release-pipeline.jenkins

// SPDX-License-Identifier: MIT

// Release pipeline script for jenkins
// Only the master branch is built by this script - the other branches are built by "continous-integration-multibranch-pipeline.jenkins"
// For details please refer to /sechub-doc/src/docs/asciidoc/documents/buildserver/jenkins-pipeline.adoc

def context = new SecHubBuildContext();
def sechubGitBranch ="unknown"

pipeline {
    agent any

    environment {
        SECHUB_TRUSTALL= "true" // necessary for integration tests
        SECHUB_BUILD_USE_TMP_CACHE ="true" // we use temporary cache, so always clean and timestamps in tests are always correct
    }

    stages {

         stage('Initialize') {
             steps {
               script{
                    sechubGitBranch = sh(returnStdout: true, script: "git branch").trim()
                    echo "Branch is $sechubGitBranch"

                    def sechubGitTagsArray = sh(returnStdout: true, script: "git tag -l --contains HEAD").split()
                    echo "HEAD has following tags: $sechubGitTagsArray"
                    echo "WORKSPACE is ${env.WORKSPACE}"

                    context.init(sechubGitTagsArray)

                    echo "RELEASE info: "+context.getReleaseInfo()

                    if (context.isAnyRelease()){
                        releaseInfo = context.getReleaseInfo()
                        emailext (
                            subject:"[ STARTED ]Release - Build:${env.BUILD_NUMBER}",
                            body:"Continous integration build for release started.\n$releaseInfo\n\n"+
                                 "${env.BUILD_URL}",
                            to: '$DEFAULT_RECIPIENTS'
                        )
                    }
                    callGradleWrapper("clean")
                }
            }
        }

        stage("Builds") {
            when {
                expression { context.isAnyRelease() }
            }
            parallel {

                stage('Build Server and PDS') {
                    environment {
                        /* against build race conditions - See TestPortProvider.java */
                        SECHUB_TEST_WIREMOCK_HTTPS_PORT = getJenkinsExecutorPort(8143)
                        SECHUB_TEST_WIREMOCK_HTTP_PORT = getJenkinsExecutorPort(8180)

                        SECHUB_TEST_S3MOCK_HTTP_PORT = getJenkinsExecutorPort(9090)
                        SECHUB_TEST_S3MOCK_HTTPS_PORT = getJenkinsExecutorPort(9190)
                    }
                    steps {
                        script{
                            echo "SECHUB_TEST_WIREMOCK_HTTPS_PORT=${env.SECHUB_TEST_WIREMOCK_HTTPS_PORT}"
                            echo "SECHUB_TEST_WIREMOCK_HTTP_PORT=${env.SECHUB_TEST_WIREMOCK_HTTP_PORT}"

                            /*
                            * We do NOT build sechub-integrationtest
                            * Reason: because we do NOT want to have the integration tests executed, otherwise gradle will not execute them
                            * on integration phase again (because nothing has changed, so gradle will cache the results which are ignored ...
                            */
                            callGradleWrapper("ensureLocalhostCertificate build generateOpenapi buildDeveloperAdminUI -x :sechub-integrationtest:test -x :sechub-cli:build -Psechub.test.wiremock.https_port=${env.SECHUB_TEST_WIREMOCK_HTTPS_PORT} -Psechub.test.wiremock.http_port=${env.SECHUB_TEST_WIREMOCK_HTTP_PORT}")
                            callGradleWrapper(":sechub-api-java:build :sechub-systemtest:build :sechub-pds-tools:buildPDSToolsCLI -Dsechub.build.stage=api-necessary")
                        }
                    }
                }

                stage('Build Client') {
                    steps {
                        script{
                            callGradleWrapper(':sechub-cli:buildGo :sechub-cli:testGo')
                        }
                    }
                }

            }
        }

        stage('Integration tests') {
            when {
                expression { context.isAnyRelease() }
            }
            environment {
                /* against build race conditions - See TestPortProvider.java */
                SERVER_PORT= getJenkinsExecutorPort(8243)
                PDS_PORT= getJenkinsExecutorPort(8543)

