Jenkinsfile

// Copyright (c) 2018-2026 Progress Software Corporation and/or its subsidiaries or affiliates. All Rights Reserved.
// This Jenkinsfile defines internal MarkLogic build pipeline.
// The pipeline builds, tests, scans, and optionally publishes MarkLogic Docker images.
// It can be triggered manually, by pull requests, or on a schedule.

//Shared library definitions: https://github.com/marklogic/MarkLogic-Build-Libs/tree/1.0-declarative/vars
@Library('shared-libraries@1.0-declarative')
import groovy.json.JsonSlurperClassic

gitCredID = 'marklogic-builder-github'
dockerRegistry = 'ml-docker-db-dev-tierpoint.bed-artifactory.bedford.progress.com'
pdcDevRegistry = 'marklogicclouddev.azurecr.io'
JIRA_ID_PATTERN = /(?i)(MLE)-\d{3,6}/
JIRA_ID = ''
LINT_OUTPUT = ''
SCAN_OUTPUT = ''
IMAGE_SIZE = 0
RPMversion = ''
GRAVITON3_IMAGE_ARCHIVE = 'marklogic-image.tar'
builtImage = ''
publishImage = ''
latestTag = ''
upgradeDockerImage = ''

// Define local funtions

/**
 * Determines if the current build is for an ARM image type.
 * ARM workers (e.g., Graviton3) are only available for selected MarkLogic versions (currently 11 and 12).
 * @return true if dockerImageType contains 'arm', false otherwise.
 */
@NonCPS
def isArmImage() {
    return params.dockerImageType.toLowerCase().contains('arm')
}
/**
 * Loads email configuration from the KUBE_NINJAS_PIPELINE_EMAILS Jenkins secret file credential.
 * The credential file must contain key=value lines for 'emailList' and 'emailSecList'.
 * @return A map with keys 'emailList' and 'emailSecList'.
 */
Map loadEmailConfig() {
    def result = [emailList: '', emailSecList: '']
    withCredentials([file(credentialsId: 'KUBE_NINJAS_PIPELINE_EMAILS', variable: 'emailConfigFile')]) {
        def props = readProperties file: emailConfigFile
        result.emailList = (props.emailList ?: '').trim()
        result.emailSecList = (props.emailSecList ?: '').trim()
        if (!result.emailList || !result.emailSecList) {
            error("KUBE_NINJAS_PIPELINE_EMAILS must define non-empty 'emailList' and 'emailSecList' properties")
        }
    }
    return result
}

/**
 * Returns the build branch value used in image metadata and tests.
 * PR builds use PR-<id>; non-PR builds use the branch name.
 */
String getBuildBranchValue() {
    if (env.CHANGE_ID?.trim()) {
        return "PR-${env.CHANGE_ID.trim()}"
    }
    if (env.BRANCH_NAME?.trim()) {
        return env.BRANCH_NAME.trim()
    }
    return (env.GIT_BRANCH ?: 'local').toString().trim()
}

/**
 * Performs pre-build checks:
 * - Initializes parameters as environment variables.
 * - Extracts Jira ID from branch name or PR title.
 * - Checks if the PR is a draft or has requested changes (for PR builds).
 * - Validates ARM image types are only used with MarkLogic 11 and 12.
 */
void preBuildCheck() {
    // Initialize parameters as env variables (workaround for https://issues.jenkins-ci.org/browse/JENKINS-41929)
    evaluate """${ def script = ''; params.each { k, v -> script += "env.${k} = '''${v}'''\n" }; return script}"""

    JIRA_ID = extractJiraID()
    echo 'Jira ticket number: ' + JIRA_ID

    if (env.GIT_URL) {
        githubAPIUrl = GIT_URL.replace('.git', '').replace('github.com', 'api.github.com/repos')
        echo 'githubAPIUrl: ' + githubAPIUrl
    } else {
        echo 'Warning: GIT_URL is not defined'
    }

    if (env.CHANGE_ID) {
        if (prDraftCheck()) { sh 'exit 1' }
        if (getReviewState().equalsIgnoreCase('CHANGES_REQUESTED')) {
            echo 'PR changes requested. (' + reviewState + ') Aborting.'
            sh 'exit 1'
        }
    }
}

/**
 * Extracts a Jira ID (e.g., MLE-1234) from the PR title or branch name.
 * @return The extracted Jira ID string, or an empty string if not found.
 */
@NonCPS
def extractJiraID() {
    // Extract Jira ID from one of the environment variables
    def match
    if (env.CHANGE_TITLE) {
        match = env.CHANGE_TITLE =~ JIRA_ID_PATTERN
    }
    else if (env.BRANCH_NAME) {
        match = env.BRANCH_NAME =~ JIRA_ID_PATTERN
    }
    else if (env.GIT_BRANCH) {
        match = env.GIT_BRANCH =~ JIRA_ID_PATTERN
    }
    else {
        echo 'Warning: No Git title or branch available.'
        return ''
    }
    try {
        return match[0][0]
    } catch (any) {
        echo 'Warning: Jira ticket number not detected.'
        return ''
    }
}

/**
 * Checks if the current Pull Request is marked as a draft via GitHub API.
 * Requires CHANGE_ID and GIT_URL environment variables.
 * @return true if the PR is a draft, false otherwise.
 */
def prDraftCheck() {
    withCredentials([usernameColonPassword(credentialsId: gitCredID, variable: 'Credentials')]) {
        PrObj = sh(returnStdout: true, script:'''
                    curl -s -u $Credentials  -X GET  ''' + githubAPIUrl + '''/pulls/$CHANGE_ID
                    ''')
    }
    def jsonObj = new JsonSlurperClassic().parseText(PrObj.toString().trim())
    return jsonObj.draft
}

