Jenkinsfile.release

/*
 * Copyright (c) 2017-present Sonatype, Inc.
 *
 * Licensed under the Apache License, Version 2.0 (the "License");
 * you may not use this file except in compliance with the License.
 * You may obtain a copy of the License at
 *
 *      http://www.apache.org/licenses/LICENSE-2.0
 *
 * Unless required by applicable law or agreed to in writing, software
 * distributed under the License is distributed on an "AS IS" BASIS,
 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 * See the License for the specific language governing permissions and
 * limitations under the License.
 */

@Library(['private-pipeline-library', 'jenkins-shared']) _

import com.sonatype.jenkins.shared.Expectation

properties([
  parameters([
    run(name: 'releaseBuild',
        filter: 'SUCCESSFUL',
        projectName: 'insight/insight-brain/release',
        description: 'The latest release of IQ Server to build the docker image')
  ])
])

String imageName = 'sonatype/nexus-iq-server'
String version = ''
String checksumX86_64 = ''
String checksumAarch = ''

dockerizedBuildPipeline(
  deployBranch: 'main',
  prepare: {
    githubStatusUpdate('pending')
    version = getVersionFromBuildName(env.releaseBuild_NAME)
    checksumX86_64 = readBuildArtifact('insight/insight-brain/release', env.releaseBuild_NUMBER, "artifacts/nexus-iq-server-${version}-linux-x86_64.tgz.sha256").trim()
    checksumAarch = readBuildArtifact('insight/insight-brain/release', env.releaseBuild_NUMBER, "artifacts/nexus-iq-server-${version}-linux-aarch_64.tgz.sha256").trim()
    updateIQServerVersionAndChecksum(version, checksumX86_64, checksumAarch)
    commitAndPushChanges(version)
  },
  setVersion: {
    env['VERSION'] = version.split('-')[0]
  },
  lint: {
    hadolint(['./Dockerfile'])
  },
  buildAndTest: {
    currentBuild.displayName = "#${currentBuild.id} ${imageName}-${env.VERSION}"
    def expectations = load 'expectations.groovy'
    validateExpectations(expectations.containerExpectations())
  },
  vulnerabilityScan: {
    nexusPolicyEvaluation(
      iqApplication: 'docker-nexus-iq-server',
      iqScanPatterns: [[scanPattern: "container:${env.DOCKER_IMAGE_ID}"]],
      iqStage: 'release')
  },
  deploy: {
    pushImage(imageName)
  },
  postDeploy: {
    sonatypeZionGitConfig()
    sshagent(credentials: [sonatypeZionCredentialsId()]) {
      sh """git tag ${env.VERSION}
            git push origin ${env.VERSION}"""
    }
  },
  onSuccess: {
    githubStatusUpdate('success')
  },
  onFailure: {
    githubStatusUpdate('failure')
  }
)

void updateIQServerVersionAndChecksum(String version, String checksumX86_64, String checksumAarch) {
  def dockerFile = readFile(file: 'Dockerfile')
  def metaShortVersionRegex = /(release=")(\d\.\d{1,3}\.\d)(" \\)/
  def versionRegex = /(ARG IQ_SERVER_VERSION=)(\d\.\d{1,3}\.\d\-\d{2})/
  def shaRegexX64_64 = /(ARG IQ_SERVER_SHA256_AARCH=)([A-Fa-f0-9]{64})/
  def shaRegexAarch = /(ARG IQ_SERVER_SHA256_X86_64=)([A-Fa-f0-9]{64})/
  dockerFile = dockerFile.replaceAll(metaShortVersionRegex,
      "\$1${version.substring(0, version.indexOf('-'))}\$3")
  dockerFile = dockerFile.replaceAll(versionRegex, "\$1${version}")
  dockerFile = dockerFile.replaceAll(shaRegexX64_64, "\$1${checksumX86_64}")
  dockerFile = dockerFile.replaceAll(shaRegexAarch, "\$1${checksumAarch}")

  writeFile(file: 'Dockerfile', text: dockerFile)
}

void commitAndPushChanges(String version) {
  runSafely 'git config --global push.default simple'
  sonatypeZionGitConfig()
  sshagent(credentials: [sonatypeZionCredentialsId()]) {
    runSafely 'git add .'
    runSafely "git diff --exit-code --cached || git commit -m 'Update IQ Server to ${version}.'"

