Jenkinsfile.dev

// Switch to using https://github.com/BCDevOps/jenkins-pipeline-shared-lib when stable.
@NonCPS
import groovy.json.JsonOutput
/*
 * Sends a slack notification
 */
def notifySlack(text, url, channel, attachments) {
    def slackURL = url
    def jenkinsIcon = 'https://wiki.jenkins-ci.org/download/attachments/2916393/logo.png'
    def payload = JsonOutput.toJson([
      text: text,
      channel: channel,
      username: "Jenkins",
      icon_url: jenkinsIcon,
      attachments: attachments
    ])
    def encodedReq = URLEncoder.encode(payload, "UTF-8")
    sh("curl -s -S -X POST --data \'payload=${encodedReq}\' ${slackURL}")
}

/*
 * Sends a rocket chat notification
 */
def notifyRocketChat(text, url) {
    def rocketChatURL = url
    def payload = JsonOutput.toJson([
      "username":"Jenkins",
      "icon_url":"https://wiki.jenkins.io/download/attachments/2916393/headshot.png",
      "text": text
    ])

    sh("curl -X POST -H 'Content-Type: application/json' --data \'${payload}\' ${rocketChatURL}")
}

/*
 * Updates the global pastBuilds array: it will iterate recursively
 * and add all the builds prior to the current one that had a result
 * different than 'SUCCESS'.
 */
def buildsSinceLastSuccess(previousBuild, build) {
  if ((build != null) && (build.result != 'SUCCESS')) {
    pastBuilds.add(build)
    buildsSinceLastSuccess(pastBuilds, build.getPreviousBuild())
   }
}

/*
 * Generates a string containing all the commit messages from
 * the builds in pastBuilds.
 */
@NonCPS
def getChangeLog(pastBuilds) {
  def log = ""
  for (int x = 0; x < pastBuilds.size(); x++) {
    for (int i = 0; i < pastBuilds[x].changeSets.size(); i++) {
      def entries = pastBuilds[x].changeSets[i].items
      for (int j = 0; j < entries.length; j++) {
        def entry = entries[j]
        log += "* ${entry.msg} by ${entry.author} \n"
      }
    }
  }
  return log;
}

def CHANGELOG = "No new changes"
def IMAGE_HASH = "latest"

// def unitTestPodLabel = "eao-unittest-${UUID.randomUUID().toString()}"
// podTemplate(label: unitTestPodLabel, name: unitTestPodLabel, serviceAccount: 'jenkins', cloud: 'openshift', containers: [
//   containerTemplate(
//     name: 'jnlp',
//     image: '172.50.0.2:5000/openshift/jenkins-slave-bddstack',
//     resourceRequestCpu: '500m',
//     resourceLimitCpu: '1000m',
//     resourceRequestMemory: '1Gi',
//     resourceLimitMemory: '4Gi',
//     workingDir: '/home/jenkins',
//     command: '',
//     args: '${computer.jnlpmac} ${computer.name}'
//   )
// ])
// {
//   stage('Unit Test on Dev') {
//     node(unitTestPodLabel) {
//       echo "checking out source"
//       echo "Build: ${BUILD_ID}"
//       checkout scm
//       try {
//         sh 'yarn install'
//         sh 'npm test'
//       } finally {
//         archiveArtifacts allowEmptyArchive: true, artifacts: 'build/coverage/src/**/*'
//         publishHTML (target: [
//                     allowMissing: false,
//                     alwaysLinkToLastBuild: false,
//                     keepAll: true,
//                     reportDir: 'build/coverage/src',
//                     reportFiles: 'index.html',
//                     reportName: "Unit Test Coverage Report"
//                   ])
//       }
//     }
//   }
// }

node('master') {
  /*
   * Extract secrets and create relevant environment variables.
   * The contents of the secret are extracted in as many files as the keys contained in the secret.
   * The files are named as the key, and contain the corresponding value.
   */
  sh("oc extract secret/slack-secrets --to=${env.WORKSPACE} --confirm")
  SLACK_HOOK = sh(script: "cat webhook", returnStdout: true)
  DEV_CHANNEL = sh(script: "cat dev-channel", returnStdout: true)

