vars/container.groovy

@@ -1,219 +0,0 @@
-/**
-* Construit, valide et publie (optionnellement) une image Docker sur le registre Cadoles (par défaut)
-*
-* Options disponibles:
-*
-* - dockerfile - String - Chemin vers le fichier Dockerfile à utiliser pour construire l'image, par défaut "./Dockerfile"
-* - contextDir - String - Répertoire servant de "contexte" pour la construction de l'image, par défault "./"
-* - imageName - String - Nom de l'image à construire, par défaut ""
-* - imageTag - String - Tag apposé sur l'image après construction, par défaut résultat de la commande `git describe --always`
-* - gitCredentialsId - String - Identifiant des "credentials" Jenkins utilisés pour cloner le dépôt Git, par défaut "forge-jenkins"
-* - dockerRepository - String - Nom d'hôte du registre Docker sur lequel publier l'image, par défaut "reg.cadoles.com"
-* - dockerRepositoryCredentialsId - String - Identifiant des "credentials" Jenkins utilisés pour déployer l'image sur le registre Docker, par défault "reg.cadoles.com-jenkins"
-* - dryRun - Boolean - Désactiver/activer la publication de l'image sur le registre Docker, par défaut "true"
-* - skipVerifications - Boolean - Désactiver/activer les étapes de vérifications de qualité/sécurité de l'image Docker, par défaut "false"
-*/
-String buildAndPublishImage(Map options = [:]) {
-    String dockerfile = options.get('dockerfile', './Dockerfile')
-    String contextDir = options.get('contextDir', '.')
-    String imageName = options.get('imageName', '')
-    String gitRef = sh(returnStdout: true, script: 'git describe --always').trim()
-    String imageTag = options.get('imageTag', gitRef)
-    String gitCredentialsId = options.get('gitCredentialsId', 'forge-jenkins')
-    String dockerRepository = options.get('dockerRepository', 'reg.cadoles.com')
-    String dockerRepositoryCredentialsId = options.get('dockerRepositoryCredentialsId', 'reg.cadoles.com-jenkins')
-    Boolean dryRun = options.get('dryRun', true)
-    Boolean skipVerifications = options.get('skipVerification', false)
-
-    String projectRepository = env.JOB_NAME
-    if (env.BRANCH_NAME ==~ /^PR-.*$/) {
-        projectRepository = env.JOB_NAME - "/${env.JOB_BASE_NAME}"
-    }
-    projectRepository = options.get('projectRepository', projectRepository)
-
-    withCredentials([
-        usernamePassword([
-            credentialsId: dockerRepositoryCredentialsId,
-            usernameVariable: 'HUB_USERNAME',
-            passwordVariable: 'HUB_PASSWORD'
-        ]),
-    ]) {
-        stage('Validate Dockerfile with Hadolint') {
-            utils.when(!skipVerifications) {
-                runHadolintCheck(dockerfile, projectRepository)
-            }
-        }
-
-        stage("Build image '${imageName}:${imageTag}'") {
-            git.withHTTPCredentials(gitCredentialsId) {
-                sh """
-                docker build \
-                    --build-arg="GIT_USERNAME=${env.GIT_USERNAME}" \
-                    --build-arg="GIT_PASSWORD=${env.GIT_PASSWORD}" \
-                    -t '${imageName}:${imageTag}' \
-                    -f '${dockerfile}' \
-                    '${contextDir}'
-                """
-            }
-        }
-
-        stage('Validate image with Trivy') {
-            utils.when(!skipVerifications) {
-                runTrivyCheck("${imageName}:${imageTag}", projectRepository)
-            }
-        }
-
-        stage("Publish image '${imageName}:${imageTag}'") {
-            utils.when(!dryRun) {
-                retry(2) {
-                    sh """
-                        echo ${env.HUB_PASSWORD} | docker login -u '${env.HUB_USERNAME}' --password-stdin '${dockerRepository}'
-                        docker push '${imageName}:${imageTag}'
-                    """
-                }
-            }
-        }
-    }
-}
-
-void runHadolintCheck(String dockerfile, String projectRepository) {
-    String reportFile = ".hadolint-report-${currentBuild.startTimeInMillis}.txt"
-
-    try {
-        validateDockerfileWithHadolint(dockerfile, ['reportFile': reportFile])
-    } catch (err) {
-        unstable("Dockerfile '${dockerfile}' failed linting !")
-    } finally {
-        String lintReport = ''
-
-        if (fileExists(reportFile)) {
-            lintReport = """${lintReport}
-            |
-            |```
-            |${readFile(reportFile)}
-            |```"""
-        } else {
-            lintReport = """${lintReport}
