ci: keep quality report handling in its own script

Jenkinsfile

@@ -1,18 +1,25 @@
 pipeline {
   agent {
     kubernetes {
+      // Keep build I/O off the node's runtime USB drive.
+      workspaceVolume dynamicPVC(accessModes: 'ReadWriteOnce', requestsSize: '20Gi', storageClassName: 'ci-scratch')
       defaultContainer 'go-tester'
       yaml """
 apiVersion: v1
 kind: Pod
 spec:
+  securityContext:
+    fsGroup: 1000
+    fsGroupChangePolicy: OnRootMismatch
   nodeSelector: {kubernetes.io/arch: arm64, node-role.kubernetes.io/worker: "true"}
   affinity:
     nodeAffinity:
       requiredDuringSchedulingIgnoredDuringExecution:
         nodeSelectorTerms:
           - matchExpressions:
-              - {key: kubernetes.io/hostname, operator: NotIn, values: [titan-06]}
+              - {key: hardware, operator: In, values: [rpi5, rpi4]}
+              - {key: node-role.kubernetes.io/worker, operator: In, values: ["true"]}
+              - {key: kubernetes.io/hostname, operator: NotIn, values: [titan-04, titan-05, titan-06, titan-08, titan-11, titan-12, titan-13, titan-14, titan-15, titan-17, titan-18, titan-19]}
       preferredDuringSchedulingIgnoredDuringExecution:
         - weight: 100
           preference:
@@ -44,11 +51,17 @@ spec:
       command: ["cat"]
       tty: true
       volumeMounts: [{name: workspace-volume, mountPath: /home/jenkins/agent}]
-  volumes: [{name: workspace-volume, emptyDir: {}}]
 """
     }
   }
   environment {
+    PIP_CACHE_DIR = '/home/jenkins/agent/.cache/pip'
+    NPM_CONFIG_CACHE = '/home/jenkins/agent/.cache/npm'
+    SONAR_USER_HOME = '/home/jenkins/agent/.cache/sonar'
+    TMPDIR = '/home/jenkins/agent/.cache/tmp'
+    GOCACHE = '/home/jenkins/agent/.cache/go-build'
+    GOMODCACHE = '/home/jenkins/agent/.cache/go-mod'
+    GOTMPDIR = '/home/jenkins/agent/.cache/go-tmp'
     SUITE_NAME = 'pegasus'
     PUSHGATEWAY_URL = 'http://platform-quality-gateway.monitoring.svc.cluster.local:9091'
     SONARQUBE_HOST_URL = 'http://sonarqube.quality.svc.cluster.local:9000'
@@ -68,6 +81,11 @@ spec:
     pollSCM('H/5 * * * *')
   }
   stages {
+    stage('Prepare build scratch') {
+      steps {
+        sh 'mkdir -p /home/jenkins/agent/.cache/tmp /home/jenkins/agent/.cache/go-tmp'
+      }
+    }
     stage('Checkout') {
       steps {
         checkout scm
@@ -302,52 +320,8 @@ EOF
     stage('Run quality gate') {
       steps {
         container('publisher') {
-          sh '''
-            set -eu
-            mkdir -p build
-            set +e
-            apt-get update
-            apt_rc=$?
-            if [ "${apt_rc}" -eq 0 ]; then
-              apt-get install -y --no-install-recommends golang-go nodejs npm
-              apt_rc=$?
-            fi
-            if [ "${apt_rc}" -eq 0 ]; then
-              python -m testing.pegasus_gate report
-              gate_rc=$?
-            else
-              gate_rc="${apt_rc}"
-            fi
-            set -e
-            if [ ! -f build/gate-summary.json ]; then
-              python3 - <<'PY'
-import json
-from pathlib import Path
-Path("build/gate-summary.json").write_text(
-    json.dumps(
-        {
-            "ok": False,
-            "issues": [
-                {
-                    "check": "gate_glue",
-                    "path": "Jenkinsfile",
-                    "detail": "quality gate dependencies or report command failed before summary generation",
-                }
-            ],
-            "file_count": 0,
-            "backend_coverage": {},
-            "frontend_coverage": {},
-        },
-        indent=2,
-        sort_keys=True,
-    )
-    + "\\n",
-    encoding="utf-8",
-)
-PY
-            fi
-            printf '%s\n' "${gate_rc}" > build/quality-report.rc
-          '''
+          sh 'sh scripts/report_quality_gate.sh'
+
         }
       }
     }

scripts/report_quality_gate.sh

@@ -0,0 +1,46 @@
+#!/bin/sh
+# Generate a gate report, including an explicit failure if tooling cannot start.
+set -eu
+mkdir -p build
+set +e
+apt-get update
+apt_rc=$?
+if [ "${apt_rc}" -eq 0 ]; then
+  apt-get install -y --no-install-recommends golang-go nodejs npm
+  apt_rc=$?
+fi
+if [ "${apt_rc}" -eq 0 ]; then
+  python -m testing.pegasus_gate report
+  gate_rc=$?
+else
+  gate_rc="${apt_rc}"
+fi
+set -e
+if [ ! -f build/gate-summary.json ]; then
+  python3 - <<'PY'
+import json
+from pathlib import Path
+Path("build/gate-summary.json").write_text(
+    json.dumps(
+        {
+"ok": False,
+"issues": [
+    {
+        "check": "gate_glue",
+        "path": "Jenkinsfile",
+        "detail": "quality gate dependencies or report command failed before summary generation",
+    }
+],
+"file_count": 0,
+"backend_coverage": {},
+"frontend_coverage": {},
+        },
+        indent=2,
+        sort_keys=True,
+    )
+    + "\n",
+    encoding="utf-8",
+)
+PY
+fi
+printf '%s\n' "${gate_rc}" > build/quality-report.rc