sns-alert-hub/vars/buildPodman.groovy
Stefan Reimer 0152d90502 Squashed '.ci/' changes from 8df60af..cdc32e0
cdc32e0 Improve cleanup flow

git-subtree-dir: .ci
git-subtree-split: cdc32e01eae67cd2635fa89cad114c6f6a11359f
2023-08-14 10:27:13 +00:00

83 lines
2.1 KiB
Groovy

// Common container builder by ZeroDownTime
def call(Map config=[:]) {
pipeline {
agent {
node {
label 'podman-aws-trivy'
}
}
stages {
stage('Prepare') {
steps {
// pull tags
withCredentials([gitUsernamePassword(credentialsId: 'gitea-jenkins-user')]) {
sh 'git fetch -q --tags ${GIT_URL}'
}
// Optional project specific preparations
sh 'make prepare'
}
}
// Build using rootless podman
stage('Build') {
steps {
sh 'make build'
}
}
stage('Test') {
steps {
sh 'make test'
}
}
// Scan via trivy
stage('Scan') {
environment {
TRIVY_FORMAT = "template"
TRIVY_OUTPUT = "reports/trivy.html"
}
steps {
sh 'mkdir -p reports && make scan'
publishHTML target: [
allowMissing: true,
alwaysLinkToLastBuild: true,
keepAll: true,
reportDir: 'reports',
reportFiles: 'trivy.html',
reportName: 'TrivyScan',
reportTitles: 'TrivyScan'
]
// Scan again and fail on CRITICAL vulns, if not overridden
script {
if (config.trivyFail == 'NONE') {
echo 'trivyFail == NONE, review Trivy report manually. Proceeding ...'
} else {
sh "TRIVY_EXIT_CODE=1 TRIVY_SEVERITY=${config.trivyFail} make scan"
}
}
}
}
// Push to container registry if not PR
// incl. basic registry retention removing any untagged images
stage('Push') {
when { not { changeRequest() } }
steps {
sh 'make push'
sh 'make rm-remote-untagged'
}
}
// generic clean
stage('cleanup') {
steps {
sh 'make clean'
}
}
}
}
}