/**
 * Gets the review state of the current Pull Request via GitHub API.
 * Requires CHANGE_ID and GIT_URL environment variables.
 * @return The review state string (e.g., 'APPROVED', 'CHANGES_REQUESTED').
 */
def getReviewState() {
    def reviewResponse
    def commitHash
    withCredentials([usernameColonPassword(credentialsId: gitCredID, variable: 'Credentials')]) {
        reviewResponse = sh(returnStdout: true, script:'''
                            curl -s -u $Credentials  -X GET  ''' + githubAPIUrl + '''/pulls/$CHANGE_ID/reviews
                            ''')
        commitHash = sh(returnStdout: true, script:'''
                        curl -s -u $Credentials  -X GET  ''' + githubAPIUrl + '''/pulls/$CHANGE_ID
                        ''')
    }
    def jsonObj = new JsonSlurperClassic().parseText(commitHash.toString().trim())
    def commitId = jsonObj.head.sha
    def reviewState = getReviewStateOfPR reviewResponse, 2, commitId
    echo reviewState
    return reviewState
}

/**
 * Sends an email notification with the build status and summary.
 * Includes links to build URL, test reports, scan reports, and Jira ticket (if found).
 * @param status The build status string (e.g., 'Success', 'Failure').
 */
void resultNotification(status) {
    def paramEmailList = params.emailList?.trim()
    def needSecList = params.SCAP_SCAN && BRANCH_NAME == 'develop'
    def emailConfig = (!paramEmailList || needSecList) ? loadEmailConfig() : null
    def baseEmailList = paramEmailList ?: emailConfig.emailList
    def emailSecList = emailConfig?.emailSecList ?: ''
    def author, authorEmail, emailList
    if (env.CHANGE_AUTHOR) {
        author = env.CHANGE_AUTHOR.toString().trim().toLowerCase()
        authorEmail = getEmailFromGITUser author
        emailList = baseEmailList + ',' + authorEmail
    } else {
        emailList = baseEmailList
    }
    
    email_body = "<b>Build URL: </b><a href='${env.BUILD_URL}'>${env.BUILD_URL}</a><br/>" +
                 "<b>Image type: </b>${env.dockerImageType}<br/><br/>" +
                 "<b>Lint Output: </b><br/>" +
                 "<pre><code>${LINT_OUTPUT}</code></pre><br/>" +
                 "<b>Vulnerabilities: </b><pre><code>${SCAN_OUTPUT}</code></pre><br/>" +
                 "<b><a href='${env.BUILD_URL}artifact/scan/report-${env.dockerImageType}.json'>Full scan report.</a></b><br/>" +
                 "<b>Image Size:  <br/></b>${IMAGE_SIZE} <br/>" +
                 "<pre><code>docker pull ${dockerRegistry}/${latestTag}</code></pre><br/><br/>"
    if (params.DOCKER_TESTS) {
        email_body = "${email_body} <b><a href='${env.BUILD_URL}Docker_20Tests_20Report'>Docker Tests Report</a></b><br/>"
    } else {
        email_body = "${email_body} <b>Docker Tests Skipped</b><br/>"
    }
    if (params.SCAP_SCAN) {
        email_body = "${email_body} <b><a href='${env.BUILD_URL}Open_20SCAP_20Report'>SCAP Scan Report</a></b><br/>"
        if ( BRANCH_NAME == 'develop' ) {
            emailList = emailList+','+emailSecList
        }
    } else {
        email_body = "${email_body} <b>SCAP Scan Skipped</b><br/>"
    }
 
    // If Jira ID is available, add comment to the ticket and add link to email.
    if (JIRA_ID) {
        def jira_link = "https://progresssoftware.atlassian.net/browse/${JIRA_ID}"
        def comment = [ body: "Jenkins pipeline build result: ${status}" ]
        jiraAddComment site: 'JIRA',
            input: comment,
            idOrKey: JIRA_ID,
            failOnError: false
        email_body = "${email_body} <br/><br/><b>Jira URL: </b><br/><a href='${jira_link}'>${jira_link}</a>"
    }
    mail to: "${emailList}",
        body: "${email_body}",
        subject: "🥷 ${status}: ${env.JOB_NAME} #${env.BUILD_NUMBER}",
        charset: 'UTF-8', mimeType: 'text/html'
}

/**
 * Copies the MarkLogic Server and Converters RPMs.
 * Determines the correct RPM version/branch based on marklogicVersion parameter.
 * Downloads nightly builds from Artifactory unless specific RPM URLs are provided via ML_RPM/ML_CONVERTERS parameters.
 * Sets RPM, CONVERTERS, and marklogicVersion global variables.
 */
void copyRPMs() {
    // Determine architecture suffix based on image type
    def archSuffix = dockerImageType.contains('arm') ? 'aarch64' : 'x86_64'
    def armRhelSuffix = (marklogicVersion == "12") ? 'rhel' : 'rhel9'

    if (marklogicVersion == "11") {
        //if dockerImageType contains "ubi9" then use nightly-rhel9 suffix
        if (dockerImageType.contains("ubi9")) {
            RPMsuffix = ".nightly-rhel9"
        } else {
            RPMsuffix = ".nightly-rhel"
        }
        RPMbranch = "b11"
        RPMversion = "11.3"
    }
    else if (marklogicVersion == "12") {
        RPMsuffix = ".nightly-rhel"
        RPMbranch = "b12"
        RPMversion = "12.1"
    }
    else {
        error "Invalid value in marklogicVersion parameter."
    }