    // pull and merge any new commits on main so that the push doesn't fail
    runSafely 'git pull --no-rebase --no-edit origin main'
    runSafely 'git push origin HEAD:main'
  }
}

void pushImage(String imageName) {
  runSafely "mkdir -p '${env.WORKSPACE_TMP}/.dockerConfig'"
  runSafely "cp -n '${env.HOME}/.docker/config.json' '${env.WORKSPACE_TMP}/.dockerConfig' || true"

  withEnv(["DOCKER_CONFIG=${env.WORKSPACE_TMP}/.dockerConfig", 'DOCKER_CONTENT_TRUST=1']) {
    withCredentials([
      file(credentialsId: 'nexus-iq-server-repository-key', variable: 'NEXUS_IQ_SERVER_REPOSITORY_KEY'),
      file(credentialsId: 'sonatype-pub', variable: 'SONATYPE_PUB'),
      file(credentialsId: 'sonatype-key', variable: 'SONATYPE_KEY'),
      [ $class: 'UsernamePasswordMultiBinding', credentialsId: 'docker-hub-credentials',
        usernameVariable: 'DOCKERHUB_API_USERNAME', passwordVariable: 'DOCKERHUB_API_PASSWORD']]) {

      runSafely """docker login --username ${env.DOCKERHUB_API_USERNAME} --password ${env.DOCKERHUB_API_PASSWORD}
                   docker trust key load $NEXUS_IQ_SERVER_REPOSITORY_KEY
                   docker trust key load $SONATYPE_KEY"""

      withCredentials([string(credentialsId: 'nexus-iq-server_dct_reg_pw', variable: 'DOCKER_CONTENT_TRUST_REPOSITORY_PASSPHRASE')]) {
        sh  """
        curl -L https://go.dev/dl/go1.23.3.linux-amd64.tar.gz | tar -xzf -
        export PATH=${env.PATH}:${env.WORKSPACE}/go/bin:${env.WORKSPACE}/bin
        export GOPATH=${env.WORKSPACE}
        go install -tags pkcs11 github.com/theupdateframework/notary/cmd/notary@latest
        notary --help
        docker buildx create --use --driver-opt image=${sonatypeDockerRegistryId()}/moby/buildkit
        export OCI_REPO="sonatype/nexus-iq-server"
        ./build_and_push_images.sh ${env.VERSION} latest
        """
      }

      String response = runSafely("""curl -X POST https://hub.docker.com/v2/users/login/ \
                                     -H 'cache-control: no-cache' -H 'content-type: application/json' \
                                     -d '{ "username": "${env.DOCKERHUB_API_USERNAME}", "password": "${env.DOCKERHUB_API_PASSWORD}" }'
                                  """, true)
      def token = readJSON(text: response)
      def dockerHubApiToken = token.token

      String readme = readFile file: 'README.md', encoding: 'UTF-8'
      readme = readme.replaceAll("(?s)<!--.*?-->", "")
      readme = readme.replace("\"", "\\\"")
      readme = readme.replace("\n", "\\n")
      readme = readme.replace("\\\$", "\\\\\$")

      httpRequest customHeaders: [[name: 'authorization', value: "JWT ${dockerHubApiToken}"]],
                  acceptType: 'APPLICATION_JSON', contentType: 'APPLICATION_JSON', httpMode: 'PATCH',
                  requestBody: "{ \"full_description\": \"${readme}\" }",
                  url: "https://hub.docker.com/v2/repositories/${imageName}/"
    }
  }
}