forked from jenkins-infra/pipeline-library
/
buildDockerAndPublishImage.groovy
245 lines (224 loc) · 11.2 KB
/
buildDockerAndPublishImage.groovy
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
import io.jenkins.infra.InfraConfig
import java.text.SimpleDateFormat
import java.util.Date
import java.text.DateFormat
def call(String imageName, Map userConfig=[:]) {
def defaultConfig = [
useContainer: true, // Wether to use a container (with a container-less and root-less tool) or a VM (with a full-fledged Docker Engine) for executing the steps
agentLabels: 'docker || linux-amd64-docker', // String expression for the labels the agent must match
builderImage: 'jenkinsciinfra/builder:2.0.2', // Version managed by updatecli
automaticSemanticVersioning: false, // Do not automagically increase semantic version by default
dockerfile: 'Dockerfile', // Obvious default
platform: 'linux/amd64', // Intel/AMD 64 Bits, following Docker platform identifiers
nextVersionCommand: 'jx-release-version', // Commmand line used to retrieve the next version
gitCredentials: '', // Credential ID for tagging and creating release
imageDir: '.', // Relative path to the context directory for the Docker build
]
// Merging the 2 maps - https://blog.mrhaki.com/2010/04/groovy-goodness-adding-maps-to-map_21.html
final Map finalConfig = defaultConfig << userConfig
// Retrieve Library's Static File Resources
final String makefileContent = libraryResource 'io/jenkins/infra/docker/Makefile'
final boolean semVerEnabled = finalConfig.automaticSemanticVersioning && env.BRANCH_IS_PRIMARY
final Date now = new Date()
DateFormat dateFormat = new SimpleDateFormat("yyyy-MM-dd'T'HH:mm:ssXXX")
final String buildDate = dateFormat.format(now)
final String operatingSystem = finalConfig.platform.split('/')[0]
final String cpuArch = finalConfig.platform.split('/')[1]
withContainerEngineAgent(finalConfig, {
withEnv([
"BUILD_DATE=${buildDate}",
"IMAGE_NAME=${imageName}",
"IMAGE_DIR=${finalConfig.imageDir}",
"IMAGE_DOCKERFILE=${finalConfig.dockerfile}",
"IMAGE_PLATFORM=${finalConfig.platform}",
"PATH+BINS=${env.WORKSPACE}/.bin", // Add to the path the directory with the custom binaries that could be installed during the build
]) {
infra.withDockerPullCredentials{
stage("Prepare ${imageName}") {
checkout scm
// The makefile to use must come from the pipeline to avoid a nasty user trying to exfiltrate data from the build
// Even though we have mitigation through the multibranch job config allowing to build PRs only from the repository contributors
writeFile file: 'Makefile', text: makefileContent
// Custom tools might be installed in the .bin directory in the workspace
sh 'mkdir -p "${WORKSPACE}/.bin"'
} // stage
// Automatic tagging on principal branch is not enabled by default
if (semVerEnabled) {
stage("Get Next Version of ${imageName}") {
if (finalConfig.nextVersionCommand.contains('jx-release-version')) {
withEnv([
"jxrv_url=https://github.com/jenkins-x-plugins/jx-release-version/releases/download/v2.5.1/jx-release-version-${operatingSystem}-${cpuArch}.tar.gz", // TODO: track with updatecli
]) {
sh '''
if ! command -v jx-release-version 2>/dev/null >/dev/null
then
echo "INFO: No jx-release-version binary found: Installing it from ${jxrv_url}."
curl --silent --location "${jxrv_url}" | tar xzv
mv ./jx-release-version "${WORKSPACE}/.bin/jx-release-version"
fi
'''
}
}
sh 'git fetch --all --tags' // Ensure that all the tags are retrieved (uncoupling from job configuration, wether tags are fetched or not)
nextVersion = sh(script: finalConfig.nextVersionCommand, returnStdout: true).trim()
echo "Next Release Version = $nextVersion"
} // stage
} // if
stage("Lint ${imageName}") {
// Define the image name as prefix to support multi images per pipeline
def hadolintReportId = "${imageName.replaceAll(':','-')}-hadolint-${now.getTime()}"
def hadoLintReportFile = "${hadolintReportId}.json"
withEnv(["HADOLINT_REPORT=${env.WORKSPACE}/${hadoLintReportFile}"]) {
try {
sh 'make lint'
} finally {
recordIssues(
enabledForFailure: true,
aggregatingResults: false,
tool: hadoLint(id: hadolintReportId, pattern: hadoLintReportFile)
)
}
}
} // stage
stage("Build ${imageName}") {
sh 'make build'
} //stage
// There can be 2 kind of tests: per image and per repository
[
'Image Test Harness': "${finalConfig.imageDir}/cst.yml",
'Common Test Harness': "${env.WORKSPACE}/common-cst.yml"
].each { testName, testHarness ->
if (fileExists(testHarness)) {
stage("Test ${testName} for ${imageName}") {
withEnv([
"TEST_HARNESS=${testHarness}",
"cst_url=https://github.com/GoogleContainerTools/container-structure-test/releases/download/v1.11.0/container-structure-test-${operatingSystem}-${cpuArch}", // TODO: track with updatecli
]) {
sh '''
if ! command -v container-structure-test 2>/dev/null >/dev/null
then
echo "INFO: No container-structure-test binary found: Installing it from ${cst_url}."
