// Jenkinsfile - 声明式流水线
pipeline {
    agent {
        kubernetes {
            yaml '''
apiVersion: v1
kind: Pod
spec:
  containers:
  - name: jnlp
    image: jenkins/jnlp-slave:latest
    resources:
      limits:
        memory: "2Gi"
        cpu: "1"
      requests:
        memory: "1Gi"
        cpu: "0.5"
  - name: maven
    image: maven:3.8.6-openjdk-11
    command: ["sleep", "99999"]
    resources:
      limits:
        memory: "4Gi"
        cpu: "2"
      requests:
        memory: "2Gi"
        cpu: "1"
  - name: docker
    image: docker:20.10
    command: ["sleep", "99999"]
    volumeMounts:
    - name: docker-sock
      mountPath: /var/run/docker.sock
  volumes:
  - name: docker-sock
    hostPath:
      path: /var/run/docker.sock
'''
        }
    }
    
    environment {
        IMAGE_NAME = "myapp"
        IMAGE_TAG = "${BUILD_NUMBER}-${GIT_COMMIT.substring(0, 7)}"
        REGISTRY = "registry.example.com"
    }
    
    stages {
        stage('Checkout') {
            steps {
                git branch: 'main', url: 'https://github.com/example/myapp.git'
            }
        }
        
        stage('Build') {
            steps {
                container('maven') {
                    sh 'mvn clean package -DskipTests'
                }
            }
        }
        
        stage('Unit Test') {
            steps {
                container('maven') {
                    sh 'mvn test'
                }
            }
            post {
                always {
                    junit 'target/surefire-reports/*.xml'
                }
            }
        }
        
        stage('Static Analysis') {
            steps {
                container('maven') {
                    sh 'mvn sonar:sonar -Dsonar.host.url=http://sonarqube:9000'
                }
            }
        }
        
        stage('Security Scan') {
            steps {
                container('maven') {
                    sh 'mvn org.owasp:dependency-check-maven:check'
                }
            }
        }
        
        stage('Build Docker Image') {
            steps {
                container('docker') {
                    sh "docker build -t ${REGISTRY}/${IMAGE_NAME}:${IMAGE_TAG} ."
                    sh "docker push ${REGISTRY}/${IMAGE_NAME}:${IMAGE_TAG}"
                }
            }
        }
        
        stage('Image Security Scan') {
            steps {
                sh "trivy image ${REGISTRY}/${IMAGE_NAME}:${IMAGE_TAG} --exit-code 1 --severity HIGH,CRITICAL"
            }
        }
        
        stage('Deploy to Test') {
            steps {
                sh "helm upgrade --install myapp-test ./helm-chart \
                    --namespace test \
                    --set image.tag=${IMAGE_TAG} \
                    --set env=test"
            }
        }
        
        stage('Integration Test') {
            steps {
                sh 'curl -s http://myapp-test/api/health | grep "OK"'
            }
        }
        
        stage('Deploy to Staging') {
            when {
                branch 'main'
            }
            steps {
                sh "helm upgrade --install myapp-staging ./helm-chart \
                    --namespace staging \
                    --set image.tag=${IMAGE_TAG} \
                    --set env=staging"
            }
        }
        
        stage('Manual Approval') {
            when {
                branch 'main'
            }
            steps {
                input message: 'Approve deployment to production?', submitter: 'sre-team'
            }
        }
        
        stage('Deploy to Production') {
            when {
                branch 'main'
            }
            steps {
                sh "helm upgrade --install myapp-prod ./helm-chart \
                    --namespace prod \
                    --set image.tag=${IMAGE_TAG} \
                    --set env=prod \
                    --set replicaCount=3"
            }
        }
    }
    
    post {
        success {
            slackSend channel: '#cicd', message: "Pipeline succeeded: ${BUILD_URL}"
        }
        failure {
            slackSend channel: '#cicd', message: "Pipeline failed: ${BUILD_URL}"
            emailext to: 'sre-team@example.com',
                     subject: "Pipeline Failed: ${BUILD_URL}",
                     body: "Check the build at ${BUILD_URL}"
        }
    }
}

// Jenkins安全最佳实践配置

// 1. 凭证管理 - 使用Jenkins Credentials Plugin
credentials {
    usernamePassword(
        id: 'docker-registry',
        usernameVariable: 'DOCKER_USER',
        passwordVariable: 'DOCKER_PASS',
        description: 'Docker registry credentials'
    )
    
    string(
        id: 'slack-webhook',
        value: 'https://hooks.slack.com/services/XXX',
        description: 'Slack webhook URL'
    )
}

// 2. 流水线安全 - 限制脚本执行
pipeline {
    agent any
    options {
        // 禁止使用不安全的方法
        disableConcurrentBuilds()
        timestamps()
        // 设置构建超时时间
        timeout(time: 60, unit: 'MINUTES')
        // 清理工作空间
        deleteDirs()
    }
}