    sh """
        cd src
        ARM_DATE=\$(TZ=America/Los_Angeles date +%Y%m%d)
        if [ -z "${env.ML_RPM}" ]; then
            if [ "${archSuffix}" = "aarch64" ]; then
                wget --no-verbose https://bed-artifactory.bedford.progress.com:443/artifactory/ml-rpm-dev-tierpoint/${RPMbranch}/server-arm/MarkLogic-${RPMversion}.\${ARM_DATE}-${armRhelSuffix}.aarch64.rpm
            else
                wget --no-verbose https://bed-artifactory.bedford.progress.com:443/artifactory/ml-rpm-tierpoint/${RPMbranch}/server/MarkLogic-${RPMversion}${RPMsuffix}.${archSuffix}.rpm
            fi
        else
            wget --no-verbose "${env.ML_RPM}"
        fi
        if [ -n "${env.ML_CONVERTERS}" ]; then
            wget --no-verbose "${env.ML_CONVERTERS}"
        else
            if [ "${archSuffix}" = "aarch64" ]; then
                wget --no-verbose https://bed-artifactory.bedford.progress.com:443/artifactory/ml-rpm-dev-tierpoint/${RPMbranch}/converters-arm/MarkLogicConverters-${RPMversion}.\${ARM_DATE}-${armRhelSuffix}.aarch64.rpm
            else
                wget --no-verbose https://bed-artifactory.bedford.progress.com:443/artifactory/ml-rpm-tierpoint/${RPMbranch}/converters/MarkLogicConverters-${RPMversion}${RPMsuffix}.${archSuffix}.rpm
            fi
        fi
    """
    script {
        // Select RPMs using version-specific patterns first to avoid picking another concurrent build's artifacts.
        RPM = sh(returnStdout: true, script: "cd src; ls -1t MarkLogic-${RPMversion}*.${archSuffix}.rpm 2>/dev/null | head -1").trim()
        if (!RPM) {
            RPM = sh(returnStdout: true, script: "cd src; ls -1t MarkLogic-*.${archSuffix}.rpm 2>/dev/null | head -1").trim()
        }

        CONVERTERS = sh(returnStdout: true, script: "cd src; ls -1t MarkLogicConverters-${RPMversion}*.${archSuffix}.rpm 2>/dev/null | head -1").trim()
        if (!CONVERTERS) {
            CONVERTERS = sh(returnStdout: true, script: "cd src; (ls -1t MarkLogicConverters-*.${archSuffix}.rpm 2>/dev/null || ls -1t MarkLogicConverters-*.rpm 2>/dev/null) | head -1").trim()
        }

        if (!RPM) {
            error "No MarkLogic RPM found in src/ for architecture ${archSuffix}"
        }

        // Extract MarkLogic version from RPM file name (handle both x86_64 and aarch64)
        marklogicVersion = sh(returnStdout: true, script: "echo ${RPM} | awk -F 'MarkLogic-' '{print \$2;}' | awk -F '.x86_64.rpm' '{print \$1;}' | awk -F '.aarch64.rpm' '{print \$1;}' | awk -F '-rhel' '{print \$1;}'").trim()

        if (!marklogicVersion.startsWith("${params.marklogicVersion}.")) {
            error "Resolved RPM version '${marklogicVersion}' does not match requested marklogicVersion '${params.marklogicVersion}'"
        }

        echo "Selected server RPM: ${RPM}"
        echo "Selected converters RPM: ${CONVERTERS}"
        echo "Derived MarkLogic version from RPM: ${marklogicVersion}"
    }
}

/**
 * Builds the Docker image using the 'make build' target.
 * Sets various image tag variables (builtImage, publishImage, latestTag).
 * Updates the Jenkins build display name.
 */
void buildDockerImage() {
    builtImage="marklogic/marklogic-server-${dockerImageType}:${marklogicVersion}-${env.dockerImageType}-${env.dockerVersion}"
    publishImage="marklogic/marklogic-server-${dockerImageType}:${marklogicVersion}-${env.dockerImageType}"
    mlVerShort=marklogicVersion.split("\\.")[0]
    latestTag="marklogic/marklogic-server-${dockerImageType}:latest-${mlVerShort}"
    // Use Los Angeles time (same as ARM_DATE in copyRPMs) to ensure consistency across UTC/PST boundaries
    timeStamp = sh(returnStdout: true, script: "TZ=America/Los_Angeles date +%Y%m%d").trim()
    timestamptedTag = builtImage.replace('nightly', timeStamp)
    def buildBranchValue = getBuildBranchValue()
    sh "make build docker_image_type=${dockerImageType} dockerTag=${marklogicVersion}-${env.dockerImageType}-${env.dockerVersion} marklogicVersion=${marklogicVersion} dockerVersion=${env.dockerVersion} build_branch=${buildBranchValue} package=${RPM} converters=${CONVERTERS}"
    currentBuild.displayName = "#${BUILD_NUMBER}: ${marklogicVersion}-${env.dockerImageType} (${env.dockerVersion})"
    echo "Built image: ${builtImage}"
}