-            |
-            |_Vérification échouée mais aucun rapport trouvé !?_ :thinking:"""
-        }
-
-        String defaultReport = '_Rien à signaler !_ :thumbsup:'
-        String report = """## Validation du Dockerfile `${dockerfile}`
-        |
-        |${lintReport ?: defaultReport}
-        """.stripMargin()
-
-        print report
-
-        if (env.CHANGE_ID) {
-            gitea.commentPullRequest(projectRepository, env.CHANGE_ID, report)
-        }
-    }
-}
-
-String validateDockerfileWithHadolint(String dockerfile, Map options = [:]) {
-    String hadolintBin = getOrInstallHadolint(options)
-    String hadolintArgs = options.get('hadolintArgs', '--no-color')
-    String reportFile = options.get('reportFile', ".hadolint-report-${currentBuild.startTimeInMillis}.txt")
-
-    sh("""#!/bin/bash
-    set -eo pipefail
-    '${hadolintBin}' '${dockerfile}' ${hadolintArgs} | tee '${reportFile}'
-    """)
-
-    return reportFile
-}
-
-void runTrivyCheck(String imageName, String projectRepository, Map options = [:]) {
-    String reportFile = ".trivy-report-${currentBuild.startTimeInMillis}.txt"
-
-    try {
-        validateImageWithTrivy(imageName, ['reportFile': reportFile])
-    } catch (err) {
-        unstable("Image '${imageName}' failed validation !")
-    } finally {
-        String lintReport = ''
-
-        if (fileExists(reportFile)) {
-            lintReport = """${lintReport}
-            |
-            |```
-            |${readFile(reportFile)}
-            |```"""
-        } else {
-            lintReport = """${lintReport}
-            |
-            |_Vérification échouée mais aucun rapport trouvé !?_ :thinking:"""
-        }
-
-        String defaultReport = '_Rien à signaler !_ :thumbsup:'
-        String report = """## Validation de l'image `${imageName}`
-        |
-        |${lintReport ?: defaultReport}
-        """.stripMargin()
-
-        print report
-
-        if (env.CHANGE_ID) {
-            gitea.commentPullRequest(projectRepository, env.CHANGE_ID, report)
-        }
-    }
-}
-
-String validateImageWithTrivy(String imageName, Map options = [:]) {
-    String trivyBin = getOrInstallTrivy(options)
-    String trivyArgs = options.get('trivyArgs', '--exit-code 1')
-    String cacheDirectory = options.get('cacheDirectory', '.trivy/.cache')
-    String cacheDefaultBranch = options.get('cacheDefaultBranch', 'develop')
-    Integer cacheMaxSize = options.get('cacheMaxSize', 250)
-    String reportFile = options.get('reportFile', ".trivy-report-${currentBuild.startTimeInMillis}.txt")
-
-    cache(maxCacheSize: cacheMaxSize, defaultBranch: cacheDefaultBranch, caches: [
-        [$class: 'ArbitraryFileCache', path: cacheDirectory, compressionMethod: 'TARGZ']
-    ]) {
-        sh("'${trivyBin}' --cache-dir '${cacheDirectory}' image -o '${reportFile}' ${trivyArgs} '${imageName}'")
-    }
-
-    return reportFile
-}
-
-String getOrInstallHadolint(Map options = [:]) {
-    String installDir = options.get('installDir', '/usr/local/bin')
-    String version = options.get('version', '2.10.0')
-    String forceDownload = options.get('forceDownload', false)
-    String downloadUrl = options.get('downloadUrl', "https://github.com/hadolint/hadolint/releases/download/v${version}/hadolint-Linux-x86_64")
-
-    String hadolintBin = sh(returnStdout: true, script: 'which hadolint || exit 0').trim()
-    if (hadolintBin == '' || forceDownload) {
-        sh("""
-        mkdir -p '${installDir}'
-        curl -o '${installDir}/hadolint' -sSL '${downloadUrl}'
-        chmod +x '${installDir}/hadolint'
-        """)
-
-        hadolintBin = "${installDir}/hadolint"
-    }
-
-    return hadolintBin
-}
-
-String getOrInstallTrivy(Map options = [:]) {
-    String installDir = options.get('installDir', '/usr/local/bin')
-    String version = options.get('version', '0.27.1')
-    String forceDownload = options.get('forceDownload', false)
-    String installScriptDownloadUrl = options.get('downloadUrl', 'https://raw.githubusercontent.com/aquasecurity/trivy/main/contrib/install.sh')
-
-    String trivyBin = sh(returnStdout: true, script: 'which trivy || exit 0').trim()
-    if (trivyBin == '' || forceDownload) {
-        sh("""
-        mkdir -p '${installDir}'
-        curl -sfL '${installScriptDownloadUrl}'  | sh -s -- -b '${installDir}' v${version}
-        chmod +x '${installDir}/trivy'
-        """)
-
-        trivyBin = "${installDir}/trivy"
-    }
-
-    return trivyBin
-}

