Jenkinsfile

def secrets = [
    [path: params.VAULT_PATH_SVC_ACCOUNT_EPHEMERAL, secretValues: [
        [envVar: 'OC_LOGIN_TOKEN_DEV', vaultKey: 'oc-login-token-dev'],
        [envVar: 'OC_LOGIN_SERVER_DEV', vaultKey: 'oc-login-server-dev'],
        [envVar: 'OC_LOGIN_TOKEN', vaultKey: 'oc-login-token'],
        [envVar: 'OC_LOGIN_SERVER', vaultKey: 'oc-login-server']]],
    [path: params.VAULT_PATH_QUAY_PUSH, secretValues: [
        [envVar: 'QUAY_USER', vaultKey: 'user'],
        [envVar: 'QUAY_TOKEN', vaultKey: 'token']]],
    [path: params.VAULT_PATH_RHR_PULL, secretValues: [
        [envVar: 'RH_REGISTRY_USER', vaultKey: 'user'],
        [envVar: 'RH_REGISTRY_TOKEN', vaultKey: 'token']]],
    [path: params.VAULT_PATH_QUAY_TOKEN, secretValues: [
        [envVar: 'QUAY_API_TOKEN', vaultKey: 'api-token']]]
]

def configuration = [vaultUrl: params.VAULT_ADDRESS, vaultCredentialId: params.VAULT_CREDS_ID]

pipeline {
    agent { label 'rhel8' }
    options {
        timestamps()
    }

    environment {
        APP_NAME="vulnerability"  // name of app-sre "application" folder this component lives in
        COMPONENT_NAME="vulnerability-engine"  // name of app-sre "resourceTemplate" in deploy.yaml for this component
        IMAGE="quay.io/cloudservices/vulnerability-engine-app"
        COMPONENTS_W_RESOURCES="rbac"
        CACHE_FROM_LATEST_IMAGE="true"

        IQE_PLUGINS="vulnerability"
        IQE_MARKER_EXPRESSION="smoke and api"
        IQE_FILTER_EXPRESSION="not (advisories or patch or remediation_manual or test_edge_leak or test_invalid_rpm_list)"
        IQE_REQUIREMENTS_PRIORITY=""
        IQE_TEST_IMPORTANCE=""
        IQE_CJI_TIMEOUT="60m"
        DEPLOY_TIMEOUT=900

        LABELS_DIR="github_labels"
        ARTIFACTS_DIR="artifacts"
        CICD_INSTALL_SCRIPT='https://raw.githubusercontent.com/RedHatInsights/bonfire/master/cicd/bootstrap.sh'
    }

    stages {
        stage('Initial setup') {
            steps {
                sh '''#!/bin/bash
                    source "ci/functions.sh"
                    set_label_flags

                    > github_pr_labels
                    echo "RELEASE_NAMESPACE:$RELEASE_NAMESPACE" >> github_pr_labels
                    echo "SKIP_DEPLOY_EPHEMERAL:$SKIP_DEPLOY_EPHEMERAL" >> github_pr_labels
                    echo "SKIP_IMAGE_BUILD:$SKIP_IMAGE_BUILD" >> github_pr_labels
                    echo "SKIP_SMOKE_TEST:$SKIP_SMOKE_TEST" >> github_pr_labels
                '''
                script {
                    FILE_CONTENTS = readFile('github_pr_labels')
                    my_var_map = [:]
                    my_vars = FILE_CONTENTS.split()
                    for (i in my_vars) {
                        s=i.split(':')
                        if (s.length == 2) {
                            my_var_map[s[0]] = s[1]
                        } else {
                            my_var_map[s[0]] = ""
                        }
                    }

                    env.RELEASE_NAMESPACE = my_var_map['RELEASE_NAMESPACE']
                    env.SKIP_IMAGE_BUILD = my_var_map['SKIP_IMAGE_BUILD']
                    env.SKIP_DEPLOY_EPHEMERAL = my_var_map['SKIP_DEPLOY_EPHEMERAL']
                    env.SKIP_SMOKE_TEST = my_var_map['SKIP_SMOKE_TEST']
                }
            }
            post {
                always {
                    archiveArtifacts artifacts: 'github_pr_labels', fingerprint: true
                }
            }
        }

        stage('Build test image') {
            when {
                expression {
                    return (! env.SKIP_IMAGE_BUILD)
                }
            }
            steps {
                script {
                    withVault([configuration: configuration, vaultSecrets: secrets]) {
                        sh '''#!/bin/bash
                            curl -sSL "$CICD_INSTALL_SCRIPT" > .cicd_install_script && source ./.cicd_install_script && rm ./.cicd_install_script
                            export DOCKER_BUILDKIT=1
                            source $CICD_ROOT/build.sh
                        '''
                    }
                }
            }
        }

        stage('Deploy Ephemeral Environment') {
            when {
                expression {
                    return (! env.SKIP_DEPLOY_EPHEMERAL)
                }
            }

            steps {
                script {
                    withVault([configuration: configuration, vaultSecrets: secrets]) {
                        sh '''#!/bin/bash
                            curl -sSL "$CICD_INSTALL_SCRIPT" > .cicd_install_script && source ./.cicd_install_script && rm ./.cicd_install_script
                            RELEASE_NAMESPACE="false"
                            source $CICD_ROOT/deploy_ephemeral_env.sh
                            echo -n "$NAMESPACE" > .eph_namespace
                        '''
                        script {
                            env.NAMESPACE = readFile('.eph_namespace')
                        }
                        sh 'rm .eph_namespace'
                    }
                }
            }
        }

        stage('Run Smoke Tests') {
            when {
                expression {
                    return (! env.SKIP_DEPLOY_EPHEMERAL && ! env.SKIP_SMOKE_TEST)
                }
            }
            steps {
                withVault([configuration: configuration, vaultSecrets: secrets]) {
                    sh '''#!/bin/bash
                        mkdir -p "$ARTIFACTS_DIR"
                        source ./ci/functions.sh
                        set +e
                        process_requirements_labels
                        set -e
                        curl -sSL "$CICD_INSTALL_SCRIPT" > .cicd_install_script && source ./.cicd_install_script && rm ./.cicd_install_script
                        source $CICD_ROOT/_common_deploy_logic.sh
                        source $CICD_ROOT/cji_smoke_test.sh
                    '''
                }
            }

            post {
                always {
                    junit skipPublishingChecks: true, testResults: 'artifacts/junit-*.xml'
                    archiveArtifacts artifacts: 'artifacts/**/*', fingerprint: true
                }
            }
        }
    }
}