/**
 * Pulls the Docker image required for upgrade testing.
 * Uses the 'upgradeDockerImage' parameter or defaults to a corresponding 'ubi' image.
 * Skips the pull if the target image is 'ubi-rootless' and DOCKER_TESTS is false.
 */
void pullUpgradeDockerImage() {
    if (dockerImageType == "ubi-rootless" && params.DOCKER_TESTS != "true") {
        sh """
            echo 'dockerImageType is set to ubi-rootless, skipping this stage and Docker upgrade test.'
        """
    } else if (isArmImage()) {
        sh """
            echo 'ARM image type detected. Skipping upgrade test (no previous ARM images available for upgrade testing).'
        """
    } else {
        if (upgradeDockerImage != "" ) {
            sh """
                echo 'upgradeDockerImage: ${upgradeDockerImage}'
                docker pull ${upgradeDockerImage}
            """
        } else {
            upgradeDockerImage = "${dockerRegistry}/marklogic/marklogic-server-ubi:${marklogicVersion}-ubi-${env.dockerVersion}"
            sh """
                echo 'upgradeDockerImage is not specified, using ${upgradeDockerImage} for upgrade test.'
                docker pull ${dockerRegistry}/marklogic/marklogic-server-ubi:${marklogicVersion}-ubi-${env.dockerVersion}
            """
        }
    }
}

/**
 * Runs container structure tests using the 'make structure-test' target.
 */
void structureTests() {
    def buildBranchValue = getBuildBranchValue()
    sh """
        #install container-structure-test 1.16.0 binary (detect architecture)
        ARCH=\$(uname -m)
        if [ "\$ARCH" = "aarch64" ]; then
            PLATFORM="arm64"
        else
            PLATFORM="amd64"
        fi
        curl -s -LO https://storage.googleapis.com/container-structure-test/v1.16.0/container-structure-test-linux-\${PLATFORM} && chmod +x container-structure-test-linux-\${PLATFORM} && mv container-structure-test-linux-\${PLATFORM} container-structure-test
        make structure-test current_image=marklogic/marklogic-server-${dockerImageType}:${marklogicVersion}-${env.dockerImageType}-${env.dockerVersion} marklogicVersion=${marklogicVersion} dockerVersion=${env.dockerVersion} build_branch=${buildBranchValue} docker_image_type=${env.dockerImageType} Jenkins=true
    """
}

/**
 * Runs Docker functional tests using the 'make docker-tests' target.
 */
void dockerTests() {
    def buildBranchValue = getBuildBranchValue()
    sh "make docker-test-ids"
    sh "make docker-tests current_image=marklogic/marklogic-server-${dockerImageType}:${marklogicVersion}-${env.dockerImageType}-${env.dockerVersion} upgrade_image=${upgradeDockerImage} marklogicVersion=${marklogicVersion} build_branch=${buildBranchValue} dockerVersion=${env.dockerVersion} docker_image_type=${dockerImageType} DOCKER_TEST_LIST=\"${params.DOCKER_TEST_LIST}\""
}

/**
 * Lints the Dockerfile and startup scripts using hadolint and shellcheck via 'make lint'.
 * Captures the lint output in the LINT_OUTPUT variable.
 * Records the built image size in the IMAGE_SIZE variable.
 */
void lint() {
    IMAGE_SIZE = sh(returnStdout: true, script: "docker images marklogic/marklogic-server-${dockerImageType}:${marklogicVersion}-${env.dockerImageType}-${env.dockerVersion} --format '{{.Repository}}:{{.Tag}}\t{{.Size}}'")

    sh """
        make lint Jenkins=true
        cat start-scripts-lint.txt dockerfile-lint.txt
    """

    LINT_OUTPUT = sh(returnStdout: true, script: "echo start-scripts-lint.txt: ;echo; cat start-scripts-lint.txt; echo; echo dockerfile-lint.txt: ; cat dockerfile-lint.txt; echo").trim()

    sh """
        rm -f start-scripts-lint.txt dockerfile-lint.txt
    """
}

/**
 * Scans the built Docker image for vulnerabilities using Grype via 'make scan'.
 * Captures the scan summary in the SCAN_OUTPUT variable.
 * Archives the full JSON scan report.
 * Sends an email notification if critical or high severity vulnerabilities are found.
 */
void vulnerabilityScan() {
    sh """
        make scan current_image=marklogic/marklogic-server-${dockerImageType}:${marklogicVersion}-${env.dockerImageType}-${env.dockerVersion} docker_image_type=${dockerImageType} Jenkins=true
    """
    SCAN_OUTPUT = sh(returnStdout: true, script: "cat scan/report-${env.dockerImageType}.txt")
    sh 'echo "SCAN_OUTPUT: ${SCAN_OUTPUT}"'
    if (SCAN_OUTPUT.size()) {
        def emailConfig = loadEmailConfig()
        mail charset: 'UTF-8', mimeType: 'text/html', to: "${emailConfig.emailSecList}", body: "<br/>Jenkins pipeline for ${env.JOB_NAME} <br/>Build Number: ${env.BUILD_NUMBER} <br/>Vulnerabilities: <pre><code>${SCAN_OUTPUT}</code></pre>", subject: "Critical or High Security Vulnerabilities Found: ${env.JOB_NAME} #${env.BUILD_NUMBER}"
    }
    archiveArtifacts artifacts: 'scan/*', onlyIfSuccessful: true
}

