-
Notifications
You must be signed in to change notification settings - Fork 13
/
Copy pathJenkinsfile
471 lines (430 loc) · 20.5 KB
/
Jenkinsfile
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
/* groovylint-disable CompileStatic, LineLength, VariableTypeRequired */
// This Jenkinsfile defines internal MarkLogic build pipeline.
//Shared library definitions: https://github.com/marklogic/MarkLogic-Build-Libs/tree/1.0-declarative/vars
@Library('[email protected]')
import groovy.json.JsonSlurperClassic
// email list for scheduled builds (includes security vulnerability)
emailList = '[email protected], [email protected], [email protected], [email protected], [email protected]'
// email list for security vulnerabilities only
emailSecList = '[email protected], [email protected]'
gitCredID = 'marklogic-builder-github'
dockerRegistry = 'ml-docker-db-dev-tierpoint.bed-artifactory.bedford.progress.com'
JIRA_ID_PATTERN = /(?i)(MLE)-\d{3,6}/
JIRA_ID = ''
LINT_OUTPUT = ''
SCAN_OUTPUT = ''
IMAGE_SIZE = 0
RPMversion = ''
// Define local funtions
void preBuildCheck() {
// Initialize parameters as env variables as workaround for https://issues.jenkins-ci.org/browse/JENKINS-41929
evaluate """${ def script = ''; params.each { k, v -> script += "env.${k} = '''${v}'''\n" }; return script}"""
JIRA_ID = extractJiraID()
echo 'Jira ticket number: ' + JIRA_ID
if (env.GIT_URL) {
githubAPIUrl = GIT_URL.replace('.git', '').replace('github.com', 'api.github.com/repos')
echo 'githubAPIUrl: ' + githubAPIUrl
} else {
echo 'Warning: GIT_URL is not defined'
}
if (env.CHANGE_ID) {
if (prDraftCheck()) { sh 'exit 1' }
if (getReviewState().equalsIgnoreCase('CHANGES_REQUESTED')) {
echo 'PR changes requested. (' + reviewState + ') Aborting.'
sh 'exit 1'
}
}
}
@NonCPS
def extractJiraID() {
// Extract Jira ID from one of the environment variables
def match
if (env.CHANGE_TITLE) {
match = env.CHANGE_TITLE =~ JIRA_ID_PATTERN
}
else if (env.BRANCH_NAME) {
match = env.BRANCH_NAME =~ JIRA_ID_PATTERN
}
else if (env.GIT_BRANCH) {
match = env.GIT_BRANCH =~ JIRA_ID_PATTERN
}
else {
echo 'Warning: No Git title or branch available.'
return ''
}
try {
return match[0][0]
} catch (any) {
echo 'Warning: Jira ticket number not detected.'
return ''
}
}
def prDraftCheck() {
withCredentials([usernameColonPassword(credentialsId: gitCredID, variable: 'Credentials')]) {
PrObj = sh(returnStdout: true, script:'''
curl -s -u $Credentials -X GET ''' + githubAPIUrl + '''/pulls/$CHANGE_ID
''')
}
def jsonObj = new JsonSlurperClassic().parseText(PrObj.toString().trim())
return jsonObj.draft
}
def getReviewState() {
def reviewResponse
def commitHash
withCredentials([usernameColonPassword(credentialsId: gitCredID, variable: 'Credentials')]) {
reviewResponse = sh(returnStdout: true, script:'''
curl -s -u $Credentials -X GET ''' + githubAPIUrl + '''/pulls/$CHANGE_ID/reviews
''')