vars/gitea.groovy

@@ -1,4 +1,4 @@
-def commentPullRequest(String repo, String issueId, String comment, Integer commentIndex = -1) {
+def commentPullRequest(String repo, String issueId, String comment, Integer commentIndex = 0) {
   comment = comment.replaceAll('"', '\\"')
   withCredentials([
     string(credentialsId: 'GITEA_JENKINS_PERSONAL_TOKEN', variable: 'GITEA_TOKEN'),
@@ -7,9 +7,6 @@ def commentPullRequest(String repo, String issueId, String comment, Integer comm
     sh """#!/bin/bash
     set -xeo pipefail
 
-    previous_comment_id=null
-
-    if [ "${commentIndex}" != "-1" ]; then
     # Récupération si il existe du commentaire existant
     previous_comment_id=\$(curl -v --fail \
       -H "Authorization: token ${GITEA_TOKEN}" \
@@ -17,7 +14,6 @@ def commentPullRequest(String repo, String issueId, String comment, Integer comm
       https://forge.cadoles.com/api/v1/repos/${repo}/issues/${issueId}/comments \
       | jq -c '[ .[] | select(.user.login=="jenkins") ] | .[${commentIndex}] | .id' \
     )
-    fi
 
     # Génération du payload pour l'API Gitea
     echo '{}' | jq -c --rawfile body .prComment '.body = \$body' > payload.json

vars/nfpm.groovy

@@ -1,25 +0,0 @@
-// Package project with nfpm
-// See https://nfpm.goreleaser.com/
-def package(Map options = [:]) {
-    String installDir = options.get("nfpmInstallDir", "/usr/local/bin")
-    String nfpmVersion = options.get("nfpmVersion", "2.15.1")
-    String nfpmForceDownload = options.get("nfpmForceDownload", false)
-    String nfpmDownloadUrl = options.get("nfpmDownloadUrl", "https://github.com/goreleaser/nfpm/releases/download/${nfpmVersion}/nfpm_${nfpmVersion}_Linux_x86_64.tar.gz")
-    String nfpmConfig = options.get("nfpmConfig", "nfpm.yaml")
-    String nfpmTarget = options.get("nfpmTarget", ".")
-    String nfpmPackager = options.get("nfpmPackager", "")
-
-    String nfpmBin = sh(returnStdout: true, script: 'which nfpm').trim("")
-    if (nfpmBin == "" || nfpmForceDownload) {
-        sh("""
-        mkdir -p '${installDir}'
-        curl -L '${nfpmDownloadUrl}' > /tmp/nfpm.tar.gz
-        tar -C /usr/local/bin -xzf /tmp/nfpm.tar.gz
-        """)
-    }
-
-    sh("""
-        export PATH='${installDir}:${env.PATH}'
-        nfpm --config '${nfpmConfig}' ${nfpmPackager ? "--packager "+nfpmPackager : ""} --target '${nfpmTarget}'
-    """)
-}

