-
Notifications
You must be signed in to change notification settings - Fork 570
/
Jenkinsfile-Internal-Release
195 lines (167 loc) · 7.77 KB
/
Jenkinsfile-Internal-Release
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
/*
* Copyright (c) 2016-present Sonatype, Inc. All rights reserved.
* Includes the third-party code listed at http://links.sonatype.com/products/nexus/attributions.
* "Sonatype" is a trademark of Sonatype, Inc.
*/
@Library(['private-pipeline-library', 'jenkins-shared']) _
import com.sonatype.jenkins.pipeline.OsTools
String OPENJDK17 = 'OpenJDK 17'
List<String> javaVersions = [OPENJDK17]
properties([
parameters([
string(defaultValue: '', description: 'New Nexus Repository Manager Version', name: 'nexus_repository_manager_version'),
string(defaultValue: '', description: 'New Nexus Repository Manager URL (Optional)', name: 'nexus_repository_manager_url'),
choice(name: 'java_version', choices: javaVersions, description: 'Java version to run Nexus Repository Manager'),
booleanParam(defaultValue: false, description: 'Optional scan for policy violations', name: 'scan_for_policy_violations')
])
])
node('ubuntu-zion') {
def commitId, commitDate, version, imageId, alpineImageId, branch
def imageName = 'sonatype/nexus3',
archiveName = 'docker-nexus3'
def JAVA_17 = 'java17'
def DOCKERFILE_JAVA_17 = 'Dockerfile.java17'
def DOCKERFILE_ALPINE_JAVA_17 = 'Dockerfile.alpine.java17'
def dockerfileMap = [
(OPENJDK17): [DOCKERFILE_JAVA_17, DOCKERFILE_ALPINE_JAVA_17]
]
try {
stage('Preparation') {
deleteDir()
OsTools.runSafe(this, "docker system prune -a -f")
def checkoutDetails = checkout scm
branch = checkoutDetails.GIT_BRANCH == 'origin/main' ? 'main' : checkoutDetails.GIT_BRANCH
commitId = checkoutDetails.GIT_COMMIT
commitDate = OsTools.runSafe(this, "git show -s --format=%cd --date=format:%Y%m%d-%H%M%S ${commitId}")
OsTools.runSafe(this, 'git config --global user.email [email protected]')
OsTools.runSafe(this, 'git config --global user.name Sonatype CI')
version = readVersion()
if (params.nexus_repository_manager_version) {
stage('Update Repository Manager Version') {
OsTools.runSafe(this, "git checkout ${branch}")
dockerfileMap[OPENJDK17].each { dockerfile ->
updateRepositoryManagerVersion("${pwd()}/${dockerfile}", JAVA_17)
}
version = getShortVersion(params.nexus_repository_manager_version)
}
}
}
def dockerfilePath = dockerfileMap[OPENJDK17][0]
def alpineDockerfilePath = dockerfileMap[OPENJDK17][1]
stage('Build UBI Image') {
def baseImage = extractBaseImage(dockerfilePath)
def baseImageRefFactory = load 'scripts/BaseImageReference.groovy'
def baseImageReference = baseImageRefFactory.build(this, baseImage as String)
def baseImageReferenceStr = baseImageReference.getReference()
def hash = OsTools.runSafe(this, "docker build --quiet --label base-image-ref='${baseImageReferenceStr}' --no-cache --tag ${imageName} . -f ${dockerfilePath}")
imageId = hash.split(':')[1]
}
stage('Build Alpine Image') {
def hash = OsTools.runSafe(this, "docker build --quiet --no-cache --tag ${imageName}-alpine . -f ${alpineDockerfilePath}")
alpineImageId = hash.split(':')[1]
}
if (params.scan_for_policy_violations) {
stage('Evaluate Policies') {
def imagesToScan = [
[name: 'docker-nexus3', image: imageName],
[name: 'docker-nexus3-alpine', image: "${imageName}-alpine"]
]
imagesToScan.each { imageConfig ->
runEvaluation({ stage ->
def iqApplicationName = imageConfig.name
def imageToScan = imageConfig.image
nexusPolicyEvaluation(
iqStage: stage,
iqApplication: iqApplicationName,
iqScanPatterns: [[scanPattern: "container:${imageToScan}"]],
failBuildOnNetworkError: false,
)
}, 'release')
}
}
}
if (currentBuild.result == 'FAILURE') {
