continous-integration-multibranch-pipeline.jenkins

// SPDX-License-Identifier: MIT

// Continous integration build pipeline script for jenkins
// -------------------------------------------------------
// Please define a new "multibranch pipeline" job and use this jenkinsfile there
// Master branch is never build by this script - this branch is build by "release-pipeline.jenkins"
// But all other branches use this as CI build pipeline
// For details please refer /sechub-doc/src/docs/asciidoc/documents/buildserver/jenkins-pipeline.adoc

def sechubGitBranch ="unknown"

pipeline {
    agent any

    parameters {
        booleanParam(name: 'DEBUG_OUTPUT_ENABLED', defaultValue: false, description: 'When enabled more informations will be printed.')
    }

    environment {
        SECHUB_TRUSTALL= "true" // necessary for integration tests
        SECHUB_SCAN_ENABLED = getStringCredentialsOrUndefined('sechub-scan-enabled')
        SECHUB_BUILD_USE_TMP_CACHE ="true" // we use temporary cache, so always clean and timestamps in tests are always correct
    }

    stages {

        stage('Initialize') {
            steps {
                script{
                    sechubGitBranch = "${env.GIT_BRANCH}"
                    echo "Branch is $sechubGitBranch"
                    if( sechubGitBranch == "master" ) {
                        echo "Cancel build, because master is built by release-pipeline.jenkins!"
                        currentBuild.result = 'SUCCESS'
                        return
                    }
                }
            }
        }

        stage("Builds") {
            parallel {

                stage('Build Server & API Java') {
                    environment {
                        /* against build race conditions - See TestPortProvider.java */
                        SECHUB_TEST_WIREMOCK_HTTPS_PORT = getJenkinsExecutorPort(8143)
                        SECHUB_TEST_WIREMOCK_HTTP_PORT = getJenkinsExecutorPort(8180)
                        SECHUB_TEST_S3MOCK_HTTP_PORT = getJenkinsExecutorPort(9090)
                        SECHUB_TEST_S3MOCK_HTTPS_PORT = getJenkinsExecutorPort(9190)
                    }
                    steps {
                        script{
                            echo "SECHUB_TEST_WIREMOCK_HTTPS_PORT=${env.SECHUB_TEST_WIREMOCK_HTTPS_PORT}"
                            echo "SECHUB_TEST_WIREMOCK_HTTP_PORT=${env.SECHUB_TEST_WIREMOCK_HTTP_PORT}"

                            // We do NOT build sechub-integrationtest
                            // Reason: because we do NOT want to have the integration tests executed, otherwise gradle will not execute them
                            // on integration phase again (because nothing has changed, so gradle will cache the results which are ignored ...
                            callGradleWrapper("ensureLocalhostCertificate build generateOpenapi buildDeveloperAdminUI -x :sechub-integrationtest:test -x :sechub-cli:build -Psechub.test.wiremock.https_port=${env.SECHUB_TEST_WIREMOCK_HTTPS_PORT} -Psechub.test.wiremock.http_port=${env.SECHUB_TEST_WIREMOCK_HTTP_PORT}")
                            callGradleWrapper(":sechub-api-java:build :sechub-systemtest:build :sechub-pds-tools:buildPDSToolsCLI -Dsechub.build.stage=api-necessary")
                        }
                    }
                }

                stage('Build Client') {
                    steps {
                        script{
                            callGradleWrapper(':sechub-cli:buildGo :sechub-cli:testGo')
                        }
                    }
                }

            }
        }

        stage("test & security") {
            parallel {

                stage('Integration tests') {
                    environment {
                        /* against build race conditions - See TestPortProvider.java */
                        SERVER_PORT = getJenkinsExecutorPort(8243)
                        PDS_PORT = getJenkinsExecutorPort(8543)

                        /* setup s3 storage when defined as secrets - otherwise sharedvolume will be used with temp */
                        SECHUB_STORAGE_S3_ACCESSKEY = getStringCredentialsOrUndefined('sechub-storage-s3-accesskey')
                        SECHUB_STORAGE_S3_SECRETKEY = getStringCredentialsOrUndefined('sechub-storage-s3-secretkey')
                        SECHUB_STORAGE_S3_BUCKETNAME = getStringCredentialsOrUndefined('sechub-storage-s3-bucketname')
                        SECHUB_STORAGE_S3_ENDPOINT = getStringCredentialsOrUndefined('sechub-storage-s3-endpoint')

                        // we setup PDS storage with same s3 bucket data
                        PDS_STORAGE_S3_ACCESSKEY = getStringCredentialsOrUndefined('sechub-storage-s3-accesskey')
                        PDS_STORAGE_S3_SECRETKEY = getStringCredentialsOrUndefined('sechub-storage-s3-secretkey')
                        PDS_STORAGE_S3_BUCKETNAME = getStringCredentialsOrUndefined('sechub-storage-s3-bucketname')
                        PDS_STORAGE_S3_ENDPOINT = getStringCredentialsOrUndefined('sechub-storage-s3-endpoint')

                        SECHUB_INTEGRATIONTEST_PREPARE_WAIT_MS=100
                    }
                    steps {
                        script{
                            // start integration tests and also create combined test report after all
                            callGradleWrapper("integrationtest -Psechub.integrationtest.serverport=${env.SERVER_PORT} -Psechub.integrationtest.pdsport=${env.PDS_PORT}")
                        }
                    }
                }

                stage('Security scan') {
                    when{
                        not {
                            environment name: 'SECHUB_SCAN_ENABLED', value: 'undefined'
                        }
                    }

                    environment {
                        SECHUB_PROJECT = 'sechub'
                        SECHUB_USERID = credentials('sechub-userid')
                        SECHUB_APITOKEN = credentials('sechub-api-token')
                        SECHUB_SERVER= credentials('sechub-server')
                    }
                    steps {
                        script{
                            executeSecHubScan()
                        }
                    }
                }

