196 lines
7.8 KiB
Plaintext
196 lines
7.8 KiB
Plaintext
/*
|
|
* Copyright (c) 2016-present Sonatype, Inc. All rights reserved.
|
|
* Includes the third-party code listed at http://links.sonatype.com/products/nexus/attributions.
|
|
* "Sonatype" is a trademark of Sonatype, Inc.
|
|
*/
|
|
@Library(['private-pipeline-library', 'jenkins-shared']) _
|
|
import com.sonatype.jenkins.pipeline.OsTools
|
|
|
|
String OPENJDK17 = 'OpenJDK 17'
|
|
List<String> javaVersions = [OPENJDK17]
|
|
|
|
properties([
|
|
parameters([
|
|
string(defaultValue: '', description: 'New Nexus Repository Manager Version', name: 'nexus_repository_manager_version'),
|
|
string(defaultValue: '', description: 'New Nexus Repository Manager URL (Optional)', name: 'nexus_repository_manager_url'),
|
|
choice(name: 'java_version', choices: javaVersions, description: 'Java version to run Nexus Repository Manager'),
|
|
booleanParam(defaultValue: false, description: 'Optional scan for policy violations', name: 'scan_for_policy_violations')
|
|
])
|
|
])
|
|
|
|
node('ubuntu-zion') {
|
|
def commitId, commitDate, version, imageId, alpineImageId, branch
|
|
def imageName = 'sonatype/nexus3',
|
|
archiveName = 'docker-nexus3'
|
|
|
|
def JAVA_17 = 'java17'
|
|
def DOCKERFILE_JAVA_17 = 'Dockerfile.java17'
|
|
def DOCKERFILE_ALPINE_JAVA_17 = 'Dockerfile.alpine.java17'
|
|
|
|
def dockerfileMap = [
|
|
(OPENJDK17): [DOCKERFILE_JAVA_17, DOCKERFILE_ALPINE_JAVA_17]
|
|
]
|
|
try {
|
|
stage('Preparation') {
|
|
deleteDir()
|
|
OsTools.runSafe(this, "docker system prune -a -f")
|
|
|
|
def checkoutDetails = checkout scm
|
|
|
|
branch = checkoutDetails.GIT_BRANCH == 'origin/main' ? 'main' : checkoutDetails.GIT_BRANCH
|
|
commitId = checkoutDetails.GIT_COMMIT
|
|
commitDate = OsTools.runSafe(this, "git show -s --format=%cd --date=format:%Y%m%d-%H%M%S ${commitId}")
|
|
|
|
OsTools.runSafe(this, 'git config --global user.email sonatype-ci@sonatype.com')
|
|
OsTools.runSafe(this, 'git config --global user.name Sonatype CI')
|
|
|
|
version = readVersion()
|
|
|
|
if (params.nexus_repository_manager_version) {
|
|
stage('Update Repository Manager Version') {
|
|
OsTools.runSafe(this, "git checkout ${branch}")
|
|
dockerfileMap[OPENJDK17].each { dockerfile ->
|
|
updateRepositoryManagerVersion("${pwd()}/${dockerfile}", JAVA_17)
|
|
}
|
|
version = getShortVersion(params.nexus_repository_manager_version)
|
|
}
|
|
}
|
|
}
|
|
def dockerfilePath = dockerfileMap[OPENJDK17][0]
|
|
def alpineDockerfilePath = dockerfileMap[OPENJDK17][1]
|
|
|
|
stage('Build UBI Image') {
|
|
def baseImage = extractBaseImage(dockerfilePath)
|
|
def baseImageRefFactory = load 'scripts/BaseImageReference.groovy'
|
|
def baseImageReference = baseImageRefFactory.build(this, baseImage as String)
|
|
def baseImageReferenceStr = baseImageReference.getReference()
|
|
def hash = OsTools.runSafe(this, "docker build --quiet --label base-image-ref='${baseImageReferenceStr}' --no-cache --tag ${imageName} . -f ${dockerfilePath}")
|
|
imageId = hash.split(':')[1]
|
|
}
|
|
stage('Build Alpine Image') {
|
|
def hash = OsTools.runSafe(this, "docker build --quiet --no-cache --tag ${imageName}-alpine . -f ${alpineDockerfilePath}")
|
|
alpineImageId = hash.split(':')[1]
|
|
}
|
|
|
|
if (params.scan_for_policy_violations) {
|
|
stage('Evaluate Policies') {
|
|
def imagesToScan = [
|
|
[name: 'docker-nexus3', image: imageName],
|
|
[name: 'docker-nexus3-alpine', image: "${imageName}-alpine"]
|
|
]
|
|
|
|
imagesToScan.each { imageConfig ->
|
|
runEvaluation({ stage ->
|
|
def iqApplicationName = imageConfig.name
|
|
def imageToScan = imageConfig.image
|
|
|
|
nexusPolicyEvaluation(
|
|
iqStage: stage,
|
|
iqApplication: iqApplicationName,
|
|
iqScanPatterns: [[scanPattern: "container:${imageToScan}"]],
|
|
failBuildOnNetworkError: false,
|
|
)
|
|
}, 'release')
|
|
}
|
|
}
|
|
}
|
|
if (currentBuild.result == 'FAILURE') {
|
|
return
|
|
}
|
|
stage('Archive') {
|
|
dir('build/target') {
|
|