commitHash = sh(returnStdout: true, script:'''
curl -s -u $Credentials -X GET ''' + githubAPIUrl + '''/pulls/$CHANGE_ID
''')
}
def jsonObj = new JsonSlurperClassic().parseText(commitHash.toString().trim())
def commitId = jsonObj.head.sha
def reviewState = getReviewStateOfPR reviewResponse, 2, commitId
echo reviewState
return reviewState
}
void resultNotification(message) {
def author, authorEmail, emailList
if (env.CHANGE_AUTHOR) {
author = env.CHANGE_AUTHOR.toString().trim().toLowerCase()
authorEmail = getEmailFromGITUser author
emailList = params.emailList + ',' + authorEmail
} else {
emailList = params.emailList
}
email_body = "<b>Build URL: </b><a href='${env.BUILD_URL}'>${env.BUILD_URL}</a><br/>" +
"<b>Image type: </b>${env.dockerImageType}<br/><br/>" +
"<b>Lint Output: </b><br/>" +
"<pre><code>${LINT_OUTPUT}</code></pre><br/>" +
"<b>Vulnerabilities: </b><pre><code>${SCAN_OUTPUT}</code></pre><br/>" +
"<b><a href='${env.BUILD_URL}artifact/scan/report-${env.dockerImageType}.json'>Full scan report.</a></b><br/>" +
"<b>Image Size: <br/></b>${IMAGE_SIZE} <br/>" +
"<pre><code>docker pull ${dockerRegistry}/${latestTag}</code></pre><br/><br/>"
if (params.DOCKER_TESTS) {
email_body = "${email_body} <b><a href='${env.BUILD_URL}Docker_20Tests_20Report'>Docker Tests Report</a></b><br/>"
} else {
email_body = "${email_body} <b>Docker Tests Skipped</b><br/>"
}
if (params.SCAP_SCAN) {
email_body = "${email_body} <b><a href='${env.BUILD_URL}Open_20SCAP_20Report'>SCAP Scan Report</a></b><br/>"
if ( BRANCH_NAME == 'develop' ) {
emailList = emailList+','+emailSecList
}
} else {
email_body = "${email_body} <b>SCAP Scan Skipped</b><br/>"
}
// If Jira ID is available, add comment to the ticket and add link to email.
if (JIRA_ID) {
def jira_link = "https://progresssoftware.atlassian.net/browse/${JIRA_ID}"
def comment = [ body: "Jenkins pipeline build result: ${message}" ]
jiraAddComment site: 'JIRA',
input: comment,
idOrKey: JIRA_ID,
failOnError: false
email_body = "${email_body} <br/><br/><b>Jira URL: </b><br/><a href='${jira_link}'>${jira_link}</a>"
}
mail to: "${emailList}",
body: "${email_body}",
subject: "${message}: ${env.JOB_NAME} #${env.BUILD_NUMBER}",
charset: 'UTF-8', mimeType: 'text/html'
}
void copyRPMs() {
if (marklogicVersion == "10") {
RPMsuffix = "-nightly"
RPMbranch = "b10"
RPMversion = "10.0"
}
else if (marklogicVersion == "11") {
//if dockerImageType contains "ubi9" then use nightly-rhel9 suffix
if (dockerImageType.contains("ubi9")) {
RPMsuffix = ".nightly-rhel9"
} else {
RPMsuffix = ".nightly-rhel"
}
RPMbranch = "b11"
RPMversion = "11.3"
}
else if (marklogicVersion == "12") {
//if dockerImageType contains "ubi9" then use nightly-rhel9 suffix
if (dockerImageType.contains("ubi9")) {
RPMsuffix = ".nightly-rhel9"
} else {
RPMsuffix = ".nightly-rhel"
}
RPMbranch = "b12"
RPMversion = "12.0"
}
else {
error "Invalid value in marklogicVersion parameter."
