ci-tools-lib/vars/buildPodman.groovy

89 lines
2.3 KiB
Groovy
Raw Permalink Normal View History

2022-02-11 16:47:10 +00:00
// Common container builder by ZeroDownTime
2022-02-14 12:15:52 +00:00
def call(Map config=[:]) {
2022-02-11 17:13:04 +00:00
pipeline {
2023-10-27 10:49:38 +00:00
options {
disableConcurrentBuilds()
}
2022-02-11 17:13:04 +00:00
agent {
node {
label 'podman-aws-trivy'
}
}
stages {
stage('Prepare') {
steps {
2023-10-02 09:29:47 +00:00
sh 'mkdir -p reports'
2023-08-15 14:36:15 +00:00
// we set pull tags as project adv. options
// pull tags
2023-08-15 14:25:39 +00:00
//withCredentials([gitUsernamePassword(credentialsId: 'gitea-jenkins-user')]) {
// sh 'git fetch -q --tags ${GIT_URL}'
//}
// Optional project specific preparations
sh 'make prepare'
2022-02-11 17:13:04 +00:00
}
}
2022-02-11 16:47:10 +00:00
2022-02-11 17:13:04 +00:00
// Build using rootless podman
stage('Build') {
steps {
2023-08-15 14:36:15 +00:00
sh 'make build GIT_BRANCH=$GIT_BRANCH'
2022-02-11 17:13:04 +00:00
}
}
2022-02-11 16:47:10 +00:00
2022-02-11 17:13:04 +00:00
stage('Test') {
steps {
sh 'make test'
}
}
2022-02-11 16:47:10 +00:00
2022-02-11 17:13:04 +00:00
// Scan via trivy
stage('Scan') {
steps {
2023-10-02 09:29:47 +00:00
// we always scan and create the full json report
sh 'TRIVY_FORMAT=json TRIVY_OUTPUT="reports/trivy.json" make scan'
// render custom full html report
sh 'trivy convert -f template -t @/home/jenkins/html.tpl -o reports/trivy.html reports/trivy.json'
2022-02-11 17:13:04 +00:00
publishHTML target: [
allowMissing: true,
alwaysLinkToLastBuild: true,
keepAll: true,
reportDir: 'reports',
reportFiles: 'trivy.html',
reportName: 'TrivyScan',
reportTitles: 'TrivyScan'
]
2023-10-02 09:29:47 +00:00
sh 'echo "Trivy report at: $BUILD_URL/TrivyScan"'
2022-02-11 16:47:10 +00:00
2023-10-02 09:29:47 +00:00
// fail build if issues found above trivy threshold
script {
2023-10-02 09:29:47 +00:00
if ( config.trivyFail ) {
sh "TRIVY_SEVERITY=${config.trivyFail} trivy convert --report summary --exit-code 1 reports/trivy.json"
}
}
2022-02-11 17:13:04 +00:00
}
}
2022-02-11 16:47:10 +00:00
// Push to container registry if not PR
2023-08-14 10:27:07 +00:00
// incl. basic registry retention removing any untagged images
2022-02-11 17:13:04 +00:00
stage('Push') {
2022-12-21 12:33:22 +00:00
when { not { changeRequest() } }
2022-02-11 17:13:04 +00:00
steps {
sh 'make push'
2023-08-14 10:27:07 +00:00
sh 'make rm-remote-untagged'
2022-02-11 17:13:04 +00:00
}
}
// generic clean
stage('cleanup') {
2023-08-14 10:24:06 +00:00
steps {
sh 'make clean'
}
}
2022-02-11 17:13:04 +00:00
}
}
}