  withEnv(["SLACK_HOOK=${SLACK_HOOK}", "DEV_CHANNEL=${DEV_CHANNEL}"]){
    stage('Build'){
      // isolate last successful builds and then get the changelog
      pastBuilds = []
      buildsSinceLastSuccess(pastBuilds, currentBuild);
      CHANGELOG = getChangeLog(pastBuilds);

      echo ">>>>>>Changelog: \n ${CHANGELOG}"

      try {
        echo "Building: eao-public-angular-dev"
        openshiftBuild bldCfg: 'eao-public-angular-dev', showBuildLogs: 'true'
        echo "Build done"

        echo "Building: eao-public-dev"
        openshiftBuild bldCfg: 'eao-public-dev', showBuildLogs: 'true'
        echo "Build done"

        echo ">>> Get Image Hash"
        // Don't tag with BUILD_ID so the pruner can do it's job; it won't delete tagged images.
        // Tag the images for deployment based on the image's hash
        IMAGE_HASH = sh (
        script: """oc get istag eao-public-dev:latest -o template --template=\"{{.image.dockerImageReference}}\"|awk -F \":\" \'{print \$3}\'""",
        returnStdout: true).trim()
        echo ">> IMAGE_HASH: ${IMAGE_HASH}"
      } catch (error) {
        notifySlack(
          "The latest eao-public-dev build seems to have broken\n'${error.message}'",
          SLACK_HOOK,
          DEV_CHANNEL,
          []
        )
        throw error
      }
    }
  }
}

def sonarqubePodLabel = "eao-sonar-${UUID.randomUUID().toString()}"
podTemplate(label: sonarqubePodLabel, name: sonarqubePodLabel, serviceAccount: 'jenkins', cloud: 'openshift', containers: [
  containerTemplate(
    name: 'jnlp',
    image: 'registry.access.redhat.com/openshift3/jenkins-slave-maven-rhel7',
    resourceRequestCpu: '500m',
    resourceLimitCpu: '1000m',
    resourceRequestMemory: '1Gi',
    resourceLimitMemory: '4Gi',
    workingDir: '/tmp',
    command: '',
    args: '${computer.jnlpmac} ${computer.name}',
    envVars: [
        secretEnvVar(key: 'SONARQUBE_URL', secretName: 'sonarqube-secrets', secretKey: 'url')
    ]
  )
])
{
  stage('Code Quality Check') {
    node(sonarqubePodLabel){
      //the checkout is mandatory, otherwise code quality check would fail
      echo "checking out source"
      echo "Build: ${BUILD_ID}"
      checkout scm
        echo "SONARQUBE_URL: ${SONARQUBE_URL}"
      dir('sonar-runner') {
        try {
          sh returnStdout: true, script: "./gradlew sonarqube -Dsonar.host.url=${SONARQUBE_URL} -Dsonar.verbose=true --stacktrace --info"
        } finally { }
      }
    }
  }
}

node('master'){
  /*
  * Extract secrets and create relevant environment variables.
  * The contents of the secret are extracted in as many files as the keys contained in the secret.
  * The files are named as the key, and contain the corresponding value.
  */
  sh("oc extract secret/slack-secrets --to=${env.WORKSPACE} --confirm")
  SLACK_HOOK = sh(script: "cat webhook", returnStdout: true)
  DEPLOY_CHANNEL = sh(script: "cat deploy-channel", returnStdout: true)
  sh("oc extract secret/rocket-chat-secrets --to=${env.WORKSPACE} --confirm")
  ROCKET_DEPLOY_WEBHOOK = sh(script: "cat rocket-deploy-webhook", returnStdout: true)

  withEnv(["SLACK_HOOK=${SLACK_HOOK}", "DEPLOY_CHANNEL=${DEPLOY_CHANNEL}", "ROCKET_DEPLOY_WEBHOOK=${ROCKET_DEPLOY_WEBHOOK}"]){
    stage('Deploy to Dev'){
      try {
        echo "Deploying to dev..."
        openshiftTag destStream: 'eao-public-dev', verbose: 'false', destTag: 'dev', srcStream: 'eao-public-dev', srcTag: "${IMAGE_HASH}"
        sleep 5
        openshiftVerifyDeployment depCfg: 'eao-public', namespace: 'esm-dev', replicaCount: 1, verbose: 'false', verifyReplicaCount: 'false', waitTime: 600000
        echo ">>>> Deployment Complete"