/**
 * Publishes the built Docker image to the internal Artifactory registry.
 * Also publishes ML images to private Azure ACR repositories (PDC).
 * Tags the image with multiple tags (version-specific, branch-specific, latest).
 * Requires Artifactory and Azure ACR credentials.
 */
void publishToInternalRegistry() {
    // Use the discovered image tag if available (handles date/time mismatches across day boundaries)
    def imageToPublish = env.IMAGE_TO_PUBLISH ?: builtImage
    echo "Publishing image: ${imageToPublish}"
    
    withCredentials([usernamePassword(credentialsId: 'builder-credentials-artifactory', passwordVariable: 'docker_password', usernameVariable: 'docker_user')]) {
        sh """
            docker logout ${dockerRegistry}
            echo "${docker_password}" | docker login --username ${docker_user} --password-stdin ${dockerRegistry}
            docker tag ${imageToPublish} ${dockerRegistry}/${publishImage}
            docker tag ${imageToPublish} ${dockerRegistry}/${latestTag}
            docker tag ${imageToPublish} ${dockerRegistry}/${timestamptedTag}
            docker push ${dockerRegistry}/${publishImage}
            docker push ${dockerRegistry}/${latestTag}
            docker push ${dockerRegistry}/${timestamptedTag}
        """
        
    }

    // Publish to private ACR repositories that are used by PDC.
    // Publish to Dev PDC registry (ARM images are excluded)
    if (!isArmImage()) {
        withCredentials([usernamePassword(credentialsId: 'pdc-azure-cr', passwordVariable: 'docker_password', usernameVariable: 'docker_user')]) {
            sh """
                echo "${docker_password}" | docker login --username ${docker_user} --password-stdin ${pdcDevRegistry}
                docker tag ${imageToPublish} ${pdcDevRegistry}/marklogicdb-custom:${marklogicVersion}-${env.dockerImageType}-${env.dockerVersion}
                docker tag ${imageToPublish} ${pdcDevRegistry}/marklogicdb-custom:${marklogicVersion}-${env.dockerImageType}
                docker push ${pdcDevRegistry}/marklogicdb-custom:${marklogicVersion}-${env.dockerImageType}-${env.dockerVersion}
                docker push ${pdcDevRegistry}/marklogicdb-custom:${marklogicVersion}-${env.dockerImageType}
            """
        }
    }

    // Publish to Kubernetes ECR for testing on EKS
    withCredentials([[$class: 'AmazonWebServicesCredentialsBinding',
                    credentialsId: 'KUBE_NINJAS_OPS_AWS_JENKINS',
                    accessKeyVariable: 'AWS_ACCESS_KEY_ID',
                    secretKeyVariable: 'AWS_SECRET_ACCESS_KEY']]) {
        // Resolve account ID via STS - no account number is hardcoded in this file.
        def awsAccountId = sh(returnStdout: true,
            script: 'aws sts get-caller-identity --region us-west-1 --query Account --output text').trim()
        def kubeNinjasEcrRegistry = "${awsAccountId}.dkr.ecr.us-west-1.amazonaws.com"
        def ecrRepo = "${kubeNinjasEcrRegistry}/jenkins-kube-ninjas/marklogic-server-${dockerImageType}"
        sh """
            aws ecr get-login-password --region us-west-1 | \\
            docker login --username AWS --password-stdin ${kubeNinjasEcrRegistry}
            docker tag ${imageToPublish} ${ecrRepo}:${marklogicVersion}-${env.dockerImageType}-${env.dockerVersion}
            docker tag ${imageToPublish} ${ecrRepo}:latest-${mlVerShort}
            docker push ${ecrRepo}:${marklogicVersion}-${env.dockerImageType}-${env.dockerVersion}
            docker push ${ecrRepo}:latest-${mlVerShort}
        """
    }

    currentBuild.description = "Published"
}

/**
 * Triggers a BlackDuck scan job for the published image.
 * Scans the rolling latest-<majorVersion> tag (not the per-build version tag) so each
 * scan overwrites the same BlackDuck code location instead of accumulating a new one
 * per MarkLogic minor version release.
 * Passes the pinned UBI base image (read from the matching marklogic-deps Dockerfile's FROM
 * line) so BlackDuck can run an additional scan excluding base image components.
 * Runs asynchronously (wait: false).
 */
void scanWithBlackDuck() {
    def isUbi9 = params.dockerImageType.contains('ubi9')
    def isArm = params.dockerImageType.contains('arm')
    def depsDockerfile = (isUbi9 && isArm) ? 'dockerFiles/marklogic-deps-ubi9-arm:base' :
        isUbi9 ? 'dockerFiles/marklogic-deps-ubi9:base' : 'dockerFiles/marklogic-deps-ubi:base'
    def baseImageToExclude = sh(returnStdout: true, script: "grep -m1 '^FROM' ${depsDockerfile} | awk '{print \$2}'").trim()
    build job: 'securityscans/Blackduck/KubeNinjas/docker', wait: false, parameters: [ string(name: 'BRANCH', value: "${env.BRANCH_NAME}"), string(name: 'CONTAINER_IMAGES', value: "${dockerRegistry}/${latestTag}"), string(name: 'ML_VER', value: "${params.marklogicVersion}"), string(name: 'DOCKER_TYPE', value: "${params.dockerImageType}"), string(name: 'BASE_IMAGE_TO_EXCLUDE', value: "${baseImageToExclude}") ]
}

/**
 * Publishes JUnit XML test results from structure and Docker tests.
 * Publishes HTML reports for Docker tests and SCAP scans if they were executed.
 */
void publishTestResults() {
    junit allowEmptyResults:true, testResults: '**/test_results/docker-tests.xml,**/container-structure-test.xml'
        if (params.DOCKER_TESTS) {
        echo 'Publishing Docker results..'
        publishHTML allowMissing: false, 
            alwaysLinkToLastBuild: true, 
            keepAll: true, 
            reportDir: 'test/test_results', 
            reportFiles: 'report.html', 
            reportName: 'Docker Tests Report', 
            reportTitles: "Build ${env.BUILD_NUMBER}"
    }
    if (params.SCAP_SCAN) {
        echo 'Publishing SCAP scan results..'
        publishHTML allowMissing: false, 
            alwaysLinkToLastBuild: true, 
            keepAll: true, reportDir: 'scap', 
            reportFiles: 'scap_scan_report.html', 
            reportName: 'Open SCAP Report', 
            reportTitles: "Build ${env.BUILD_NUMBER}"
    }
}