OsTools.runSafe(this, "docker save ${imageName} | gzip > ${archiveName}.tar.gz")
|
|
archiveArtifacts artifacts: "${archiveName}.tar.gz", onlyIfSuccessful: true
|
|
}
|
|
}
|
|
if (branch == 'main') {
|
|
stage('Push image to RSC') {
|
|
withSonatypeDockerRegistry() {
|
|
// Tag Images
|
|
sh "docker tag ${imageId} docker-all.repo.sonatype.com/sonatype-internal/nexus3:${version}"
|
|
sh "docker tag ${imageId} docker-all.repo.sonatype.com/sonatype-internal/nexus3:${version}-ubi"
|
|
sh "docker tag ${imageId} docker-all.repo.sonatype.com/sonatype-internal/nexus3:${version}-java17-ubi"
|
|
sh "docker tag ${alpineImageId} docker-all.repo.sonatype.com/sonatype-internal/nexus3:${version}-alpine"
|
|
sh "docker tag ${alpineImageId} docker-all.repo.sonatype.com/sonatype-internal/nexus3:${version}-java17-alpine"
|
|
|
|
// Push Images
|
|
sh "docker push docker-all.repo.sonatype.com/sonatype-internal/nexus3:${version}"
|
|
sh "docker push docker-all.repo.sonatype.com/sonatype-internal/nexus3:${version}-ubi"
|
|
sh "docker push docker-all.repo.sonatype.com/sonatype-internal/nexus3:${version}-java17-ubi"
|
|
sh "docker push docker-all.repo.sonatype.com/sonatype-internal/nexus3:${version}-alpine"
|
|
sh "docker push docker-all.repo.sonatype.com/sonatype-internal/nexus3:${version}-java17-alpine"
|
|
}
|
|
}
|
|
}
|
|
} finally {
|
|
OsTools.runSafe(this, "docker logout")
|
|
OsTools.runSafe(this, "docker system prune -a -f")
|
|
OsTools.runSafe(this, 'git clean -f && git reset --hard origin/main')
|
|
}
|
|
}
|
|
|
|
def readVersion() {
|
|
def content = readFile 'Dockerfile.java17'
|
|
for (line in content.split('\n')) {
|
|
if (line.startsWith('ARG NEXUS_VERSION=')) {
|
|
return getShortVersion(line.substring(18))
|
|
}
|
|
}
|
|
error 'Could not determine version.'
|
|
}
|
|
|
|
def getShortVersion(version) {
|
|
return version.split('-')[0]
|
|
}
|
|
|
|
def updateRepositoryManagerVersion(dockerFileLocation, javaVersion) {
|
|
def dockerFile = readFile(file: dockerFileLocation)
|
|
|
|
def metaVersionRegex = /(version=")(\d\.\d{1,3}\.\d\-\d{2})(" \\)/
|
|
def metaShortVersionRegex = /(release=")(\d\.\d{1,3}\.\d)(" \\)/
|
|
|
|
def versionRegex = /(ARG NEXUS_VERSION=)(\d\.\d{1,3}\.\d\-\d{2})/
|
|
def shaRegex = /(ARG NEXUS_DOWNLOAD_SHA256_HASH=)([A-Fa-f0-9]{64})/
|
|
|
|
dockerFile = dockerFile.replaceAll(metaVersionRegex, "\$1${params.nexus_repository_manager_version}\$3")
|
|
dockerFile = dockerFile.replaceAll(metaShortVersionRegex,
|
|
"\$1${params.nexus_repository_manager_version.substring(0, params.nexus_repository_manager_version.indexOf('-'))}\$3")
|
|
dockerFile = dockerFile.replaceAll(versionRegex, "\$1${params.nexus_repository_manager_version}")
|
|
|
|
def nexusUrlRegex = /(ARG NEXUS_DOWNLOAD_URL=)(.*)/
|
|
def nexusUrl = params.nexus_repository_manager_url
|
|
if (params.nexus_repository_manager_url) {
|
|
dockerFile = dockerFile.replaceAll(nexusUrlRegex, "\$1${params.nexus_repository_manager_url}")
|
|
}
|
|
else {
|
|
// default URL
|
|
def defaultUrl = /https:\/\/download-staging.sonatype.com\/nexus\/3\/nexus-\$\{NEXUS_VERSION\}-unix\.tar\.gz/
|
|
dockerFile = dockerFile.replaceAll(nexusUrlRegex, "\$1${defaultUrl}")
|
|
|
|
def normalizedUrl = "a".replaceAll(/./, "${defaultUrl}")
|
|
nexusUrl = normalizedUrl.replace("\${NEXUS_VERSION}", params.nexus_repository_manager_version)
|
|
nexusUrl = nexusUrl.replace("\${JAVA_VERSION}", javaVersion)
|
|
}
|
|
def sha = getSha(nexusUrl)
|
|
|
|
dockerFile = dockerFile.replaceAll(shaRegex, "\$1${sha}")
|
|
|
|
writeFile(file: dockerFileLocation, text: dockerFile)
|
|
}
|
|
|
|
def getSha(url) {
|
|
def sha = sh (
|
|
script: "curl -s -L ${url} | shasum -a 256 | cut -d' ' -f1",
|
|
returnStdout: true
|
|
).trim()
|
|
return sha
|
|
}
|
|
|
|
def extractBaseImage(dockerFileLocation) {
|
|
def dockerFile = readFile(file: dockerFileLocation)
|
|
def baseImageRegex = "FROM\\s+([^\\s]+)"
|
|
def usedImages = dockerFile =~ baseImageRegex
|
|
|
|
return usedImages[0][1]
|
|
}
|