Mini Project — End-to-End CI/CD Pipeline

// payment-api/Jenkinsfile
// Mini Project — End-to-End CI/CD Pipeline

// Lesson 36: Shared library import — pinned version for production safety
@Library('acme-pipelines@v3.0.0') _

pipeline {

    // Lesson 39: Kubernetes pod agent — clean ephemeral build environment
    agent {
        kubernetes {
            label 'java-builder'
            defaultContainer 'maven'
        }
    }

    // Lesson 16: Environment variables — declared once, used everywhere
    environment {
        APP_NAME        = 'payment-api'
        DOCKER_REGISTRY = 'registry.acmecorp.com'
        STAGING_NS      = 'staging'
        PROD_NS         = 'production'
        HEALTH_PATH     = '/actuator/health'

        // Lesson 18: Credentials — injected from Jenkins store, masked in output
        // credentials() for usernamePassword creates _USR and _PSW variables
        DOCKER_CREDS    = credentials('docker-registry-credentials')
    }

    options {
        // Lesson 44 (AP-04): Always set a pipeline timeout
        timeout(time: 45, unit: 'MINUTES')

        // Lesson 44 (AP-10): Log rotation — never accumulate unlimited builds
        buildDiscarder(logRotator(numToKeepStr: '20', artifactNumToKeepStr: '5'))

        timestamps()
        skipDefaultCheckout()
    }

    // Lesson 19: Webhook trigger — fires on every push to GitHub
    triggers {
        githubPush()
    }

    stages {

        stage('Checkout') {
            steps {
                checkout scm
                script {
                    // Lesson 16: Capture git metadata for image tag and notifications
                    env.GIT_SHORT   = sh(script: 'git rev-parse --short HEAD',
                                         returnStdout: true).trim()
                    env.GIT_AUTHOR  = sh(script: 'git log -1 --format="%an"',
                                         returnStdout: true).trim()
                    env.GIT_MESSAGE = sh(script: 'git log -1 --format="%s"',
                                         returnStdout: true).trim()

                    // Build-number + short SHA = unique, traceable image tag
                    env.IMAGE_TAG   = "${APP_NAME}:${BUILD_NUMBER}-${env.GIT_SHORT}"
                    env.FULL_IMAGE  = "${DOCKER_REGISTRY}/${env.IMAGE_TAG}"

                    echo "Building ${env.FULL_IMAGE}"
                    echo "'${env.GIT_MESSAGE}' by ${env.GIT_AUTHOR}"
                }
            }
        }

        stage('Test') {
            steps {
                // Lesson 15: Dedicated test stage — failures caught before any image is built
                sh './gradlew clean test integrationTest --continue'
            }
            post {
                always {
                    // Lesson 9: Publish test results regardless of pass/fail
                    junit allowEmptyResults: true,
                          testResults: 'build/test-results/**/*.xml'
                    archiveArtifacts artifacts: 'build/reports/**',
                                     allowEmptyArchive: true
                }
            }
        }

        stage('Code Quality') {
            steps {
                sh './gradlew checkstyleMain spotbugsMain'
            }
            post {
                always {
                    archiveArtifacts artifacts: 'build/reports/checkstyle/**,build/reports/spotbugs/**',
                                     allowEmptyArchive: true
                }
            }
        }

        stage('Build Docker Image') {
            steps {
                // Lesson 23/39: Switch to the docker container in the build pod
                container('docker') {
                    sh """
                        docker login -u ${DOCKER_CREDS_USR} -p ${DOCKER_CREDS_PSW} ${DOCKER_REGISTRY}
                        docker build \
                          --build-arg BUILD_NUMBER=${BUILD_NUMBER} \
                          --build-arg GIT_COMMIT=${env.GIT_SHORT} \
                          -t ${FULL_IMAGE} \
                          -t ${DOCKER_REGISTRY}/${APP_NAME}:latest \
                          .
                        docker push ${FULL_IMAGE}
                        docker push ${DOCKER_REGISTRY}/${APP_NAME}:latest
                    """
                }
            }
        }

        stage('Deploy to Staging') {
            // Lesson 15/21: Only deploy from main — feature branches stop after Build
            when { branch 'main' }
            steps {
                script {
                    // Lesson 24: Capture current image for rollback if deploy fails
                    def previousImage = sh(
                        script: "kubectl get deployment ${APP_NAME} -n ${STAGING_NS} " +
                                "-o jsonpath='{.spec.template.spec.containers[0].image}'",
                        returnStdout: true
                    ).trim()

                    try {
                        sh """
                            kubectl set image deployment/${APP_NAME} \
                              ${APP_NAME}=${FULL_IMAGE} \
                              --namespace=${STAGING_NS}