/**
 * Runs an OpenSCAP compliance scan on the rootless image using 'make scap-scan'.
 * Generates an HTML report.
 */
void scapScan() {
    sh """
        make scap-scan current_image=marklogic/marklogic-server-${dockerImageType}:${marklogicVersion}-${env.dockerImageType}-${env.dockerVersion}
    """
}

pipeline {
    // No pipeline-wide agent: stages that need a different label (graviton) must not
    // overlap with a persistently-held top-level agent, or two nodes of the same scarce
    // label pool can be double-booked at once (risking queue deadlock under load).
    agent none
    options {
        checkoutToSubdirectory '.'
        buildDiscarder logRotator(artifactDaysToKeepStr: '7', artifactNumToKeepStr: '', daysToKeepStr: '30', numToKeepStr: '')
        skipStagesAfterUnstable()
    }
    triggers {
        // Trigger nightly builds on the develop branch for every supported version of MarkLogic
        // and for every supported image type.
        // Include SCAP scan for rootless images
        parameterizedCron( env.BRANCH_NAME == 'develop' ? '''00 03 * * * % marklogicVersion=11;dockerImageType=ubi
                                                             00 03 * * * % marklogicVersion=11;dockerImageType=ubi-rootless;SCAP_SCAN=true
                                                             00 03 * * * % marklogicVersion=11;dockerImageType=ubi9
                                                             00 03 * * * % marklogicVersion=11;dockerImageType=ubi9-rootless;SCAP_SCAN=true
                                                             00 02 * * * % marklogicVersion=12;dockerImageType=ubi
                                                             00 02 * * * % marklogicVersion=12;dockerImageType=ubi-rootless;SCAP_SCAN=true
                                                             00 02 * * * % marklogicVersion=12;dockerImageType=ubi9
                                                             00 02 * * * % marklogicVersion=12;dockerImageType=ubi9-rootless;SCAP_SCAN=true
                                                             00 07 * * 7 % marklogicVersion=11;dockerImageType=ubi;DOCKER_TEST_LIST=D05 Initialized MarkLogic container with latency;PUBLISH_IMAGE=false
                                                             00 08 * * 7 % marklogicVersion=12;dockerImageType=ubi;DOCKER_TEST_LIST=D05 Initialized MarkLogic container with latency;PUBLISH_IMAGE=false
                                                             00 05 * * * % marklogicVersion=11;dockerImageType=ubi9-arm;GRAVITON3_AGENT=true
                                                             30 05 * * * % marklogicVersion=11;dockerImageType=ubi9-rootless-arm;SCAP_SCAN=true;GRAVITON3_AGENT=true
                                                             00 06 * * * % marklogicVersion=12;dockerImageType=ubi9-arm;GRAVITON3_AGENT=true
                                                             30 06 * * * % marklogicVersion=12;dockerImageType=ubi9-rootless-arm;SCAP_SCAN=true;GRAVITON3_AGENT=true
                                                             00 09 * * 7 % marklogicVersion=11;dockerImageType=ubi9-arm;DOCKER_TEST_LIST=D05 Initialized MarkLogic container with latency;PUBLISH_IMAGE=false;GRAVITON3_AGENT=true
                                                             00 10 * * 7 % marklogicVersion=12;dockerImageType=ubi9-arm;DOCKER_TEST_LIST=D05 Initialized MarkLogic container with latency;PUBLISH_IMAGE=false;GRAVITON3_AGENT=true''' : '')
                                                }
    environment {
        QA_LICENSE_KEY = credentials('QA_LICENSE_KEY')
    }

    parameters {
        string(name: 'dockerVersion', defaultValue: '2.3.0', description: 'ML Docker version. This value is used as part of the Docker image tag, which is built as ${marklogicVersion}-${dockerImageType}-${dockerVersion}', trim: true)
        choice(name: 'dockerImageType', choices: 'ubi-rootless\nubi\nubi9-rootless\nubi9\nubi9-arm\nubi9-rootless-arm', description: 'Platform type for Docker image. Will be made part of the docker image tag')
        string(name: 'upgradeDockerImage', defaultValue: '', description: 'Docker image for testing upgrades. Defaults to ubi image if left blank.\n Currently upgrading to ubi-rootless is not supported hence the test is skipped when ubi-rootless image is provided.', trim: true)
        choice(name: 'marklogicVersion', choices: '12\n11', description: 'MarkLogic Server Branch. used to pick appropriate rpm')
        string(name: 'ML_RPM', defaultValue: '', description: 'URL for RPM to be used for Image creation. \n If left blank nightly ML rpm will be used.\n Please provide Jenkins accessible path e.g. /project/engineering or /project/qa', trim: true)
        string(name: 'ML_CONVERTERS', defaultValue: '', description: 'URL for the converters RPM to be included in the image creation \n If left blank the nightly ML Converters Package will be used.', trim: true)
        booleanParam(name: 'PUBLISH_IMAGE', defaultValue: false, description: 'Publish image to internal registry')
        booleanParam(name: 'TEST_STRUCTURE', defaultValue: true, description: 'Run container structure tests')
        booleanParam(name: 'DOCKER_TESTS', defaultValue: true, description: 'Run docker tests')
        string(name: 'DOCKER_TEST_LIST', defaultValue: '', description: 'Comma separated list of test names to run (e.g Test one, Test two). Leave empty to run all tests.', trim: true)
        booleanParam(name: 'SCAP_SCAN', defaultValue: false, description: 'Run Open SCAP scan on the image.')
        booleanParam(name: 'GRAVITON3_AGENT', defaultValue: false, description: '[ARM only] Run ARM-only stages on Graviton3 agent')
        string(name: 'emailList', defaultValue: '', description: 'Optional override for the build notification email list. If left blank, the list is loaded from the KUBE_NINJAS_PIPELINE_EMAILS Jenkins credential file. Specify a comma-separated list only to send notifications to additional or different recipients for a specific build run.', trim: true)
    }