return
}
stage('Archive') {
dir('build/target') {
OsTools.runSafe(this, "docker save ${imageName} | gzip > ${archiveName}.tar.gz")
archiveArtifacts artifacts: "${archiveName}.tar.gz", onlyIfSuccessful: true
}
}
if (branch == 'main') {
stage('Push image to RSC') {
withSonatypeDockerRegistry() {
// Tag Images
sh "docker tag ${imageId} docker-all.repo.sonatype.com/sonatype-internal/nexus3:${version}"
sh "docker tag ${imageId} docker-all.repo.sonatype.com/sonatype-internal/nexus3:${version}-ubi"
sh "docker tag ${imageId} docker-all.repo.sonatype.com/sonatype-internal/nexus3:${version}-java17-ubi"
sh "docker tag ${alpineImageId} docker-all.repo.sonatype.com/sonatype-internal/nexus3:${version}-alpine"
sh "docker tag ${alpineImageId} docker-all.repo.sonatype.com/sonatype-internal/nexus3:${version}-java17-alpine"
// Push Images
sh "docker push docker-all.repo.sonatype.com/sonatype-internal/nexus3:${version}"
sh "docker push docker-all.repo.sonatype.com/sonatype-internal/nexus3:${version}-ubi"
sh "docker push docker-all.repo.sonatype.com/sonatype-internal/nexus3:${version}-java17-ubi"
sh "docker push docker-all.repo.sonatype.com/sonatype-internal/nexus3:${version}-alpine"
sh "docker push docker-all.repo.sonatype.com/sonatype-internal/nexus3:${version}-java17-alpine"
}
}
}
} finally {
OsTools.runSafe(this, "docker logout")
OsTools.runSafe(this, "docker system prune -a -f")
OsTools.runSafe(this, 'git clean -f && git reset --hard origin/main')
}
}
def readVersion() {
def content = readFile 'Dockerfile.java17'
for (line in content.split('\n')) {
if (line.startsWith('ARG NEXUS_VERSION=')) {
return getShortVersion(line.substring(18))
}
}
error 'Could not determine version.'
}
def getShortVersion(version) {
return version.split('-')[0]
}
def updateRepositoryManagerVersion(dockerFileLocation, javaVersion) {
def dockerFile = readFile(file: dockerFileLocation)
def metaVersionRegex = /(version=")(\d\.\d{1,3}\.\d\-\d{2})(" \\)/
def metaShortVersionRegex = /(release=")(\d\.\d{1,3}\.\d)(" \\)/
def versionRegex = /(ARG NEXUS_VERSION=)(\d\.\d{1,3}\.\d\-\d{2})/
def shaRegex = /(ARG NEXUS_DOWNLOAD_SHA256_HASH=)([A-Fa-f0-9]{64})/
dockerFile = dockerFile.replaceAll(metaVersionRegex, "\$1${params.nexus_repository_manager_version}\$3")
dockerFile = dockerFile.replaceAll(metaShortVersionRegex,
"\$1${params.nexus_repository_manager_version.substring(0, params.nexus_repository_manager_version.indexOf('-'))}\$3")
dockerFile = dockerFile.replaceAll(versionRegex, "\$1${params.nexus_repository_manager_version}")
def nexusUrlRegex = /(ARG NEXUS_DOWNLOAD_URL=)(.*)/
def nexusUrl = params.nexus_repository_manager_url
if (params.nexus_repository_manager_url) {
dockerFile = dockerFile.replaceAll(nexusUrlRegex, "\$1${params.nexus_repository_manager_url}")
}
else {
// default URL
def defaultUrl = /https:\/\/download-staging.sonatype.com\/nexus\/3\/nexus-\$\{NEXUS_VERSION\}-unix\.tar\.gz/
dockerFile = dockerFile.replaceAll(nexusUrlRegex, "\$1${defaultUrl}")
def normalizedUrl = "a".replaceAll(/./, "${defaultUrl}")
nexusUrl = normalizedUrl.replace("\${NEXUS_VERSION}", params.nexus_repository_manager_version)
nexusUrl = nexusUrl.replace("\${JAVA_VERSION}", javaVersion)
}
def sha = getSha(nexusUrl)
dockerFile = dockerFile.replaceAll(shaRegex, "\$1${sha}")
writeFile(file: dockerFileLocation, text: dockerFile)
}
def getSha(url) {
def sha = sh (
script: "curl -s -L ${url} | shasum -a 256 | cut -d' ' -f1",
returnStdout: true
).trim()
return sha
}
def extractBaseImage(dockerFileLocation) {
def dockerFile = readFile(file: dockerFileLocation)
def baseImageRegex = "FROM\\s+([^\\s]+)"
def usedImages = dockerFile =~ baseImageRegex
return usedImages[0][1]
}