                /* setup s3 storage when defined as secrets - otherwise sharedvolume will be used with temp */
                SECHUB_STORAGE_S3_ACCESSKEY = getStringCredentialsOrUndefined('sechub-storage-s3-accesskey')
                SECHUB_STORAGE_S3_SECRETKEY = getStringCredentialsOrUndefined('sechub-storage-s3-secretkey')
                SECHUB_STORAGE_S3_BUCKETNAME = getStringCredentialsOrUndefined('sechub-storage-s3-bucketname')
                SECHUB_STORAGE_S3_ENDPOINT = getStringCredentialsOrUndefined('sechub-storage-s3-endpoint')

                // we setup PDS storage with same s3 bucket data
                PDS_STORAGE_S3_ACCESSKEY = getStringCredentialsOrUndefined('sechub-storage-s3-accesskey')
                PDS_STORAGE_S3_SECRETKEY = getStringCredentialsOrUndefined('sechub-storage-s3-secretkey')
                PDS_STORAGE_S3_BUCKETNAME = getStringCredentialsOrUndefined('sechub-storage-s3-bucketname')
                PDS_STORAGE_S3_ENDPOINT = getStringCredentialsOrUndefined('sechub-storage-s3-endpoint')

                SECHUB_INTEGRATIONTEST_PREPARE_WAIT_MS=100

                /* avoid race conditions with management port */
                MANAGEMENT_SERVER_PORT= getJenkinsExecutorPort(10250)
            }
            steps {
                script{
                    // start integration tests and also create combined test report after all
                    callGradleWrapper("integrationtest -Psechub.integrationtest.serverport=${env.SERVER_PORT} -Psechub.integrationtest.pdsport=${env.PDS_PORT}")
                }
            }
        }

        stage('Build Documentation') {
            when {
                expression { context.isAnyRelease() }
            }
            steps {
                script{
                    callGradleWrapper('documentation -Dsechub.build.stage=all')
                }
            }
        }

        stage('Publish release artifacts') {
            when {
                expression { context.isAnyRelease() }
            }
            steps {
                echo 'This step is now ignored - because already done by GitHub actions - see https://github.com/mercedes-benz/sechub/actions'
            }
        }

        /**
         * How to handle these triggers in your build ?
         * See /sechub-doc/src/docs/asciidoc/documents/buildserver/jenkins-pipeline.adoc
         */
        stage('Trigger server released') {
            when {
                 expression { context.isServerRelease() }
            }
            steps {
                // trigger other pipeline job :
                build job: 'sechub-server-released',
                    propagate: true,
                    wait: false,
                    parameters: [string(name: 'SERVERVERSION', value:"${context.serverVersion}")]
            }
        }

        stage('Trigger client released') {
            when {
                 expression { context.isClientRelease() }
            }
            steps {
                // trigger other pipeline job :
                build job: 'sechub-client-released',
                    propagate: true,
                    wait: false,
                    parameters: [string(name: 'CLIENTVERSION', value:"${context.clientVersion}")]
            }
        }

        stage('Trigger PDS released') {
            when {
                 expression { context.isPdsRelease() }
            }
            steps {
                // trigger other pipeline job :
                build job: 'sechub-pds-released',
                    propagate: true,
                    wait: false,
                    parameters: [string(name: 'PDS_VERSION', value:"${context.pdsVersion}")]
            }
        }

    }

    post {

        failure {
            script {
                if (context.isAnyRelease()){
                    releaseInfo = context.getReleaseInfo()
                    emailext (
                        subject:"[ FAILED ]Release - Build:${env.BUILD_NUMBER}",
                        body:"Continous integration build with release publish failed.\n$releaseInfo\n\n"+
                             "${env.BUILD_URL}",
                        to: '$DEFAULT_RECIPIENTS'
                    )
                }else{
                    emailext (
                        subject:"[ FAILED ]CI - Build:${env.BUILD_NUMBER}",
                        body:"Continous integration build failed.\n$releaseInfo\n\n"+
                             "${env.BUILD_URL}",
                        to: '$DEFAULT_RECIPIENTS'
                    )
                }
            }
        }

        success {
            script {
                if (context.isAnyRelease()){
                    releaseInfo = context.getReleaseInfo()
                    emailext (
                        subject:"[ SUCCESS ]Release - Build:${env.BUILD_NUMBER}",
                        body:"Continous integration build with release publish sucessfully done. Triggered additional jobs.\n$releaseInfo\n\n"+
                            "${env.BUILD_URL}",
                        to: '$DEFAULT_RECIPIENTS'
                    )
                }
            }
        }

        always {
            junit '**/build/test-results/*/TEST-*.xml'
            script{
                  callGradleWrapper('createCombinedTestReportZipfile')
            }
            archive 'build/archive/combined-sechub-testreport.zip'
        }
    }

