doc(container): add buildAndPublishImage parameters documentation

vars/container.groovy

@@ -0,0 +1,219 @@
+/**
+* Construit, valide et publie (optionnellement) une image Docker sur le registre Cadoles (par défaut)
+*
+* Options disponibles:
+*
+* - dockerfile - String - Chemin vers le fichier Dockerfile à utiliser pour construire l'image, par défaut "./Dockerfile"
+* - contextDir - String - Répertoire servant de "contexte" pour la construction de l'image, par défault "./"
+* - imageName - String - Nom de l'image à construire, par défaut ""
+* - imageTag - String - Tag apposé sur l'image après construction, par défaut résultat de la commande `git describe --always`
+* - gitCredentialsId - String - Identifiant des "credentials" Jenkins utilisés pour cloner le dépôt Git, par défaut "forge-jenkins"
+* - dockerRepository - String - Nom d'hôte du registre Docker sur lequel publier l'image, par défaut "reg.cadoles.com"
+* - dockerRepositoryCredentialsId - String - Identifiant des "credentials" Jenkins utilisés pour déployer l'image sur le registre Docker, par défault "reg.cadoles.com-jenkins"
+* - dryRun - Boolean - Désactiver/activer la publication de l'image sur le registre Docker, par défaut "true"
+* - skipVerifications - Boolean - Désactiver/activer les étapes de vérifications de qualité/sécurité de l'image Docker, par défaut "false"
+*/
+String buildAndPublishImage(Map options = [:]) {
+    String dockerfile = options.get('dockerfile', './Dockerfile')
+    String contextDir = options.get('contextDir', '.')
+    String imageName = options.get('imageName', '')
+    String gitRef = sh(returnStdout: true, script: 'git describe --always').trim()
+    String imageTag = options.get('imageTag', gitRef)
+    String gitCredentialsId = options.get('gitCredentialsId', 'forge-jenkins')
+    String dockerRepository = options.get('dockerRepository', 'reg.cadoles.com')
+    String dockerRepositoryCredentialsId = options.get('dockerRepositoryCredentialsId', 'reg.cadoles.com-jenkins')
+    Boolean dryRun = options.get('dryRun', true)
+    Boolean skipVerifications = options.get('skipVerification', false)
+
+    String projectRepository = env.JOB_NAME
+    if (env.BRANCH_NAME ==~ /^PR-.*$/) {
+        projectRepository = env.JOB_NAME - "/${env.JOB_BASE_NAME}"
+    }
+    projectRepository = options.get('projectRepository', projectRepository)
+
+    withCredentials([
+        usernamePassword([
+            credentialsId: dockerRepositoryCredentialsId,
+            usernameVariable: 'HUB_USERNAME',
+            passwordVariable: 'HUB_PASSWORD'
+        ]),
+    ]) {
+        stage('Validate Dockerfile with Hadolint') {
+            utils.when(!skipVerifications) {
+                runHadolintCheck(dockerfile, projectRepository)
+            }
+        }
+
+        stage("Build image '${imageName}:${imageTag}'") {
+            git.withHTTPCredentials(gitCredentialsId) {
+                sh """
+                docker build \
+                    --build-arg="GIT_USERNAME=${env.GIT_USERNAME}" \
+                    --build-arg="GIT_PASSWORD=${env.GIT_PASSWORD}" \
+                    -t '${imageName}:${imageTag}' \
+                    -f '${dockerfile}' \
+                    '${contextDir}'
+                """
+            }
+        }
+
+        stage('Validate image with Trivy') {
+            utils.when(!skipVerifications) {
+                runTrivyCheck("${imageName}:${imageTag}", projectRepository)
+            }
+        }
+
+        stage("Publish image '${imageName}:${imageTag}'") {
+            utils.when(!dryRun) {
+                retry(2) {
+                    sh """
+                        echo ${env.HUB_PASSWORD} | docker login -u '${env.HUB_USERNAME}' --password-stdin '${dockerRepository}'
+                        docker push '${imageName}:${imageTag}'
+                    """
+                }
+            }
+        }
+    }
+}
+
+void runHadolintCheck(String dockerfile, String projectRepository) {
+    String reportFile = ".hadolint-report-${currentBuild.startTimeInMillis}.txt"
+
+    try {
+        validateDockerfileWithHadolint(dockerfile, ['reportFile': reportFile])
+    } catch (err) {
+        unstable("Dockerfile '${dockerfile}' failed linting !")
+    } finally {
+        String lintReport = ''
+
+        if (fileExists(reportFile)) {
+            lintReport = """${lintReport}
+            |
+            |```
+            |${readFile(reportFile)}
+            |```"""
+        } else {