}
sh """
cd src
if [ -z ${env.ML_RPM} ]; then
wget --no-verbose https://bed-artifactory.bedford.progress.com:443/artifactory/ml-rpm-tierpoint/${RPMbranch}/server/MarkLogic-${RPMversion}${RPMsuffix}.x86_64.rpm
else
wget --no-verbose ${ML_RPM}
fi
if [ -z ${env.ML_CONVERTERS}]; then
wget --no-verbose https://bed-artifactory.bedford.progress.com:443/artifactory/ml-rpm-tierpoint/${RPMbranch}/converters/MarkLogicConverters-${RPMversion}${RPMsuffix}.x86_64.rpm
else
wget --no-verbose ${ML_CONVERTERS}
fi
"""
script {
// Get the RPM and Converters file names
RPM = sh(returnStdout: true, script: 'cd src;file MarkLogic-*.rpm | cut -d: -f1').trim()
CONVERTERS = sh(returnStdout: true, script: 'cd src;file MarkLogicConverters-*.rpm | cut -d: -f1').trim()
// Extract MarkLogic version from RPM file name
marklogicVersion = sh(returnStdout: true, script: "echo ${RPM}| awk -F \"MarkLogic-\" '{print \$2;}' | awk -F \".x86_64.rpm\" '{print \$1;}' | awk -F \"-rhel\" '{print \$1;}' ").trim()
}
}
void buildDockerImage() {
builtImage="marklogic/marklogic-server-${dockerImageType}:${marklogicVersion}-${env.dockerImageType}-${env.dockerVersion}"
publishImage="marklogic/marklogic-server-${dockerImageType}:${marklogicVersion}-${env.dockerImageType}"
mlVerShort=marklogicVersion.split("\\.")[0]
latestTag="marklogic/marklogic-server-${dockerImageType}:latest-${mlVerShort}"
sh "make build docker_image_type=${dockerImageType} dockerTag=${marklogicVersion}-${env.dockerImageType}-${env.dockerVersion} marklogicVersion=${marklogicVersion} dockerVersion=${env.dockerVersion} build_branch=${env.BRANCH_NAME} package=${RPM} converters=${CONVERTERS}"
currentBuild.displayName = "#${BUILD_NUMBER}: ${marklogicVersion}-${env.dockerImageType} (${env.dockerVersion})"
}
void pullUpgradeDockerImage() {
if (dockerImageType == "ubi-rootless" && params.DOCKER_TESTS != "true") {
sh """
echo 'dockerImageType is set to ubi-rootless, skipping this stage and Docker upgrade test.'
"""
} else {
if (upgradeDockerImage != "" ) {
sh """
echo 'upgradeDockerImage: ${upgradeDockerImage}'
docker pull ${upgradeDockerImage}
"""
} else {
upgradeDockerImage = "${dockerRegistry}/marklogic/marklogic-server-ubi:${marklogicVersion}-ubi-${env.dockerVersion}"
sh """
echo 'upgradeDockerImage is not specified, using ${upgradeDockerImage} for upgrade test.'
docker pull ${dockerRegistry}/marklogic/marklogic-server-ubi:${marklogicVersion}-ubi-${env.dockerVersion}
"""
}
}
}
void structureTests() {
sh """
#install container-structure-test 1.16.0 binary
curl -s -LO https://storage.googleapis.com/container-structure-test/v1.16.0/container-structure-test-linux-amd64 && chmod +x container-structure-test-linux-amd64 && mv container-structure-test-linux-amd64 container-structure-test
make structure-test current_image=marklogic/marklogic-server-${dockerImageType}:${marklogicVersion}-${env.dockerImageType}-${env.dockerVersion} marklogicVersion=${marklogicVersion} dockerVersion=${env.dockerVersion} build_branch=${env.BRANCH_NAME} docker_image_type=${env.dockerImageType} Jenkins=true
"""
}
void dockerTests() {
sh "make docker-tests current_image=marklogic/marklogic-server-${dockerImageType}:${marklogicVersion}-${env.dockerImageType}-${env.dockerVersion} upgrade_image=${upgradeDockerImage} marklogicVersion=${marklogicVersion} build_branch=${env.BRANCH_NAME} dockerVersion=${env.dockerVersion} docker_image_type=${dockerImageType}"
}
void lint() {
IMAGE_SIZE = sh(returnStdout: true, script: "docker images marklogic/marklogic-server-${dockerImageType}:${marklogicVersion}-${env.dockerImageType}-${env.dockerVersion} --format '{{.Repository}}:{{.Tag}}\t{{.Size}}'")
sh """
make lint Jenkins=true