}

// --------------------------------------------------------------------------
// - Script helper methods
// --------------------------------------------------------------------------

/* Gives back port number increased by executor number, so different between
   jenkins executors (at least on same node) */
int getJenkinsExecutorPort(int originPort){
    int executorNr = "${env.EXECUTOR_NUMBER}"
    return originPort+executorNr
}

void callGradleWrapper(String gradleCommand) {
     jdk = tool name: 'JDK_17'
     env.JAVA_HOME = "${jdk}"

     if (isUnix()) {
           sh "./gradlew ${gradleCommand}"
     } else {
           bat "gradlew.bat ${gradleCommand}"
     }
}

Object getStringCredentialsOrUndefined(String id){
    result = 'undefined'
    if (stringCredentialsExist(id)){
        try {
        withCredentials([string(credentialsId: id, variable: 'text')]) {
          result = ''+text
        }
      } catch (_) {
      }
    }
    return result
}

boolean stringCredentialsExist(String id) {
  try {
    withCredentials([string(credentialsId: id, variable: 'irrelevant')]) {
      true
    }
  } catch (_) {
    false
  }
}

/**
 * This class is necessary because jenkins - at least in version 2.150.2 - does not correct handle
 * GIT tags and branches. Multi pipeline builds do not even checkout the tags. Normal pipeline builds do checkout the tags,
 * but "when {tag pattern:'myPattern', comparator:'REGEXP' } does not work at all - no comment...
 *
 * To get the possibility to use tags for versioning this helper class was created
 * At the begining of the pipeline there is a global variable defined which is also available inside build stages
 * So we do init with git tags on head as array and use getter methods (not groovy but normal java getter, otherwise sandbox problems OMG!)
 */
class SecHubBuildContext{

    String clientVersion
    String serverVersion
    String pdsVersion

    boolean clientRelease
    boolean serverRelease
    boolean pdsRelease

    String releaseInfoString

    public SecHubBuildContext(){
    }

    /*
     * Simplifies given version string . e.g. v0.4.1-client will be reduced to 0.4.1
     */
    public String getSimplifiedVersion(String fullVersion){
        if (fullVersion==null){
            return "0.0.0";
        }
        String result = fullVersion;
        if (result.startsWith("v"))  {
            result=result.substring(1);
        }
        int index = result.indexOf('-');
        if (index==-1){
            return result;
        }
        return result.substring(0,index);
    }

    public boolean isAnyRelease(){
        return isClientRelease() || isServerRelease() || isPdsRelease();
    }

    public void init(String[ ] commitTags){
        def versionCommitTags = commitTags.findAll {it.startsWith("v")}

        // we got vX.Y.Z-server and vX.Y.Z-client tags
        def clientVersionCommitTag = versionCommitTags.find{ it.contains("-client") }
        def serverVersionCommitTag = versionCommitTags.find{ it.contains("-server") }
        def pdsVersionCommitTag = versionCommitTags.find{ it.contains("-pds") }

        releaseInfoString = "Release(s):"
        if (clientVersionCommitTag == null || clientVersionCommitTag.empty){
            clientRelease=false;
        }else{
            clientRelease=true;
            clientVersion=getSimplifiedVersion(clientVersionCommitTag)
            releaseInfoString=releaseInfoString+" " + clientVersionCommitTag
        }

        if (serverVersionCommitTag == null || serverVersionCommitTag.empty){
            serverRelease=false;
        }else{
            serverRelease=true;
            serverVersion=getSimplifiedVersion(serverVersionCommitTag)
            releaseInfoString=releaseInfoString+" " + serverVersionCommitTag
        }

        if (pdsVersionCommitTag == null || pdsVersionCommitTag.empty){
            pdsRelease=false;
        }else{
            pdsRelease=true;
            pdsVersion=getSimplifiedVersion(pdsVersionCommitTag)
            releaseInfoString=releaseInfoString+" " + pdsVersionCommitTag
        }
    }

    public String getReleaseInfo(){
        return releaseInfoString
    }

}