Pipeline with Docker

// Using Docker as the build environment
// The pipeline runs inside a Maven container — no Maven needed on the agent
pipeline {

    agent {
        docker {
            // Use the official Maven image with Java 21
            // This image has Maven and Java pre-installed
            image 'maven:3.9-eclipse-temurin-21'

            // Mount the Maven cache from the host into the container
            // Without this, Maven re-downloads all dependencies on every build
            // $HOME/.m2 is the Maven local repository — expensive to rebuild
            args '-v $HOME/.m2:/root/.m2'
        }
    }

    stages {

        stage('Build') {
            steps {
                // mvn is available because we're running inside the Maven container
                // No 'mvn not found' errors — it's baked into the image
                sh 'mvn --version'   // confirm the correct Maven version
                sh 'mvn clean package -DskipTests'
            }
        }

        stage('Test') {
            steps {
                sh 'mvn test'
            }
            post {
                always {
                    junit 'target/surefire-reports/**/*.xml'
                }
            }
        }

    }

}

// -------------------------------------------------------
// ADVANCED: Different stages in different containers
// Use 'agent none' at the top and declare agents per-stage
// -------------------------------------------------------

pipeline {
    agent none  // no global agent — each stage picks its own

    stages {

        stage('Test — Java') {
            agent {
                docker { image 'eclipse-temurin:21-jdk' }
            }
            steps {
                sh './gradlew test'
            }
        }

        stage('Test — Node') {
            agent {
                docker { image 'node:20-alpine' }
            }
            steps {
                sh 'npm ci && npm test'
            }
        }

        stage('Lint Python') {
            agent {
                docker { image 'python:3.12-slim' }
            }
            steps {
                sh 'pip install flake8 && flake8 scripts/'
            }
        }

    }
}

pipeline {
    // The agent needs Docker installed to build images
    agent { label 'linux && docker' }

    environment {
        APP_NAME    = 'shipment-tracker'
        REGISTRY    = 'registry.acmecorp.com'
        // Composite tag: build number + short git commit hash
        // e.g. 58-a3f2b1c — links to both Jenkins build and Git commit
        IMAGE_TAG   = "${BUILD_NUMBER}-${env.GIT_COMMIT?.take(7) ?: 'unknown'}"
        DOCKER_CREDS = credentials('docker-registry-credentials')
    }

    stages {

        stage('Checkout') {
            steps {
                checkout scm
                echo "Building image: ${REGISTRY}/${APP_NAME}:${IMAGE_TAG}"
            }
        }

        stage('Test') {
            steps {
                // Run tests first — don't build the image if tests fail
                sh './gradlew test'
            }
            post {
                always { junit 'build/test-results/**/*.xml' }
            }
        }

        stage('Build Docker Image') {
            when { branch 'main' }
            steps {
                script {
                    // docker.build() builds the image from the Dockerfile in the current directory
                    // Returns an image object we can use to tag and push
                    def image = docker.build("${REGISTRY}/${APP_NAME}:${IMAGE_TAG}")

                    // docker.withRegistry() authenticates with the registry
                    // Uses credentials from the Jenkins credential store — never plain text
                    docker.withRegistry("https://${REGISTRY}", 'docker-registry-credentials') {

                        // Push with the composite tag (build number + commit hash)
                        // This is the immutable, traceable tag — never changes after push
                        image.push(IMAGE_TAG)

                        // Also push as 'latest' — always points to the newest main build
                        // Kubernetes deployments can reference 'latest' for auto-update
                        image.push('latest')

                    }
                    echo "Pushed: ${REGISTRY}/${APP_NAME}:${IMAGE_TAG}"
                    echo "Pushed: ${REGISTRY}/${APP_NAME}:latest"
                }
            }
        }

        stage('Security Scan') {
            when { branch 'main' }
            steps {
                // Trivy is an open-source container vulnerability scanner
                // It scans the image for known CVEs before it goes anywhere near production
                sh """
                    docker run --rm \
                      -v /var/run/docker.sock:/var/run/docker.sock \
                      aquasec/trivy image \
                      --exit-code 1 \
                      --severity HIGH,CRITICAL \
                      ${REGISTRY}/${APP_NAME}:${IMAGE_TAG}
                """
            }
        }

        stage('Update Deployment Manifest') {
            when { branch 'main' }
            steps {
                // Update the Kubernetes deployment YAML with the new image tag
                // The GitOps pipeline (ArgoCD/Flux) picks this up and deploys automatically
                sh """
                    sed -i 's|image: ${REGISTRY}/${APP_NAME}:.*|image: ${REGISTRY}/${APP_NAME}:${IMAGE_TAG}|g' \
                        k8s/deployment.yaml
                    git config user.email 'jenkins@acmecorp.com'
                    git config user.name 'Jenkins'
                    git add k8s/deployment.yaml
                    git commit -m 'ci: update ${APP_NAME} image to ${IMAGE_TAG} [skip ci]'
                    git push origin main
                """
            }
        }

    }

    post {
        success {
            slackSend(
                channel: '#deployments',
                color: 'good',
                message: "🐳 *${APP_NAME}:${IMAGE_TAG}* pushed to registry — <${env.BUILD_URL}|Build #${BUILD_NUMBER}>"
            )
        }
        failure {
            slackSend(
                channel: '#deployments',
                color: 'danger',
                message: "❌ *${APP_NAME}* Docker build failed — <${env.BUILD_URL}|Build #${BUILD_NUMBER}>"
            )
        }
        always {
            // Clean up local Docker images after pushing
            // Prevents the agent disk from filling up with old images
            sh "docker rmi ${REGISTRY}/${APP_NAME}:${IMAGE_TAG} || true"
            sh "docker rmi ${REGISTRY}/${APP_NAME}:latest || true"
            cleanWs()
        }
    }

}