                            kubectl rollout status deployment/${APP_NAME} \
                              --namespace=${STAGING_NS} --timeout=3m
                        """
                    } catch (err) {
                        echo "Staging deploy failed — rolling back to ${previousImage}"
                        sh "kubectl rollout undo deployment/${APP_NAME} --namespace=${STAGING_NS}"
                        error("Deploy to staging failed: ${err.message}")
                    }
                }
            }
        }

        stage('Smoke Test — Staging') {
            when { branch 'main' }
            steps {
                // Lesson 24: timeout + retry for transient startup delay
                timeout(time: 2, unit: 'MINUTES') {
                    retry(3) {
                        sh """
                            sleep 5
                            curl --fail --silent \
                              https://${APP_NAME}.${STAGING_NS}.acmecorp.com${HEALTH_PATH} \
                              | grep -q '"status":"UP"'
                        """
                    }
                }
                echo "Staging smoke test passed — ${env.FULL_IMAGE} is healthy"
            }
        }

        stage('Production Approval') {
            when { branch 'main' }
            steps {
                // Lesson 13: Manual gate — release engineers approve before production
                // Outer timeout covers the waiting period — abandons after 24 hrs
                timeout(time: 24, unit: 'HOURS') {
                    input(
                        message: "Deploy ${env.IMAGE_TAG} to PRODUCTION?\n" +
                                 "Commit: ${env.GIT_MESSAGE}\n" +
                                 "Author: ${env.GIT_AUTHOR}\n" +
                                 "Staging: PASSED",
                        ok: 'Deploy to Production',
                        submitter: 'release-engineers,payments-leads'
                    )
                }
            }
        }

        stage('Deploy to Production') {
            when { branch 'main' }
            steps {
                script {
                    def previousImage = sh(
                        script: "kubectl get deployment ${APP_NAME} -n ${PROD_NS} " +
                                "-o jsonpath='{.spec.template.spec.containers[0].image}'",
                        returnStdout: true
                    ).trim()

                    withCredentials([file(credentialsId: 'kubeconfig-production',
                                         variable: 'KUBECONFIG')]) {
                        try {
                            sh """
                                kubectl set image deployment/${APP_NAME} \
                                  ${APP_NAME}=${FULL_IMAGE} \
                                  --namespace=${PROD_NS}

                                kubectl rollout status deployment/${APP_NAME} \
                                  --namespace=${PROD_NS} --timeout=5m
                            """
                        } catch (err) {
                            echo "Production deploy failed — rolling back to ${previousImage}"
                            sh "kubectl rollout undo deployment/${APP_NAME} --namespace=${PROD_NS}"
                            error("Production deploy failed: ${err.message}")
                        }
                    }
                }
            }
        }

        stage('Smoke Test — Production') {
            when { branch 'main' }
            steps {
                timeout(time: 2, unit: 'MINUTES') {
                    retry(3) {
                        sh """
                            sleep 5
                            curl --fail --silent \
                              https://${APP_NAME}.acmecorp.com${HEALTH_PATH} \
                              | grep -q '"status":"UP"'
                        """
                    }
                }
                echo "Production smoke test passed — ${env.FULL_IMAGE} is live"
            }
        }

    } // end stages

    post {

        success {
            script {
                // Lesson 20 / Lesson 44 (AP-07): Notify on success only for main
                // Feature branch green builds stay quiet — no alert fatigue
                if (env.BRANCH_NAME == 'main') {
                    slackSend(
                        channel: '#payments-deployments',
                        color: 'good',
                        message: ":white_check_mark: *${APP_NAME}* deployed to production\n" +
                                 "Build: <${BUILD_URL}|#${BUILD_NUMBER}>\n" +
                                 "Image: `${env.IMAGE_TAG}`\n" +
                                 "Commit: _${env.GIT_MESSAGE}_ by ${env.GIT_AUTHOR}"
                    )
                }
            }
        }

        failure {
            // Notify on every failure regardless of branch
            slackSend(
                channel: '#payments-deployments',
                color: 'danger',
                message: ":x: *${APP_NAME}* build failed — " +
                         "<${BUILD_URL}|Build #${BUILD_NUMBER}> — ${env.GIT_MESSAGE}"
            )
        }

        // Lesson 25: Always clean workspace — no stale files between builds
        always { cleanWs() }

    }

}