-builder
spec:
  automountServiceAccountToken: false
  enableServiceLinks: false
  restartPolicy: Never
  securityContext:
    fsGroup: 1000
    fsGroupChangePolicy: OnRootMismatch
  nodeSelector:
    kubernetes.io/arch: arm64
    node-role.kubernetes.io/worker: "true"
    hardware: rpi5
  affinity:
    nodeAffinity:
      requiredDuringSchedulingIgnoredDuringExecution:
        nodeSelectorTerms:
          - matchExpressions:
              - key: kubernetes.io/hostname
                operator: NotIn
                values:
                  - titan-04
                  - titan-14
                  - titan-18
                  - titan-19
                  - titan-22
                  - titan-24
  imagePullSecrets:
    - name: harbor-bstein-robot
  containers:
    - name: jnlp
      image: jenkins/inbound-agent@sha256:8eda4fe2a66bcf6a5e43436d9918fc14c306204dc8fcd75f4e15e0e6e5dc759a
      securityContext:
        allowPrivilegeEscalation: false
        capabilities:
          drop: ["ALL"]
        runAsNonRoot: true
        runAsUser: 1000
        seccompProfile:
          type: RuntimeDefault
      resources:
        requests:
          cpu: 25m
          memory: 256Mi
        limits:
          cpu: 500m
          memory: 512Mi
    - name: python
      image: registry.bstein.dev/bstein/python@sha256:269541d3387baae008df4608ead893dba2b5cdaad1a5a380731a88992d34b808
      command: ["sleep"]
      args: ["99d"]
      tty: true
      securityContext:
        allowPrivilegeEscalation: false
        capabilities:
          drop: ["ALL"]
        runAsNonRoot: true
        runAsUser: 1000
        seccompProfile:
          type: RuntimeDefault
      resources:
        requests:
          cpu: 25m
          memory: 64Mi
        limits:
          cpu: 250m
          memory: 256Mi
    - name: kaniko
      image: gcr.io/kaniko-project/executor@sha256:c3109d5926a997b100c4343944e06c6b30a6804b2f9abe0994d3de6ef92b028e
      command: ["/busybox/sh", "-c"]
      args: ["/busybox/sleep 99d"]
      tty: true
      securityContext:
        allowPrivilegeEscalation: false
        capabilities:
          drop: ["ALL"]
        privileged: false
        runAsUser: 0
        seccompProfile:
          type: RuntimeDefault
      resources:
        requests:
          cpu: 250m
          memory: 1Gi
        limits:
          cpu: "2"
          memory: 4Gi
"""
    }
  }
  parameters {
    booleanParam(
      name: 'PUBLISH_IMAGE',
      defaultValue: false,
      description: 'Publish the reviewed main revision to Harbor.'
    )
    string(
      name: 'EXPECTED_SOURCE_REVISION',
      defaultValue: '',
      description: 'Exact 40-character commit on atlas/titan-iac main.'
    )
    string(
      name: 'CONFIRM_PUBLISH',
      defaultValue: '',
      description: 'Enter PUBLISH HERMES AGENT to confirm the release.'
    )
  }
  environment {
    HERMES_IMAGE = 'registry.bstein.dev/bstein/hermes-agent'
  }
  options {
    disableConcurrentBuilds()
    buildDiscarder(logRotator(daysToKeepStr: '30', numToKeepStr: '100', artifactDaysToKeepStr: '30', artifactNumToKeepStr: '100'))
    skipDefaultCheckout(true)
    timeout(time: 90, unit: 'MINUTES')
  }
  stages {
    stage('Checkout reviewed source') {
      steps {
        checkout scm
      }
    }
    stage('Enforce release boundary') {
      steps {
        sh '''
          set -eu
          mkdir -p build
          test "${PUBLISH_IMAGE}" = "true"
          test "${CONFIRM_PUBLISH}" = "PUBLISH HERMES AGENT"
          case "${EXPECTED_SOURCE_REVISION}" in
            *[!0-9a-f]*|'')
              echo "EXPECTED_SOURCE_REVISION must be a lowercase full commit" >&2
              exit 2
              ;;
          esac
          test "${#EXPECTED_SOURCE_REVISION}" -eq 40
          actual_revision="$(git rev-parse HEAD)"
          test "${actual_revision}" = "${EXPECTED_SOURCE_REVISION}"
          test "${actual_revision}" = "$(git rev-parse origin/main)"
          test -z "$(git status --porcelain)"
          test -f dockerfiles/Dockerfile.hermes-agent
          printf '%s\n' "${HERMES_IMAGE}:git-${actual_revision}" > build/hermes-agent.destination
        '''
      }
    }
    stage('Build and publish without a daemon') {
      steps {
        container('kaniko') {
          withCredentials([usernamePassword(
            credentialsId: 'harbor-robot',
            usernameVariable: 'HARBOR_USER',
            passwordVariable: 'HARBOR_PASSWORD'
          )]) {
            sh '''#!/busybox/sh
              set -eu
              set +x
              config_path=/kaniko/.docker/config.json
              destination="$(cat build/hermes-agent.destination)"
              umask 077
              auth="$(printf '%s:%s' "${HARBOR_USER}" "${HARBOR_PASSWORD}" | /busybox/base64 | /busybox/tr -d '\n')"
              /busybox/mkdir -p /kaniko/.docker
              /busybox/printf '{"auths":{"registry.bstein.dev":{"auth":"%s"}}}\n' "${auth}" > "${config_path}"
              unset HARBOR_USER HARBOR_PASSWORD auth
              trap '/busybox/rm -f "${config_path}"' EXIT HUP INT TERM
              /kaniko/executor \
                --context="dir://${WORKSPACE}" \
                --dockerfile="${WORKSPACE}/dockerfiles/Dockerfile.hermes-agent" \
                --destination="${destination}" \
                --digest-file="${WORKSPACE}/build/hermes-agent.digest" \
                --image-name-with-digest-file="${WORKSPACE}/build/hermes-agent.image" \
                --label="org.opencontainers.image.revision=${EXPECTED_SOURCE_REVISION}" \
                --cleanup \
                --push-retry=3
            '''
          }
        }
      }
    }
    stage('Render reviewed Flux handoff') {
      steps {
        sh '''
          set -eu
          destination="$(cat build/hermes-agent.destination)"
          python3 ci/scripts/hermes_image_release.py \
            --digest-file build/hermes-agent.digest \
            --source-revision "${EXPECTED_SOURCE_REVISION}" \
            --destination "${destination}" \
            --kustomization services/hermes/kustomization.yaml \
            --output-dir build/hermes-agent-release
          test -s build/hermes-agent-release/hermes-image-update.patch
          test -s build/hermes-agent-release/hermes-agent-image.json
        '''
      }
    }
  }
  post {
    always {
      archiveArtifacts(
        artifacts: 'build/hermes-agent.digest,build/hermes-agent.image,build/hermes-agent.destination,build/hermes-agent-release/**',
        allowEmptyArchive: true,
        fingerprint: true
      )
    }
    cleanup {
      container('kaniko') {
        sh '''#!/busybox/sh
          /busybox/rm -f /kaniko/.docker/config.json
        '''
      }
    }
  }
}