+            lintReport = """${lintReport}
+            |
+            |_Vérification échouée mais aucun rapport trouvé !?_ :thinking:"""
+        }
+
+        String defaultReport = '_Rien à signaler !_ :thumbsup:'
+        String report = """## Validation du Dockerfile `${dockerfile}`
+        |
+        |${lintReport ?: defaultReport}
+        """.stripMargin()
+
+        print report
+
+        if (env.CHANGE_ID) {
+            gitea.commentPullRequest(projectRepository, env.CHANGE_ID, report)
+        }
+    }
+}
+
+String validateDockerfileWithHadolint(String dockerfile, Map options = [:]) {
+    String hadolintBin = getOrInstallHadolint(options)
+    String hadolintArgs = options.get('hadolintArgs', '--no-color')
+    String reportFile = options.get('reportFile', ".hadolint-report-${currentBuild.startTimeInMillis}.txt")
+
+    sh("""#!/bin/bash
+    set -eo pipefail
+    '${hadolintBin}' '${dockerfile}' ${hadolintArgs} | tee '${reportFile}'
+    """)
+
+    return reportFile
+}
+
+void runTrivyCheck(String imageName, String projectRepository, Map options = [:]) {
+    String reportFile = ".trivy-report-${currentBuild.startTimeInMillis}.txt"
+
+    try {
+        validateImageWithTrivy(imageName, ['reportFile': reportFile])
+    } catch (err) {
+        unstable("Image '${imageName}' failed validation !")
+    } finally {
+        String lintReport = ''
+
+        if (fileExists(reportFile)) {
+            lintReport = """${lintReport}
+            |
+            |```
+            |${readFile(reportFile)}
+            |```"""
+        } else {
+            lintReport = """${lintReport}
+            |
+            |_Vérification échouée mais aucun rapport trouvé !?_ :thinking:"""
+        }
+
+        String defaultReport = '_Rien à signaler !_ :thumbsup:'
+        String report = """## Validation de l'image `${imageName}`
+        |
+        |${lintReport ?: defaultReport}
+        """.stripMargin()
+
+        print report
+
+        if (env.CHANGE_ID) {
+            gitea.commentPullRequest(projectRepository, env.CHANGE_ID, report)
+        }
+    }
+}
+
+String validateImageWithTrivy(String imageName, Map options = [:]) {
+    String trivyBin = getOrInstallTrivy(options)
+    String trivyArgs = options.get('trivyArgs', '--exit-code 1')
+    String cacheDirectory = options.get('cacheDirectory', '.trivy/.cache')
+    String cacheDefaultBranch = options.get('cacheDefaultBranch', 'develop')
+    Integer cacheMaxSize = options.get('cacheMaxSize', 250)
+    String reportFile = options.get('reportFile', ".trivy-report-${currentBuild.startTimeInMillis}.txt")
+
+    cache(maxCacheSize: cacheMaxSize, defaultBranch: cacheDefaultBranch, caches: [
+        [$class: 'ArbitraryFileCache', path: cacheDirectory, compressionMethod: 'TARGZ']
+    ]) {
+        sh("'${trivyBin}' --cache-dir '${cacheDirectory}' image -o '${reportFile}' ${trivyArgs} '${imageName}'")
+    }
+
+    return reportFile
+}
+
+String getOrInstallHadolint(Map options = [:]) {
+    String installDir = options.get('installDir', '/usr/local/bin')
+    String version = options.get('version', '2.10.0')
+    String forceDownload = options.get('forceDownload', false)
+    String downloadUrl = options.get('downloadUrl', "https://github.com/hadolint/hadolint/releases/download/v${version}/hadolint-Linux-x86_64")
+
+    String hadolintBin = sh(returnStdout: true, script: 'which hadolint || exit 0').trim()
+    if (hadolintBin == '' || forceDownload) {
+        sh("""
+        mkdir -p '${installDir}'
+        curl -o '${installDir}/hadolint' -sSL '${downloadUrl}'
+        chmod +x '${installDir}/hadolint'
+        """)
+
+        hadolintBin = "${installDir}/hadolint"
+    }
+
+    return hadolintBin
+}
+
+String getOrInstallTrivy(Map options = [:]) {
+    String installDir = options.get('installDir', '/usr/local/bin')
+    String version = options.get('version', '0.27.1')
+    String forceDownload = options.get('forceDownload', false)
+    String installScriptDownloadUrl = options.get('downloadUrl', 'https://raw.githubusercontent.com/aquasecurity/trivy/main/contrib/install.sh')
+
+    String trivyBin = sh(returnStdout: true, script: 'which trivy || exit 0').trim()
+    if (trivyBin == '' || forceDownload) {
+        sh("""
+        mkdir -p '${installDir}'
+        curl -sfL '${installScriptDownloadUrl}'  | sh -s -- -b '${installDir}' v${version}
+        chmod +x '${installDir}/trivy'
+        """)
+
+        trivyBin = "${installDir}/trivy"
+    }
+
+    return trivyBin
+}

