Handling Pipeline Failures

pipeline {
    agent { label 'linux' }

    stages {

        stage('Integration Tests') {
            steps {
                // retry wraps the block and re-runs it up to 3 times if it fails
                // Use for genuinely flaky tests or external dependencies
                // Do NOT use to hide real test failures — fix those instead
                retry(3) {
                    sh './gradlew integrationTest'
                }
            }
        }

        stage('Deploy') {
            steps {
                // Combine retry with timeout for network-dependent operations
                // This retries the deploy up to 2 times, but each attempt
                // is killed if it takes longer than 5 minutes
                retry(2) {
                    timeout(time: 5, unit: 'MINUTES') {
                        sh './deploy.sh staging'
                    }
                }
            }
        }

    }
}

pipeline {
    agent { label 'linux' }

    stages {

        stage('Run All Checks') {
            steps {

                // catchError lets the pipeline continue even if this step fails
                // buildResult: the final build result if this block fails
                // stageResult: what this stage shows in the UI if it fails
                catchError(buildResult: 'FAILURE', stageResult: 'FAILURE') {
                    // Unit tests — if these fail, build should fail
                    sh './gradlew test'
                }

                // This step runs even if the unit tests above failed
                // Because catchError caught the failure and let execution continue
                catchError(buildResult: 'UNSTABLE', stageResult: 'UNSTABLE') {
                    // Static analysis — if this fails, mark build as unstable (yellow)
                    // but don't fail the whole build — just flag it for review
                    sh './gradlew checkstyle pmd'
                }

                // Publish results regardless of what failed above
                // We want the test report even if tests failed
                junit allowEmptyResults: true, testResults: 'build/test-results/**/*.xml'
            }
        }

    }
}

pipeline {
    agent { label 'linux' }

    environment {
        APP_NAME     = 'payments-service'
        REGISTRY     = 'registry.acmecorp.com'
        DOCKER_CREDS = credentials('docker-registry-credentials')
    }

    stages {

        stage('Deploy to Production') {
            when { branch 'main' }
            steps {
                script {
                    // Store the current running version BEFORE deploying
                    // If the new deploy fails, we need this to roll back
                    def previousVersion = sh(
                        script: "kubectl get deployment/${APP_NAME} " +
                                "-o jsonpath='{.spec.template.spec.containers[0].image}' " +
                                "--namespace=production",
                        returnStdout: true
                    ).trim()

                    echo "Current version in production: ${previousVersion}"
                    echo "Deploying new version: ${REGISTRY}/${APP_NAME}:${BUILD_NUMBER}"

                    try {
                        // Attempt the deploy
                        sh """
                            kubectl set image deployment/${APP_NAME} \
                              ${APP_NAME}=${REGISTRY}/${APP_NAME}:${BUILD_NUMBER} \
                              --namespace=production
                            kubectl rollout status deployment/${APP_NAME} \
                              --namespace=production --timeout=120s
                        """

                        // Post-deploy health check — confirm the service is responding
                        sh 'curl --fail --retry 3 https://api.acmecorp.com/health'
                        echo "✅ Deploy successful — health check passed"

                    } catch(Exception e) {
                        // Deploy or health check failed — roll back immediately
                        echo "❌ Deploy failed: ${e.getMessage()}"
                        echo "Rolling back to: ${previousVersion}"

                        // Restore the previous image
                        sh """
                            kubectl set image deployment/${APP_NAME} \
                              ${APP_NAME}=${previousVersion} \
                              --namespace=production
                            kubectl rollout status deployment/${APP_NAME} \
                              --namespace=production --timeout=120s
                        """

                        echo "Rollback complete — production restored to ${previousVersion}"

                        // Mark the build as failed and propagate the exception
                        // Without 'throw e' Jenkins would treat the catch as a success
                        currentBuild.result = 'FAILURE'
                        throw e

                    } finally {
                        // Always runs — log the final state of the production deployment
                        // Useful for the audit trail regardless of success or failure
                        sh "kubectl get deployment/${APP_NAME} --namespace=production"
                    }
                }
            }
        }

    }

    post {
        failure {
            slackSend(
                channel: '#incidents',
                color: 'danger',
                message: """
                    🚨 *PRODUCTION DEPLOY FAILED AND ROLLED BACK*
                    Service: *${APP_NAME}*
                    Build: <${env.BUILD_URL}|#${BUILD_NUMBER}>
                    Production has been restored to the previous version.
                """.stripIndent().trim()
            )
        }
        success {
            slackSend(
                channel: '#deployments',
                color: 'good',
                message: "✅ *${APP_NAME}* build #${BUILD_NUMBER} deployed to production successfully"
            )
        }
        always { cleanWs() }
    }

}

pipeline {
    agent { label 'linux' }

    stages {

        stage('Test') {
            steps {
                sh './gradlew test jacocoTestReport'
            }
            post {
                always {
                    junit 'build/test-results/**/*.xml'

                    // Check code coverage — warn if below threshold, don't fail
                    script {
                        def coverage = sh(
                            script: "grep -oP '(?<= 1) {
                        // Critical vulnerabilities found — fail the build
                        error('Dependency check found HIGH severity vulnerabilities — build blocked')
                    }
                }
            }
        }

    }
}

pipeline {
    agent { label 'linux' }

    // Pipeline-level timeout — the entire pipeline must finish within 45 minutes
    options {
        timeout(time: 45, unit: 'MINUTES')
    }

    stages {

        stage('Integration Tests') {
            steps {
                // Stage-level timeout — this specific stage has 15 minutes max
                timeout(time: 15, unit: 'MINUTES') {
                    sh './gradlew integrationTest'
                }
            }
        }

        stage('Wait for Service') {
            steps {
                // Step-level timeout — abort if the health check doesn't respond in 2 minutes
                timeout(time: 2, unit: 'MINUTES') {
                    // waitUntil polls until the block returns true or timeout fires
                    waitUntil {
                        def response = sh(
                            script: 'curl -s -o /dev/null -w "%{http_code}" https://staging.acmecorp.com/health',
                            returnStdout: true
                        ).trim()
                        return response == '200'
                    }
                }
            }
        }

    }
}