    stages {
        // Grouped under one agent (held only for this group's duration, then released)
        // so these sequential, always-'cld-docker' stages don't each re-queue for a
        // fresh node, without holding a node open while later stages need graviton.
        stage('Prepare-Build-Lint-Scan') {
            agent { node { label 'cld-docker' } }
            stages {
                // Stage: Remove stale test results from previous builds
                stage('Clean-Previous-Results') {
                    steps {
                        sh '''
                            rm -f container-structure-test.xml
                            rm -rf test/test_results
                        '''
                    }
                }

                // Stage: Perform initial checks (PR status, Jira ID)
                stage('Pre-Build-Check') {
                    steps {
                        preBuildCheck()
                    }
                }

                // Stage: Download MarkLogic Server and Converters RPMs (ARM builds on x86)
                stage('Copy-RPMs') {
                    steps {
                        copyRPMs()
                        stash name: 'rpms', includes: 'src/*.rpm'
                    }
                }

                // Stage: Build the Docker image
                // Save image archive to workspace and stash for cross-agent stages.
                stage('Build-Image') {
                    steps {
                        unstash 'rpms'
                        buildDockerImage()
                        script {
                            // Always save image for cases where agents might differ
                            sh """
                                echo "Saving ${builtImage} to ${WORKSPACE}/${GRAVITON3_IMAGE_ARCHIVE}..."
                                docker image save ${builtImage} -o ${WORKSPACE}/${GRAVITON3_IMAGE_ARCHIVE}
                                ls -lh ${WORKSPACE}/${GRAVITON3_IMAGE_ARCHIVE}
                            """
                            stash name: 'built-image-archive', includes: "${GRAVITON3_IMAGE_ARCHIVE}", allowEmpty: false
                        }
                    }
                }

                // Stage: Pull the base image needed for upgrade testing
                stage('Pull-Upgrade-Image') {
                    steps {
                        pullUpgradeDockerImage()
                    }
                }

                // Stage: Lint Dockerfile and startup scripts (x86 only)
                stage('Lint') {
                    steps {
                        lint()
                    }
                }

                // Stage: Scan the image for vulnerabilities (x86 only)
                stage('Scan') {
                    steps {
                        echo 'Skipping vulnerability scan due to compatibility issues.'
                        // vulnerabilityScan()
                    }
                }
            }
        }

        // Stage: Run OpenSCAP compliance scan (conditional)
        stage('SCAP-Scan') {
            agent {
                node {
                    label isArmImage() ? 'cld-docker-graviton' : 'cld-docker'
                }
            }
            when {
                    beforeAgent true
                    expression { return params.SCAP_SCAN }
            }
            steps {
                script {
                    unstash 'built-image-archive'
                    // Load image from tar if not already available (applies to all build types)
                    def imageSource = "${WORKSPACE}/${GRAVITON3_IMAGE_ARCHIVE}"
                    sh """
                        if ! docker image inspect ${builtImage} &>/dev/null; then
                            echo "Loading image from ${imageSource} for SCAP scan..."
                            docker image load -i ${imageSource}
                        else
                            echo "Image ${builtImage} already available locally"
                        fi
                    """
                }
                scapScan()
                stash name: 'scap-results', includes: 'scap/**', allowEmpty: true
            }
        }

        // Stage: Load image from tar archive (ARM builds only)
        stage('Load-Image') {
            agent { label 'cld-docker-graviton' }
            when {
                beforeAgent true
                expression { return isArmImage() && params.GRAVITON3_AGENT }
            }
            steps {
                script {
                    unstash 'built-image-archive'
                    sh """
                        if ! docker image inspect ${builtImage} &>/dev/null; then
                            echo "Loading image from ${WORKSPACE}/${GRAVITON3_IMAGE_ARCHIVE}..."
                            docker image load -i ${WORKSPACE}/${GRAVITON3_IMAGE_ARCHIVE}
                        else
                            echo "Image ${builtImage} already loaded (likely by SCAP-Scan stage)"
                        fi
                        docker images | head -5
                    """
                }
            }
        }

        // Stage: Run container structure tests (conditional)
        stage('Structure-Tests') {
            agent {
                node {
                    label isArmImage() ? 'cld-docker-graviton' : 'cld-docker'
                }
            }
            when {
                beforeAgent true
                expression { return params.TEST_STRUCTURE }
            }
            steps {
                script {
                    unstash 'built-image-archive'
                    // Load image from tar if not already available (applies to all build types)
                    def imageSource = "${WORKSPACE}/${GRAVITON3_IMAGE_ARCHIVE}"
                    sh """
                        if ! docker image inspect ${builtImage} &>/dev/null; then
                            echo "Loading image from ${imageSource} for Structure-Tests..."
                            docker image load -i ${imageSource}
                        else
                            echo "Image ${builtImage} already available locally"
                        fi
                    """
                }
                structureTests()
                stash name: 'structure-test-results', includes: 'container-structure-test.xml', allowEmpty: true
            }
        }

