Jenkinsfile.release

/*
 * Copyright (c) 2017-present Sonatype, Inc.
 *
 * Licensed under the Apache License, Version 2.0 (the "License");
 * you may not use this file except in compliance with the License.
 * You may obtain a copy of the License at
 *
 *      http://www.apache.org/licenses/LICENSE-2.0
 *
 * Unless required by applicable law or agreed to in writing, software
 * distributed under the License is distributed on an "AS IS" BASIS,
 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 * See the License for the specific language governing permissions and
 * limitations under the License.
 */

@Library(['private-pipeline-library', 'jenkins-shared']) _

import com.sonatype.jenkins.shared.Expectation

properties([
  parameters([
    run(name: 'releaseBuild',
        filter: 'SUCCESSFUL',
        projectName: 'insight/insight-brain/release',
        description: 'The latest release of IQ Server to build the docker image')
  ])
])

String imageName = 'sonatype/nexus-iq-server'
String version = ''
String checksumX86_64 = ''
String checksumAarch = ''

dockerizedBuildPipeline(
  deployBranch: 'debug_release',
  prepare: {
    githubStatusUpdate('pending')
    version = getVersionFromBuildName(env.releaseBuild_NAME)
    checksumX86_64 = readBuildArtifact('insight/insight-brain/release', env.releaseBuild_NUMBER, "artifacts/nexus-iq-server-${version}-linux-x86_64.tgz.sha256").trim()
    checksumAarch = readBuildArtifact('insight/insight-brain/release', env.releaseBuild_NUMBER, "artifacts/nexus-iq-server-${version}-linux-aarch_64.tgz.sha256").trim()
    updateIQServerVersionAndChecksum(version, checksumX86_64, checksumAarch)
    commitAndPushChanges(version)
  },
  setVersion: {
    env['VERSION'] = version.split('-')[0]
  },
  lint: {
    hadolint(['./Dockerfile'])
  },
  buildAndTest: {
    currentBuild.displayName = "#${currentBuild.id} ${imageName}-${env.VERSION}"
    def expectations = load 'expectations.groovy'
    validateExpectations(expectations.containerExpectations())
  },
  vulnerabilityScan: {
    nexusPolicyEvaluation(
      iqApplication: 'docker-nexus-iq-server',
      iqScanPatterns: [[scanPattern: "container:${env.DOCKER_IMAGE_ID}"]],
      iqStage: 'release')
  },
  deploy: {
    pushImage(imageName)
  },
  postDeploy: {
    sonatypeZionGitConfig()
    sshagent(credentials: [sonatypeZionCredentialsId()]) {
      sh """git tag ${env.VERSION}
            git push origin ${env.VERSION}"""
    }
  },
  onSuccess: {
    githubStatusUpdate('success')
  },
  onFailure: {
    githubStatusUpdate('failure')
  }
)

void updateIQServerVersionAndChecksum(String version, String checksumX86_64, String checksumAarch) {
  def dockerFile = readFile(file: 'Dockerfile')
  def metaShortVersionRegex = /(release=")(\d\.\d{1,3}\.\d)(" \\)/
  def versionRegex = /(ARG IQ_SERVER_VERSION=)(\d\.\d{1,3}\.\d\-\d{2})/
  def shaRegexAarch = /(ARG IQ_SERVER_SHA256_AARCH=)([A-Fa-f0-9]{64})/
  def shaRegexX64_64 = /(ARG IQ_SERVER_SHA256_X86_64=)([A-Fa-f0-9]{64})/
  dockerFile = dockerFile.replaceAll(metaShortVersionRegex,
      "\$1${version.substring(0, version.indexOf('-'))}\$3")
  dockerFile = dockerFile.replaceAll(versionRegex, "\$1${version}")
  dockerFile = dockerFile.replaceAll(shaRegexX64_64, "\$1${checksumX86_64}")
  dockerFile = dockerFile.replaceAll(shaRegexAarch, "\$1${checksumAarch}")

  writeFile(file: 'Dockerfile', text: dockerFile)
}

void commitAndPushChanges(String version) {
  runSafely 'git config --global push.default simple'
  sonatypeZionGitConfig()
  sshagent(credentials: [sonatypeZionCredentialsId()]) {
    runSafely 'git add .'
    runSafely "git diff --exit-code --cached || git commit -m 'Update IQ Server to ${version}.'"