vars/gitea.groovy

@@ -1,4 +1,4 @@
-def commentPullRequest(String repo, String issueId, String comment, Integer commentIndex = 0) {
+def commentPullRequest(String repo, String issueId, String comment, Integer commentIndex = -1) {
   comment = comment.replaceAll('"', '\\"')
   withCredentials([
     string(credentialsId: 'GITEA_JENKINS_PERSONAL_TOKEN', variable: 'GITEA_TOKEN'),
@@ -7,13 +7,17 @@ def commentPullRequest(String repo, String issueId, String comment, Integer comm
     sh """#!/bin/bash
     set -xeo pipefail
 
-    # Récupération si il existe du commentaire existant
-    previous_comment_id=\$(curl -v --fail \
-      -H "Authorization: token ${GITEA_TOKEN}" \
-      -H "Content-Type: application/json" \
-      https://forge.cadoles.com/api/v1/repos/${repo}/issues/${issueId}/comments \
-      | jq -c '[ .[] | select(.user.login=="jenkins") ] | .[${commentIndex}] | .id' \
-    )
+    previous_comment_id=null
+
+    if [ "${commentIndex}" != "-1" ]; then
+      # Récupération si il existe du commentaire existant
+      previous_comment_id=\$(curl -v --fail \
+        -H "Authorization: token ${GITEA_TOKEN}" \
+        -H "Content-Type: application/json" \
+        https://forge.cadoles.com/api/v1/repos/${repo}/issues/${issueId}/comments \
+        | jq -c '[ .[] | select(.user.login=="jenkins") ] | .[${commentIndex}] | .id' \
+      )
+    fi
 
     # Génération du payload pour l'API Gitea
     echo '{}' | jq -c --rawfile body .prComment '.body = \$body' > payload.json

vars/nfpm.groovy

@@ -0,0 +1,25 @@
+// Package project with nfpm
+// See https://nfpm.goreleaser.com/
+def package(Map options = [:]) {
+    String installDir = options.get("nfpmInstallDir", "/usr/local/bin")
+    String nfpmVersion = options.get("nfpmVersion", "2.15.1")
+    String nfpmForceDownload = options.get("nfpmForceDownload", false)
+    String nfpmDownloadUrl = options.get("nfpmDownloadUrl", "https://github.com/goreleaser/nfpm/releases/download/${nfpmVersion}/nfpm_${nfpmVersion}_Linux_x86_64.tar.gz")
+    String nfpmConfig = options.get("nfpmConfig", "nfpm.yaml")
+    String nfpmTarget = options.get("nfpmTarget", ".")
+    String nfpmPackager = options.get("nfpmPackager", "")
+
+    String nfpmBin = sh(returnStdout: true, script: 'which nfpm').trim("")
+    if (nfpmBin == "" || nfpmForceDownload) {
+        sh("""
+        mkdir -p '${installDir}'
+        curl -L '${nfpmDownloadUrl}' > /tmp/nfpm.tar.gz
+        tar -C /usr/local/bin -xzf /tmp/nfpm.tar.gz
+        """)
+    }
+
+    sh("""
+        export PATH='${installDir}:${env.PATH}'
+        nfpm --config '${nfpmConfig}' ${nfpmPackager ? "--packager "+nfpmPackager : ""} --target '${nfpmTarget}'
+    """)
+}