        // Stage: Run Docker functional tests (conditional)
        stage('Docker-Run-Tests') {
            agent {
                node {
                    label isArmImage() ? 'cld-docker-graviton' : 'cld-docker'
                }
            }
            when {
                beforeAgent true
                expression { return params.DOCKER_TESTS }
            }
            steps {
                script {
                    unstash 'built-image-archive'
                    // Load image from tar if not already available (applies to all build types)
                    def imageSource = "${WORKSPACE}/${GRAVITON3_IMAGE_ARCHIVE}"
                    sh """
                        if ! docker image inspect ${builtImage} &>/dev/null; then
                            echo "Loading image from ${imageSource} for Docker-Run-Tests..."
                            docker image load -i ${imageSource}
                        else
                            echo "Image ${builtImage} already available locally"
                        fi
                    """
                }
                dockerTests()
                stash name: 'docker-test-results', includes: 'test/test_results/**', allowEmpty: true
            }
        }

        // Grouped under one agent for the same reason as Prepare-Build-Lint-Scan above:
        // both always want 'cld-docker' and never overlap with the graviton stages.
        stage('Publish-And-Scan') {
            agent { node { label 'cld-docker' } }
            stages {
                // Stage: Publish image to internal registries (conditional)
                stage('Publish-Image') {
                    when {
                            beforeAgent true
                            anyOf {
                                branch 'develop'
                                expression { return params.PUBLISH_IMAGE }
                            }
                    }
                    steps {
                        script {
                            unstash 'built-image-archive'
                            // Load image from tar if not already available (applies to all build types)
                            // Node's Docker daemon is shared with other concurrent builds, so only ever
                            // trust the exact, fully-qualified tag - never a loose repo/type match, which
                            // could resolve to a different build's image (e.g. a different marklogicVersion).
                            sh """
                                if ! docker image inspect ${builtImage} &>/dev/null; then
                                    echo "Image not found locally, loading from ${WORKSPACE}/${GRAVITON3_IMAGE_ARCHIVE}..."
                                    docker image load -i ${WORKSPACE}/${GRAVITON3_IMAGE_ARCHIVE}
                                else
                                    echo "Image ${builtImage} already available locally"
                                fi
                                docker image inspect ${builtImage} >/dev/null
                            """

                            // Store for use in publishToInternalRegistry
                            env.IMAGE_TO_PUBLISH = builtImage
                        }
                        publishToInternalRegistry()
                        // Trigger downstream QA image build job
                        build job: 'KubeNinjas/docker/docker-nightly-builds-qa', wait: false, parameters: [string(name: 'dockerImageType', value: "${dockerImageType}"), string(name: 'marklogicVersion', value: "${RPMversion}")]
                    }
                }

                // Stage: Trigger BlackDuck security scan (conditional)
                stage('BlackDuck-Scan') {
                    when {
                        anyOf {
                                branch pattern: '^(develop|master|release.*)$', comparator: 'REGEXP'
                            }
                    }
                    steps {
                        scanWithBlackDuck()
                    }
                }
            }
        }

        // Stage: Cleanup ARM agent (ARM builds only)
        stage('Cleanup-ARM') {
            agent { label 'cld-docker-graviton' }
            when {
                beforeAgent true
                expression { return isArmImage() && params.GRAVITON3_AGENT }
            }
            steps {
                sh '''
                    echo "Cleaning up ARM agent..."
                    # Stop all running containers
                    docker stop $(docker ps -a -q) || true
                    # Docker cleanup
                    docker system prune --force --all --volumes
                    docker system df
                '''
            }
        }

    }

    // Post has no implicit agent (top-level agent is none), so each branch explicitly
    // grabs its own short-lived 'cld-docker' node for cleanup/notification.
    post {
        always {
            node('cld-docker') {
                // Clean up the workspace and Docker resources
                sh """
                    # Remove any stale test artifacts before unstash
                    rm -rf test/test_results scap container-structure-test.xml
                    # Remove ARM image tar archive
                    rm -f ${WORKSPACE}/${GRAVITON3_IMAGE_ARCHIVE}
                    # Remove ARM image if it was built
                    if [ -n "${builtImage}" ]; then
                        docker rmi ${builtImage} || true
                    fi
                    # Clean up RPMs
                    if [ -d src ]; then
                        cd src
                        rm -rf *.rpm NOTICE.txt
                        cd ..
                    fi
                    # Docker cleanup applies to both agents
                    docker stop \$(docker ps -a -q) || true
                    docker system prune --force --all --volumes
                    docker system df
                """
                script {
                    try { unstash 'structure-test-results' } catch (e) { echo 'No structure test results to unstash.' }
                    try { unstash 'docker-test-results' } catch (e) { echo 'No docker test results to unstash.' }
                    try { unstash 'scap-results' } catch (e) { echo 'No SCAP results to unstash.' }
                }
                publishTestResults()
            }
        }
        success {
            node('cld-docker') {
                resultNotification('✅ Success')
            }
        }
        failure {
            node('cld-docker') {
                resultNotification('❌ Failure')
            }
        }
        unstable {
            node('cld-docker') {
                resultNotification('⚠️ Unstable')
            }
        }
        aborted {
            node('cld-docker') {
                resultNotification('🚫 Aborted')
            }
        }
    }
}