        notifyRocketChat(
          "A new version of eao-public-dev is now in Dev. \n Changes: \n ${CHANGELOG}",
          ROCKET_DEPLOY_WEBHOOK
        )

        notifySlack(
          "A new version of eao-public-dev is now in Dev. \n Changes: \n ${CHANGELOG}",
          SLACK_HOOK,
          DEPLOY_CHANNEL,
          []
        )
      } catch (error) {
        notifyRocketChat(
          "The latest deployment of eao-public-dev to Dev seems to have failed\n'${error.message}'",
          ROCKET_DEPLOY_WEBHOOK
        )

        notifySlack(
          "The latest deployment of eao-public-dev to Dev seems to have failed\n'${error.message}'",
          SLACK_HOOK,
          DEPLOY_CHANNEL,
          []
        )
      }
    }
  }
}

def bddPodLabel = "eao-bdd-${UUID.randomUUID().toString()}"
podTemplate(label: bddPodLabel, name: bddPodLabel, serviceAccount: 'jenkins', cloud: 'openshift', containers: [
  containerTemplate(
    name: 'jnlp',
    image: 'docker-registry.default.svc:5000/bcgov/jenkins-slave-bddstack:v1-stable',
    resourceRequestCpu: '500m',
    resourceLimitCpu: '1000m',
    resourceRequestMemory: '1Gi',
    resourceLimitMemory: '4Gi',
    workingDir: '/home/jenkins',
    command: '',
    args: '${computer.jnlpmac} ${computer.name}'
  )
])
{
  stage('FT on Dev') {
    node(bddPodLabel) {
      //the checkout is mandatory, otherwise functional test would fail
      echo "checking out source"
      echo "Build: ${BUILD_ID}"
      checkout scm
      dir('functional-tests') {
        try {
          sh './gradlew chromeHeadlessTest'
        } finally {
          archiveArtifacts allowEmptyArchive: true, artifacts: 'build/reports/geb/**/*'
          junit 'build/test-results/**/*.xml'
          publishHTML (target: [
                      allowMissing: false,
                      alwaysLinkToLastBuild: false,
                      keepAll: true,
                      reportDir: 'build/reports/spock',
                      reportFiles: 'index.html',
                      reportName: "BDD Spock Report"
                    ])
          publishHTML (target: [
                      allowMissing: false,
                      alwaysLinkToLastBuild: false,
                      keepAll: true,
                      reportDir: 'build/reports/tests/chromeHeadlessTest',
                      reportFiles: 'index.html',
                      reportName: "Full Test Report"
                    ])
          perfReport compareBuildPrevious: true, excludeResponseTime: true, ignoreFailedBuilds: true, ignoreUnstableBuilds: true, modeEvaluation: true, modePerformancePerTestCase: true, percentiles: '0,50,90,100', relativeFailedThresholdNegative: 80.0, relativeFailedThresholdPositive: 20.0, relativeUnstableThresholdNegative: 50.0, relativeUnstableThresholdPositive: 50.0, sourceDataFiles: 'build/test-results/**/*.xml'
        }
      }
    }
  }
}

def zapPodLabel = "eao-owasp-zap-${UUID.randomUUID().toString()}"
podTemplate(label: zapPodLabel, name: zapPodLabel, serviceAccount: 'jenkins', cloud: 'openshift', containers: [
  containerTemplate(
    name: 'jnlp',
    image: '172.50.0.2:5000/openshift/jenkins-slave-zap',
    resourceRequestCpu: '500m',
    resourceLimitCpu: '1000m',
    resourceRequestMemory: '3Gi',
    resourceLimitMemory: '4Gi',
    workingDir: '/home/jenkins',
    command: '',
    args: '${computer.jnlpmac} ${computer.name}'
  )
])
{
  stage('ZAP Security Scan') {
    node(zapPodLabel) {
      //the checkout is mandatory
      echo "checking out source"
      echo "Build: ${BUILD_ID}"
      checkout scm
      dir('zap') {
        def retVal = sh returnStatus: true, script: './runzap.sh'
        publishHTML([allowMissing: false, alwaysLinkToLastBuild: false, keepAll: true, reportDir: '/zap/wrk', reportFiles: 'index.html', reportName: 'ZAP Full Scan', reportTitles: 'ZAP Full Scan'])
        echo "Return value is: ${retVal}"
      }
    }
  }
}