vars/symfonyAppPipeline.groovy

@@ -1,15 +1,26 @@
 import org.jenkinsci.plugins.pipeline.modeldefinition.Utils
 
-def call(String baseImage = 'ubuntu:22.04') {
+def call(String baseImage = 'ubuntu:22.04', Map options = [:]) {
+  Map hooks = options.get('hooks', [:])
+  String jobHistory = options.get('jobHistory', '10')
+
   node {
+    properties([
+      buildDiscarder(logRotator(daysToKeepStr: jobHistory, numToKeepStr: jobHistory)),
+    ])
+    stage('Cancel older jobs') {
+      def buildNumber = env.BUILD_NUMBER as int
+      if (buildNumber > 1) milestone(buildNumber - 1)
+      milestone(buildNumber)
+    }
     stage('Checkout project') {
       checkout(scm)
     }
     stage('Run pre hooks') {
-      hook('pre-symfony-app')
+      runHook(hooks, 'preSymfonyAppPipeline')
     }
     stage('Run in Symfony image') {
-      def symfonyImage = buildDockerImage(baseImage)
+      def symfonyImage = buildDockerImage(baseImage, hooks)
       symfonyImage.inside() {
         def repo = env.JOB_NAME
         if (env.BRANCH_NAME ==~ /^PR-.*$/) {
@@ -29,7 +40,7 @@ def call(String baseImage = 'ubuntu:22.04') {
                 def auditReport = sh(script: 'local-php-security-checker --format=markdown || true', returnStdout: true)
                 if (auditReport.trim() != '') {
                   if (env.CHANGE_ID) {
-                    gitea.commentPullRequest(repo, env.CHANGE_ID, auditReport, 0)
+                    gitea.commentPullRequest(repo, env.CHANGE_ID, auditReport)
                   } else {
                     print auditReport
                   }
@@ -55,7 +66,7 @@ def call(String baseImage = 'ubuntu:22.04') {
                 '''
                 def report = sh(script: 'junit2md php-cs-fixer.xml', returnStdout: true)
                 if (env.CHANGE_ID) {
-                  gitea.commentPullRequest(repo, env.CHANGE_ID, report, 1)
+                  gitea.commentPullRequest(repo, env.CHANGE_ID, report)
                 } else {
                   print report
                 }
@@ -76,7 +87,7 @@ def call(String baseImage = 'ubuntu:22.04') {
                 report = '## Rapport PHPStan\n\n```\n' + report
                 report = report + '\n```\n'
                 if (env.CHANGE_ID) {
-                  gitea.commentPullRequest(repo, env.CHANGE_ID, report, 2)
+                  gitea.commentPullRequest(repo, env.CHANGE_ID, report)
                 } else {
                   print report
                 }
@@ -87,12 +98,12 @@ def call(String baseImage = 'ubuntu:22.04') {
       }
     }
     stage('Run post hooks') {
-      hook('post-symfony-app')
+      runHook(hooks, 'postSymfonyAppPipeline')
     }
   }
 }
 
-def buildDockerImage(String baseImage) {
+void buildDockerImage(String baseImage, Map hooks) {
   def imageName = 'cadoles-symfony-ci'
   dir(".${imageName}") {
     def dockerfile = libraryResource 'com/cadoles/symfony/Dockerfile'
@@ -101,7 +112,7 @@ def buildDockerImage(String baseImage) {
     def addLetsEncryptCA = libraryResource 'com/cadoles/common/add-letsencrypt-ca.sh'
     writeFile file:'add-letsencrypt-ca.sh', text:addLetsEncryptCA
 
-    hook('build-symfony-image')
+    runHook(hooks, 'buildSymfonyImage')
 
     def safeJobName = URLDecoder.decode(env.JOB_NAME).toLowerCase().replace('/', '-').replace(' ', '-')
     def imageTag = "${safeJobName}-${env.BUILD_ID}"
@@ -109,14 +120,15 @@ def buildDockerImage(String baseImage) {
   }
 }
 
-def when(boolean condition, body) {
-  def config = [:]
-  body.resolveStrategy = Closure.OWNER_FIRST
-  body.delegate = config
+void runHook(Map hooks, String name) {
+  if (!hooks[name]) {
+    println("No hook '${name}' defined. Skipping.")
+    return
+  }
 
-  if (condition) {
-    body()
-    } else {
-    Utils.markStageSkippedForConditional(STAGE_NAME)
+  if (hooks[name] instanceof Closure) {
+    hooks[name]()
+  } else {
+    error("Hook '${name}' seems to be defined but is not a closure !")
   }
 }

vars/utils.groovy

@@ -0,0 +1,13 @@
+import org.jenkinsci.plugins.pipeline.modeldefinition.Utils
+
+void when(Boolean condition, body) {
+    Map config = [:]
+    body.resolveStrategy = Closure.OWNER_FIRST
+    body.delegate = config
+
+    if (condition) {
+        body()
+    } else {
+        Utils.markStageSkippedForConditional(STAGE_NAME)
+    }
+}