Credentials Management

pipeline {
    agent { label 'linux' }

    // Method 1: environment block injection
    // Credentials are available to ALL stages as environment variables
    // Best for credentials used in multiple stages
    environment {
        // For a username/password credential, Jenkins creates two variables:
        // DOCKER_CREDS_USR = the username
        // DOCKER_CREDS_PSW = the password (masked in logs)
        DOCKER_CREDS  = credentials('docker-registry-credentials')

        // For a secret text credential, creates one variable with the secret value
        SLACK_WEBHOOK = credentials('slack-webhook-url')
    }

    stages {

        stage('Build and Push Image') {
            steps {
                // Use the variables injected by the environment block
                // DOCKER_CREDS_USR and DOCKER_CREDS_PSW are available here
                sh """
                    docker login \
                      -u ${DOCKER_CREDS_USR} \
                      -p ${DOCKER_CREDS_PSW} \
                      registry.acmecorp.com

                    docker build -t registry.acmecorp.com/analytics-service:${BUILD_NUMBER} .
                    docker push registry.acmecorp.com/analytics-service:${BUILD_NUMBER}
                """
            }
        }

        stage('Deploy to Production') {
            when { branch 'main' }
            steps {
                // Method 2: withCredentials block
                // The SSH key is only available inside this block
                // Best for credentials needed in just one place
                withCredentials([
                    sshUserPrivateKey(
                        credentialsId: 'prod-server-ssh-key',
                        keyFileVariable: 'SSH_KEY_FILE',   // path to the temp key file
                        usernameVariable: 'SSH_USER'        // the SSH username
                    )
                ]) {
                    // SSH_KEY_FILE contains the path to the private key file Jenkins created
                    sh """
                        ssh -i ${SSH_KEY_FILE} \
                            -o StrictHostKeyChecking=no \
                            ${SSH_USER}@prod-server-01.acmecorp.com \
                            'docker pull registry.acmecorp.com/analytics-service:${BUILD_NUMBER} && \
                             docker-compose up -d'
                    """
                }
                // SSH_KEY_FILE and SSH_USER are no longer available here
                // Jenkins deletes the temporary key file after the block closes
            }
        }

        stage('Notify') {
            steps {
                // Method 3: withCredentials for a secret text credential
                // Useful when you need fine-grained control over when the secret is used
                withCredentials([
                    string(
                        credentialsId: 'slack-webhook-url',
                        variable: 'SLACK_URL'
                    )
                ]) {
                    sh """
                        curl -X POST \
                          -H 'Content-type: application/json' \
                          --data '{"text":"analytics-service ${BUILD_NUMBER} deployed to production"}' \
                          ${SLACK_URL}
                    """
                }
            }
        }

    }

    post {
        failure {
            // SLACK_WEBHOOK is available here — it was injected at pipeline level
            sh """
                curl -X POST \
                  -H 'Content-type: application/json' \
                  --data '{"text":"analytics-service pipeline FAILED — build ${BUILD_NUMBER}"}' \
                  ${SLACK_WEBHOOK}
            """
        }
        always { cleanWs() }
    }

}