Jenkinsfile

def secrets = [
    [path: 'insights-cicd/ephemeral-bot-svc-account', secretValues: [
        [envVar: 'OC_LOGIN_TOKEN_DEV', vaultKey: 'oc-login-token-dev'],
        [envVar: 'OC_LOGIN_SERVER_DEV', vaultKey: 'oc-login-server-dev'],
        [envVar: 'OC_LOGIN_TOKEN', vaultKey: 'oc-login-token'],
        [envVar: 'OC_LOGIN_SERVER', vaultKey: 'oc-login-server']]],
    [path: 'app-sre/quay/cloudservices-push', secretValues: [
        [envVar: 'QUAY_USER', vaultKey: 'user'],
        [envVar: 'QUAY_TOKEN', vaultKey: 'token']]],
    [path: 'insights-cicd/rh-registry-pull', secretValues: [
        [envVar: 'RH_REGISTRY_USER', vaultKey: 'user'],
        [envVar: 'RH_REGISTRY_TOKEN', vaultKey: 'token']]],
    [path: 'insights-cicd/quay/cloudservices', secretValues: [
        [envVar: 'QUAY_API_TOKEN', vaultKey: 'api-token']]]
]

def configuration = [vaultUrl: params.VAULT_ADDRESS, vaultCredentialId: params.VAULT_CREDS_ID]

pipeline {
    agent { label 'rhel8' }
    options {
        timestamps()
    }

    environment {
        APP_NAME="vulnerability"  // name of app-sre "application" folder this component lives in
        COMPONENT_NAME="vulnerability-engine"  // name of app-sre "resourceTemplate" in deploy.yaml for this component
        IMAGE="quay.io/cloudservices/vulnerability-engine-app"
        COMPONENTS_W_RESOURCES="rbac"
        CACHE_FROM_LATEST_IMAGE="true"

        IQE_PLUGINS="vulnerability"
        IQE_ENV="ephemeral"
        IQE_MARKER_EXPRESSION="smoke and api"
        IQE_FILTER_EXPRESSION="not (advisories or patch or remediation_manual or test_edge_leak or test_invalid_rpm_list)"
        IQE_REQUIREMENTS_PRIORITY=""
        IQE_TEST_IMPORTANCE=""
        IQE_CJI_TIMEOUT="60m"
        DEPLOY_TIMEOUT=900

        LABELS_DIR="github_labels"
        ARTIFACTS_DIR="artifacts"
        CICD_INSTALL_SCRIPT='https://raw.githubusercontent.com/RedHatInsights/bonfire/master/cicd/bootstrap.sh'
    }

    stages {
        stage('Initial setup') {
            when {
                changeRequest()
            }
            steps {
                sh '''#!/bin/bash
                    # Initialize and update git submodules
                    git submodule update --init --recursive

                    source "ci/functions.sh"
                    set_label_flags

                    > github_pr_labels
                    echo "RELEASE_NAMESPACE:$RELEASE_NAMESPACE" >> github_pr_labels
                    echo "SKIP_DEPLOY_EPHEMERAL:$SKIP_DEPLOY_EPHEMERAL" >> github_pr_labels
                    echo "SKIP_IMAGE_BUILD:$SKIP_IMAGE_BUILD" >> github_pr_labels
                    echo "SKIP_SMOKE_TEST:$SKIP_SMOKE_TEST" >> github_pr_labels
                '''
                script {
                    FILE_CONTENTS = readFile('github_pr_labels')
                    my_var_map = [:]
                    my_vars = FILE_CONTENTS.split()
                    for (i in my_vars) {
                        s=i.split(':')
                        if (s.length == 2) {
                            my_var_map[s[0]] = s[1]
                        } else {
                            my_var_map[s[0]] = ""
                        }
                    }

                    env.RELEASE_NAMESPACE = my_var_map['RELEASE_NAMESPACE']
                    env.SKIP_IMAGE_BUILD = my_var_map['SKIP_IMAGE_BUILD']
                    env.SKIP_DEPLOY_EPHEMERAL = my_var_map['SKIP_DEPLOY_EPHEMERAL']
                    env.SKIP_SMOKE_TEST = my_var_map['SKIP_SMOKE_TEST']
                }
            }
            post {
                always {
                    archiveArtifacts artifacts: 'github_pr_labels', fingerprint: true
                }
            }
        }

        stage('Build test image') {
            when {
                allOf {
                    changeRequest()
                    expression {
                        return (! env.SKIP_IMAGE_BUILD)
                    }
                }
            }
            steps {
                script {
                    withVault([configuration: configuration, vaultSecrets: secrets]) {
                        sh '''#!/bin/bash
                            curl -sSL "$CICD_INSTALL_SCRIPT" > .cicd_install_script && source ./.cicd_install_script && rm ./.cicd_install_script
                            export DOCKER_BUILDKIT=1
                            source $CICD_ROOT/build.sh
                        '''
                    }
                }
            }
        }

        stage('Deploy Ephemeral Environment') {
            when {
                allOf {
                    changeRequest()
                    expression {
                        return (! env.SKIP_DEPLOY_EPHEMERAL)
                    }
                }
            }

            steps {
                script {
                    withVault([configuration: configuration, vaultSecrets: secrets]) {
                        sh '''#!/bin/bash
                            curl -sSL "$CICD_INSTALL_SCRIPT" > .cicd_install_script && source ./.cicd_install_script && rm ./.cicd_install_script
                            RELEASE_NAMESPACE="false"
                            source $CICD_ROOT/deploy_ephemeral_env.sh
                            echo -n "$NAMESPACE" > .eph_namespace
                        '''
                        script {
                            env.NAMESPACE = readFile('.eph_namespace')
                        }
                        sh 'rm .eph_namespace'
                    }
                }
            }
            post {
                always {
                    archiveArtifacts artifacts: 'artifacts/**/*', fingerprint: true, allowEmptyArchive: true
                }
            }
        }

        stage('Run Smoke Tests') {
            when {
                allOf {
                    changeRequest()
                    expression {
                        return (! env.SKIP_DEPLOY_EPHEMERAL && ! env.SKIP_SMOKE_TEST)
                    }
                }
            }
            steps {
                withVault([configuration: configuration, vaultSecrets: secrets]) {
                    sh '''#!/bin/bash
                        mkdir -p "$ARTIFACTS_DIR"
                        source ./ci/functions.sh
                        set +e
                        process_requirements_labels
                        set -e
                        curl -sSL "$CICD_INSTALL_SCRIPT" > .cicd_install_script && source ./.cicd_install_script && rm ./.cicd_install_script
                        source $CICD_ROOT/_common_deploy_logic.sh
                        source $CICD_ROOT/cji_smoke_test.sh

                        # Update IQE plugin config to run floorist plugin tests.
                        export COMPONENT_NAME="vulnerability-engine"
                        export IQE_CJI_NAME="floorist"
                        # Pass in COMPONENT_NAME.
                        export IQE_ENV_VARS="COMPONENT_NAME=$COMPONENT_NAME"
                        export IQE_PLUGINS="floorist"
                        export IQE_MARKER_EXPRESSION="floorist_smoke"
                        export IQE_IMAGE_TAG="floorist"

                        # Run smoke tests with ClowdJobInvocation
                        source "${CICD_ROOT}/cji_smoke_test.sh"
                    '''
                }
            }

            post {
                always {
                    junit skipPublishingChecks: true, testResults: 'artifacts/junit-*.xml'
                    archiveArtifacts artifacts: 'artifacts/**/*', fingerprint: true
                }
            }
        }
    }
}