vars/symfonyAppPipeline.groovy

@@ -1,26 +1,15 @@
 import org.jenkinsci.plugins.pipeline.modeldefinition.Utils
 
-def call(String baseImage = 'ubuntu:22.04', Map options = [:]) {
+def call(String baseImage = 'ubuntu:22.04') {
-  Map hooks = options.get('hooks', [:])
-  String jobHistory = options.get('jobHistory', '10')
-
   node {
-    properties([
-      buildDiscarder(logRotator(daysToKeepStr: jobHistory, numToKeepStr: jobHistory)),
-    ])
-    stage('Cancel older jobs') {
-      def buildNumber = env.BUILD_NUMBER as int
-      if (buildNumber > 1) milestone(buildNumber - 1)
-      milestone(buildNumber)
-    }
     stage('Checkout project') {
       checkout(scm)
     }
     stage('Run pre hooks') {
-      runHook(hooks, 'preSymfonyAppPipeline')
+      hook('pre-symfony-app')
     }
     stage('Run in Symfony image') {
-      def symfonyImage = buildDockerImage(baseImage, hooks)
+      def symfonyImage = buildDockerImage(baseImage)
       symfonyImage.inside() {
         def repo = env.JOB_NAME
         if (env.BRANCH_NAME ==~ /^PR-.*$/) {
@@ -40,7 +29,7 @@ def call(String baseImage = 'ubuntu:22.04', Map options = [:]) {
                 def auditReport = sh(script: 'local-php-security-checker --format=markdown || true', returnStdout: true)
                 if (auditReport.trim() != '') {
                   if (env.CHANGE_ID) {
-                    gitea.commentPullRequest(repo, env.CHANGE_ID, auditReport)
+                    gitea.commentPullRequest(repo, env.CHANGE_ID, auditReport, 0)
                   } else {
                     print auditReport
                   }
@@ -66,7 +55,7 @@ def call(String baseImage = 'ubuntu:22.04', Map options = [:]) {
                 '''
                 def report = sh(script: 'junit2md php-cs-fixer.xml', returnStdout: true)
                 if (env.CHANGE_ID) {
-                  gitea.commentPullRequest(repo, env.CHANGE_ID, report)
+                  gitea.commentPullRequest(repo, env.CHANGE_ID, report, 1)
                 } else {
                   print report
                 }
@@ -87,7 +76,7 @@ def call(String baseImage = 'ubuntu:22.04', Map options = [:]) {
                 report = '## Rapport PHPStan\n\n```\n' + report
                 report = report + '\n```\n'
                 if (env.CHANGE_ID) {
-                  gitea.commentPullRequest(repo, env.CHANGE_ID, report)
+                  gitea.commentPullRequest(repo, env.CHANGE_ID, report, 2)
                 } else {
                   print report
                 }
@@ -98,12 +87,12 @@ def call(String baseImage = 'ubuntu:22.04', Map options = [:]) {
       }
     }
     stage('Run post hooks') {
-      runHook(hooks, 'postSymfonyAppPipeline')
+      hook('post-symfony-app')
     }
   }
 }
 
-void buildDockerImage(String baseImage, Map hooks) {
+def buildDockerImage(String baseImage) {
   def imageName = 'cadoles-symfony-ci'
   dir(".${imageName}") {
     def dockerfile = libraryResource 'com/cadoles/symfony/Dockerfile'
@@ -112,7 +101,7 @@ void buildDockerImage(String baseImage, Map hooks) {
     def addLetsEncryptCA = libraryResource 'com/cadoles/common/add-letsencrypt-ca.sh'
     writeFile file:'add-letsencrypt-ca.sh', text:addLetsEncryptCA
 
-    runHook(hooks, 'buildSymfonyImage')
+    hook('build-symfony-image')
 
     def safeJobName = URLDecoder.decode(env.JOB_NAME).toLowerCase().replace('/', '-').replace(' ', '-')
     def imageTag = "${safeJobName}-${env.BUILD_ID}"
@@ -120,15 +109,14 @@ void buildDockerImage(String baseImage, Map hooks) {
   }
 }
 
-void runHook(Map hooks, String name) {
+def when(boolean condition, body) {
-  if (!hooks[name]) {
+  def config = [:]
-    println("No hook '${name}' defined. Skipping.")
+  body.resolveStrategy = Closure.OWNER_FIRST
-    return
+  body.delegate = config
-  }
 
-  if (hooks[name] instanceof Closure) {
+  if (condition) {
-    hooks[name]()
+    body()
     } else {
-    error("Hook '${name}' seems to be defined but is not a closure !")
+    Utils.markStageSkippedForConditional(STAGE_NAME)
   }
 }

vars/utils.groovy

@@ -1,13 +0,0 @@
-import org.jenkinsci.plugins.pipeline.modeldefinition.Utils
-
-void when(Boolean condition, body) {
-    Map config = [:]
-    body.resolveStrategy = Closure.OWNER_FIRST
-    body.delegate = config
-
-    if (condition) {
-        body()
-    } else {
-        Utils.markStageSkippedForConditional(STAGE_NAME)
-    }
-}