    // pull and merge any new commits on main so that the push doesn't fail
    runSafely 'git pull --no-rebase --no-edit origin main'
    runSafely 'git push origin HEAD:main'
  }
}

void pushImage(String imageName) {
  runSafely "mkdir -p '${env.WORKSPACE_TMP}/.dockerConfig'"
  runSafely "cp -n '${env.HOME}/.docker/config.json' '${env.WORKSPACE_TMP}/.dockerConfig' || true"

  withEnv(["DOCKER_CONFIG=${env.WORKSPACE_TMP}/.dockerConfig", 'DOCKER_CONTENT_TRUST=1', "TRUST_DIR=${env.WORKSPACE_TMP}/.dockerConfig/trust"]) {
    withCredentials([
        file(credentialsId: 'sonatype_docker_root_private_key', variable: 'SONATYPE_DOCKER_ROOT_PRIVATE_KEY'),
        file(credentialsId: 'nexus-iq-server_dct_gun_key', variable: 'NEXUS_IQ_SERVER_DCT_GUN_KEY'),
        file(credentialsId: 'nexus-iq-server_dct_root_key', variable: 'NEXUS_IQ_SERVER_DCT_ROOT_KEY'),
        string(credentialsId: 'sonatype_docker_root_pw', variable: 'NOTARY_DELEGATION_PASSPHRASE'),
        string(credentialsId: 'sonatype_docker_root_pw', variable: 'NOTARY_ROOT_PASSPHRASE'),
        string(credentialsId: 'nexus-iq-server_dct_reg_pw', variable: 'NOTARY_TARGETS_PASSPHRASE'),
      [ $class: 'UsernamePasswordMultiBinding', credentialsId: 'docker-hub-credentials',
        usernameVariable: 'DOCKERHUB_API_USERNAME', passwordVariable: 'DOCKERHUB_API_PASSWORD']]) {

      runSafely """docker login --username ${env.DOCKERHUB_API_USERNAME} --password ${env.DOCKERHUB_API_PASSWORD}
                   mkdir -p ${TRUST_DIR}/private
                   cp '${SONATYPE_DOCKER_ROOT_PRIVATE_KEY}' ${TRUST_DIR}/private
                   cp '${NEXUS_IQ_SERVER_DCT_GUN_KEY}' ${TRUST_DIR}/private
                   cp '${NEXUS_IQ_SERVER_DCT_ROOT_KEY}' ${TRUST_DIR}/private"""
      withSonatypeDockerRegistry() {
        runSafely """
        curl -L https://go.dev/dl/go1.23.3.linux-amd64.tar.gz | tar -xzf -
        export PATH=${env.PATH}:${env.WORKSPACE}/go/bin:${env.WORKSPACE}/bin
        export GOPATH=${env.WORKSPACE}
        go install -tags pkcs11 github.com/theupdateframework/notary/cmd/notary@latest
        notary --help
        docker buildx create --use --driver-opt image=${sonatypeDockerRegistryId()}/moby/buildkit
        export OCI_REPO="sonatype/nexus-iq-server"
        ./build_and_push_images.sh testing testinglatest
        """
      }

      String response = runSafely("""curl -X POST https://hub.docker.com/v2/users/login/ \
                                     -H 'cache-control: no-cache' -H 'content-type: application/json' \
                                     -d '{ "username": "${env.DOCKERHUB_API_USERNAME}", "password": "${env.DOCKERHUB_API_PASSWORD}" }'
                                  """, true)
      def token = readJSON(text: response)
      def dockerHubApiToken = token.token

      String readme = readFile file: 'README.md', encoding: 'UTF-8'
      readme = readme.replaceAll("(?s)<!--.*?-->", "")
      readme = readme.replace("\"", "\\\"")
      readme = readme.replace("\n", "\\n")
      readme = readme.replace("\\\$", "\\\\\$")

      httpRequest customHeaders: [[name: 'authorization', value: "JWT ${dockerHubApiToken}"]],
                  acceptType: 'APPLICATION_JSON', contentType: 'APPLICATION_JSON', httpMode: 'PATCH',
                  requestBody: "{ \"full_description\": \"${readme}\" }",
                  url: "https://hub.docker.com/v2/repositories/${imageName}/"
    }
  }
}