            }
        }

        stage('Build Documentation') {
            steps {
                script{
                    callGradleWrapper('documentation -Dsechub.build.stage=all')
                }
            }
        }

    }

    post {
        failure {
            emailext (
                subject:"[ BUILD FAILED ] Branch: $sechubGitBranch, build #${env.BUILD_NUMBER}",
                body:"CI build for branch '$sechubGitBranch' failed.\n"+
                     "${env.BUILD_URL}/console",
                to: '$DEFAULT_RECIPIENTS'
            )
        }
        fixed {
            emailext (
                subject:"[ BUILD FIXED ] Branch: $sechubGitBranch, build #${env.BUILD_NUMBER}",
                body:"CI build for branch '$sechubGitBranch' has been fixed.\n"+
                     "${env.BUILD_URL}/console",
                to: '$DEFAULT_RECIPIENTS'
            )
        }
        always {
            junit '**/build/test-results/*/TEST-*.xml'
            script{
                callGradleWrapper('createCombinedTestReportZipfile')
            }
            archive 'build/archive/combined-sechub-testreport.zip'
        }
    }
}

// --------------------------------------------------------------------------
// - Script helper methods
// --------------------------------------------------------------------------

/* Gives back port number increased by executor number, so different between
   jenkins executors (at least on same node) */
int getJenkinsExecutorPort(int originPort){
    int executorNr = "${env.EXECUTOR_NUMBER}"
    return originPort+executorNr
}

void callGradleWrapper(String gradleCommand) {
    jdk = tool name: 'JDK_17'
    env.JAVA_HOME = "${jdk}"

    if (isUnix()) {
        sh "./gradlew ${gradleCommand}"
    } else {
        bat "gradlew.bat ${gradleCommand}"
    }
}

void executeSecHubScan() {
    if (isUnix()) {
        sh "sechub scan"
    } else {
        bat "sechub.exe scan"
    }
}

Object getStringCredentialsOrUndefined(String id){
    result = 'undefined'
    if (stringCredentialsExist(id)){
        try {
            withCredentials([string(credentialsId: id, variable: 'text')]) {
                result = ''+text
            }
        } catch (_) {
        }
    }
    return result
}

boolean stringCredentialsExist(String id) {
    try {
        withCredentials([string(credentialsId: id, variable: 'irrelevant')]) {
            true
        }
    } catch (_) {
        false
    }
}

/**
 * This class is necessary because jenkins - at least in version 2.150.2 - does not correct handle
 * GIT tags and branches. Multi pipeline builds do not even checkout the tags. Normal pipeline builds do checkout the tags,
 * but "when {tag pattern:'myPattern', comparator:'REGEXP' } does not work at all - no comment...
 *
 * To get the possibility to use tags for versioning this helper class was created
 * At the begining of the pipeline there is a global variable defined which is also available inside build stages
 * So we do init with git tags on head as array and use getter methods (not groovy but normal java getter, otherwise sandbox problems OMG!)
 */
class SecHubBuildContext{

    boolean clientVersion
    boolean serverVersion

    boolean clientBuildDone
    boolean serverBuildDone

    String releaseInfoString

    public SecHubBuildContext(){
    }

    public boolean isStartEmailNeeded(){
        return isAnyRelease()
    }

    public boolean isFailEmailNeeded(){
        return true;// always
    }

    public boolean isSuccesssEmailNeeded(){
        return isAnyRelease()
    }

    public void setClientBuildDone(boolean done){
        this.clientBuildDone=done
    }

    public void setServerBuildDone(boolean done){
        this.serverBuildDone=done
    }

    public void setWebsiteBuildDone(boolean done){
        this.websiteBuildDone=done
    }


    /**
     * Returns true when client or sever deployment.
     * Interesting for interdepent deployment tests.
     * E.g.
     *  - a server deployment should have integration test + client build before.
     *  - a client deployment should have also integration test - means server build before
     *    to have a working local integration test server
     */
    public boolean isClientOrServerRelease(){
        return isClientRelease() || isServerRelease();
    }

    public boolean isAnyRelease(){
        return isClientRelease() || isServerRelease();
    }

    public boolean isSuccessFul(){
        if (! isAnyRelease()){
            return false
        }

        if (isClientRelease()) {
           if (! this.clientBuildDone){
               return false
           }
        }

        if (isServerRelease()) {
           if (! this.serverBuildDone){
               return false8443
           }
        }

        return true
    }

    public boolean isClientRelease(){
        return clientVersion
    }

    public boolean isServerRelease(){
        return serverVersion
    }

    public void init(String[ ] commitTags){
        def versionCommitTags = commitTags.findAll {it.startsWith("v")}

        // we got vX.Y.Z-server and vX.Y.Z-client tags
        def clientVersionCommitTag = versionCommitTags.find{ it.contains("-client") }
        def serverVersionCommitTag = versionCommitTags.find{ it.contains("-server") }

        releaseInfoString = "Release(s):"
        if (clientVersionCommitTag == null || clientVersionCommitTag.empty){
            clientVersion=false;
        }else{
            clientVersion=true;
            releaseInfoString=releaseInfoString+" " + clientVersionCommitTag
        }

        if (serverVersionCommitTag == null || serverVersionCommitTag.empty){
            serverVersion=false;
        }else{
            serverVersion=true;
            releaseInfoString=releaseInfoString+" " + serverVersionCommitTag
        }

    }

    public String getReleaseInfo(){
        return releaseInfoString
    }

}