curl --silent --location --output "${WORKSPACE}/.bin/container-structure-test" "${cst_url}"
chmod a+x "${WORKSPACE}/.bin/container-structure-test"
fi
make test
'''
} // withEnv
} //stage
} // if
}
// Automatic tagging on principal branch is not enabled by default
if (semVerEnabled) {
stage("Semantic Release of ${imageName}") {
echo "Configuring credential.helper"
sh 'git config --local credential.helper "!f() { echo username=\\$GIT_USERNAME; echo password=\\$GIT_PASSWORD; }; f"'
withCredentials([
usernamePassword(credentialsId: "${finalConfig.gitCredentials}", passwordVariable: 'GIT_PASSWORD', usernameVariable: 'GIT_USERNAME')
]) {
withEnv(["NEXT_VERSION=${nextVersion}"]) {
echo "Tagging and pushing the new version: $nextVersion"
sh '''
git config user.name "${GIT_USERNAME}"
git config user.email "jenkins-infra@googlegroups.com"
git tag -a "${NEXT_VERSION}" -m "${IMAGE_NAME}"
git push origin --tags
'''
} // withEnv
} // withCredentials
} // stage
} // if
}// withDockerPullCredentials
infra.withDockerPushCredentials{
if (env.TAG_NAME || env.BRANCH_IS_PRIMARY) {
stage("Deploy ${imageName}") {
final InfraConfig infraConfig = new InfraConfig(env)
String imageDeployName = infraConfig.dockerRegistry + '/' + imageName
if (env.TAG_NAME) {
// User could specify a tag in the image name. In that case the git tag is appended. Otherwise the docker tag is set to the git tag.
if (imageDeployName.contains(':')) {
imageDeployName += "-${env.TAG_NAME}"
} else {
imageDeployName += ":${env.TAG_NAME}"
}
}
withEnv(["IMAGE_DEPLOY_NAME=${imageDeployName}"]) {
// Please note that "make deploy" uses the environment variable "IMAGE_DEPLOY_NAME"
sh 'make deploy'
} // withEnv
} //stage
} // if
} // withDockerPushCredentials
if (env.TAG_NAME && finalConfig.automaticSemanticVersioning) {
stage('GitHub Release') {
withCredentials([
usernamePassword(credentialsId: "${finalConfig.gitCredentials}", passwordVariable: 'GITHUB_TOKEN', usernameVariable: 'GITHUB_USERNAME')
]) {
final String origin = sh(returnStdout: true, script: 'git remote -v | grep origin | grep push | sed \'s/^origin\\s//\' | sed \'s/\\s(push)//\'').trim() - '.git'
final String org = origin.split('/')[3]
final String repository = origin.split('/')[4]
final String ghVersion = '2.5.2' // TODO: track with updatecli
final String platformId = "${operatingSystem}_${cpuArch}"
final String ghUrl = "https://github.com/cli/cli/releases/download/v${ghVersion}/gh_${ghVersion}_${platformId}.tar.gz"
final String ghReleasesApiUri = "/repos/${org}/${repository}/releases"
withEnv([
"GH_URL=${ghUrl}",
"GH_RELEASES_API_URI=${ghReleasesApiUri}",
]) {
sh '''
if ! command -v gh 2>/dev/null >/dev/null
then
echo "INFO: No gh binary found: Installing it from ${ghUrl}."
temp_dir="$(mktemp -d)"
curl --silent --show-error --location --output "${temp_dir}/gh.tgz" "${GH_URL}"
tar xvfz "${temp_dir}/gh.tgz" -C "${temp_dir}"
mv "$(find "${temp_dir}"/*/bin -type f -name gh)" "${WORKSPACE}/.bin/gh"
rm -rf "${temp_dir}"
gh --version
fi
'''
final String release = sh(returnStdout: true, script: 'gh api ${GH_RELEASES_API_URI} | jq -e -r \'. | max_by(.id) | select(.draft == true and .name == "next").id\'').trim()
withEnv(["GH_NEXT_RELEASE_URI=${ghReleasesApiUri}/${release}"]) {
sh 'gh api -X PATCH -F draft=false -F name="${TAG_NAME}" -F tag_name="${TAG_NAME}" "${GH_NEXT_RELEASE_URI}"'
} // withEnv
} // withEnv
} // withCredentials
} // stage
} // if
} // withEnv
}) // withContainerEngineAgent
} // call
def withContainerEngineAgent(finalConfig, body) {
if (finalConfig.useContainer) {
// The podTemplate must define only a single container, named `jnlp`
// Ref - https://support.cloudbees.com/hc/en-us/articles/360054642231-Considerations-for-Kubernetes-Clients-Connections-when-using-Kubernetes-Plugin
podTemplate(
annotations: [
podAnnotation(key: 'container.apparmor.security.beta.kubernetes.io/jnlp', value: 'unconfined'),
podAnnotation(key: 'container.seccomp.security.alpha.kubernetes.io/jnlp', value: 'unconfined'),
],
containers: [
// This container must be named `jnlp` and should use the default entrypoint/cmd (command/args) inherited from inbound-agent parent image
containerTemplate(
name: 'jnlp',
image: finalConfig.builderImage,
resourceRequestCpu: '2',
resourceLimitCpu: '2',
resourceRequestMemory: '2Gi',
resourceLimitMemory: '2Gi',
),
]
) {
node(POD_LABEL) {
withEnv(['CONTAINER_BIN=img', 'CST_DRIVER=tar']) {
body.call()
}
}
}
} else {
node(finalConfig.agentLabels) {
withEnv(['CONTAINER_BIN=docker', 'CST_DRIVER=docker',]) {
body.call()
}
}
}
}