cat start-scripts-lint.txt dockerfile-lint.txt
"""
LINT_OUTPUT = sh(returnStdout: true, script: "echo start-scripts-lint.txt: ;echo; cat start-scripts-lint.txt; echo; echo dockerfile-lint.txt: ; cat dockerfile-lint.txt; echo").trim()
sh """
rm -f start-scripts-lint.txt dockerfile-lint.txt
"""
}
void vulnerabilityScan() {
sh """
make scan current_image=marklogic/marklogic-server-${dockerImageType}:${marklogicVersion}-${env.dockerImageType}-${env.dockerVersion} docker_image_type=${dockerImageType} Jenkins=true
"""
SCAN_OUTPUT = sh(returnStdout: true, script: "cat scan/report-${env.dockerImageType}.txt")
sh 'echo "SCAN_OUTPUT: ${SCAN_OUTPUT}"'
if (SCAN_OUTPUT.size()) {
mail charset: 'UTF-8', mimeType: 'text/html', to: "${emailSecList}", body: "<br/>Jenkins pipeline for ${env.JOB_NAME} <br/>Build Number: ${env.BUILD_NUMBER} <br/>Vulnerabilities: <pre><code>${SCAN_OUTPUT}</code></pre>", subject: "Critical or High Security Vulnerabilities Found: ${env.JOB_NAME} #${env.BUILD_NUMBER}"
}
archiveArtifacts artifacts: 'scan/*', onlyIfSuccessful: true
}
void publishToInternalRegistry() {
withCredentials([usernamePassword(credentialsId: 'builder-credentials-artifactory', passwordVariable: 'docker_password', usernameVariable: 'docker_user')]) {
sh """
echo "${docker_password}" | docker login --username ${docker_user} --password-stdin ${dockerRegistry}
docker tag ${builtImage} ${dockerRegistry}/${builtImage}
docker tag ${builtImage} ${dockerRegistry}/${publishImage}
docker tag ${builtImage} ${dockerRegistry}/${latestTag}
docker push ${dockerRegistry}/${builtImage}
docker push ${dockerRegistry}/${publishImage}
docker push ${dockerRegistry}/${latestTag}
"""
}
// Publish to private ECR repository that is used by the performance team. (only ML11)
if ( params.marklogicVersion == "11" ) {
withCredentials( [[
$class: 'AmazonWebServicesCredentialsBinding',
credentialsId: "aws-engineering-ct-ecr",
accessKeyVariable: 'AWS_ACCESS_KEY_ID',
secretKeyVariable: 'AWS_SECRET_ACCESS_KEY'
]]) {
sh """
aws ecr get-login-password --region us-west-2 | docker login --username AWS --password-stdin 713759029616.dkr.ecr.us-west-2.amazonaws.com
docker tag ${builtImage} 713759029616.dkr.ecr.us-west-2.amazonaws.com/ml-docker-nightly:${marklogicVersion}-${env.dockerImageType}-${env.dockerVersion}
docker tag ${builtImage} 713759029616.dkr.ecr.us-west-2.amazonaws.com/ml-docker-nightly:${marklogicVersion}-${env.dockerImageType}
docker push 713759029616.dkr.ecr.us-west-2.amazonaws.com/ml-docker-nightly:${marklogicVersion}-${env.dockerImageType}-${env.dockerVersion}
docker push 713759029616.dkr.ecr.us-west-2.amazonaws.com/ml-docker-nightly:${marklogicVersion}-${env.dockerImageType}
"""
}
}
currentBuild.description = "Published"
}
void publishTestResults() {
junit allowEmptyResults:true, testResults: '**/test_results/docker-tests.xml,**/container-structure-test.xml'
if (params.DOCKER_TESTS) {
echo 'Publishing Docker results..'
publishHTML allowMissing: false,
alwaysLinkToLastBuild: true,
keepAll: true,
reportDir: 'test/test_results',
reportFiles: 'report.html',
reportName: 'Docker Tests Report',
reportTitles: "Build ${env.BUILD_NUMBER}"
}
if (params.SCAP_SCAN) {
echo 'Publishing SCAP scan results..'
publishHTML allowMissing: false,
alwaysLinkToLastBuild: true,
keepAll: true, reportDir: 'scap',
reportFiles: 'scap_scan_report.html',
reportName: 'Open SCAP Report',
reportTitles: "Build ${env.BUILD_NUMBER}"
}
}
void scapScan() {
sh """
make scap-scan current_image=marklogic/marklogic-server-${dockerImageType}:${marklogicVersion}-${env.dockerImageType}-${env.dockerVersion}
"""
}
pipeline {
agent {
label {
label 'cld-docker'
}
}
options {
checkoutToSubdirectory '.'
buildDiscarder logRotator(artifactDaysToKeepStr: '7', artifactNumToKeepStr: '', daysToKeepStr: '30', numToKeepStr: '')
skipStagesAfterUnstable()
}
triggers {
parameterizedCron( env.BRANCH_NAME == 'develop' ? '''00 02 * * * % marklogicVersion=10;dockerImageType=ubi
00 02 * * * % marklogicVersion=10;dockerImageType=ubi-rootless;SCAP_SCAN=true
00 02 * * * % marklogicVersion=11;dockerImageType=ubi
30 02 * * * % marklogicVersion=11;dockerImageType=ubi-rootless;SCAP_SCAN=true
30 02 * * * % marklogicVersion=12;dockerImageType=ubi
30 02 * * * % marklogicVersion=12;dockerImageType=ubi-rootless;SCAP_SCAN=true
00 03 * * * % marklogicVersion=11;dockerImageType=ubi9
00 03 * * * % marklogicVersion=11;dockerImageType=ubi9-rootless;SCAP_SCAN=true
00 03 * * * % marklogicVersion=12;dockerImageType=ubi9
00 03 * * * % marklogicVersion=12;dockerImageType=ubi9-rootless;SCAP_SCAN=true''' : '')
}
environment {
QA_LICENSE_KEY = credentials('QA_LICENSE_KEY')
}
parameters {
string(name: 'emailList', defaultValue: emailList, description: 'List of email for build notification', trim: true)
string(name: 'dockerVersion', defaultValue: '2.1.0', description: 'ML Docker version. This version along with ML rpm package version will be the image tag as {ML_Version}_{dockerVersion}', trim: true)
choice(name: 'dockerImageType', choices: 'ubi-rootless\nubi\nubi9-rootless\nubi9', description: 'Platform type for Docker image. Will be made part of the docker image tag')
string(name: 'upgradeDockerImage', defaultValue: '', description: 'Docker image for testing upgrades. Defaults to ubi image if left blank.\n Currently upgrading to ubi-rotless is not supported hence the test is skipped when ubi-rootless image is provided.', trim: true)
choice(name: 'marklogicVersion', choices: '11\n12\n10', description: 'MarkLogic Server Branch. used to pick appropriate rpm')
string(name: 'ML_RPM', defaultValue: '', description: 'URL for RPM to be used for Image creation. \n If left blank nightly ML rpm will be used.\n Please provide Jenkins accessible path e.g. /project/engineering or /project/qa', trim: true)
string(name: 'ML_CONVERTERS', defaultValue: '', description: 'URL for the converters RPM to be included in the image creation \n If left blank the nightly ML Converters Package will be used.', trim: true)
booleanParam(name: 'PUBLISH_IMAGE', defaultValue: false, description: 'Publish image to internal registry')
booleanParam(name: 'TEST_STRUCTURE', defaultValue: true, description: 'Run container structure tests')
booleanParam(name: 'DOCKER_TESTS', defaultValue: true, description: 'Run docker tests')
booleanParam(name: 'SCAP_SCAN', defaultValue: false, description: 'Run Open SCAP scan on the image.')
}
stages {
stage('Pre-Build-Check') {
steps {
preBuildCheck()
}
}
stage('Copy-RPMs') {
steps {
copyRPMs()
}
}
stage('Build-Image') {
steps {
buildDockerImage()
}
}
stage('Pull-Upgrade-Image') {
steps {
pullUpgradeDockerImage()
}
}
stage('Lint') {
steps {
lint()
}
}
stage('Scan') {
steps {
vulnerabilityScan()
}
}
stage('SCAP-Scan') {
when {
expression { return params.SCAP_SCAN }
}
steps {
scapScan()
}
}
stage('Structure-Tests') {
when {
expression { return params.TEST_STRUCTURE }
}
steps {
structureTests()
}
}
stage('Docker-Run-Tests') {
when {
expression { return params.DOCKER_TESTS }
}
steps {
dockerTests()
}
}
stage('Publish-Image') {
when {
anyOf {
branch 'develop'
expression { return params.PUBLISH_IMAGE }
}
}
steps {
publishToInternalRegistry()
build job: 'MarkLogic-Docker-Kubernetes/docker/docker-nightly-builds-qa', wait: false, parameters: [string(name: 'dockerImageType', value: "${dockerImageType}"), string(name: 'marklogicVersion', value: "${RPMversion}")]
}
}
}
post {
always {
sh '''
cd src
rm -rf *.rpm NOTICE.txt
docker stop $(docker ps -a -q) || true
docker system prune --force --all
docker volume prune --force --all
docker system df
'''
publishTestResults()
}
success {
resultNotification('BUILD SUCCESS ✅')
}
failure {
resultNotification('BUILD ERROR ❌')
}
unstable {
resultNotification('BUILD UNSTABLE ❌')
}
}
}