Jenkinsfile.treecompose

def TIMER = "H/30 * * * *"
def NODE = "rhcos-jenkins"
def API_CI_REGISTRY = "registry.svc.ci.openshift.org"
def OS_NAME = "maipo";
def OSCONTAINER_IMG = API_CI_REGISTRY + "/rhcos/os-${OS_NAME}"
def OPENSHIFT_URL = "https://api.ci.openshift.org";
def COMPOSEFLAGS = "";

// We write to this one for now
def artifact_repo = "/srv/rhcos/output/repo"

node(NODE) {
    def par_stages = [:]
    stage("Clean workspace") {
       step([$class: 'WsCleanup'])
    }
    checkout scm
    utils = load("pipeline-utils.groovy")
    utils.define_properties(TIMER)

    try {
    def manifest = "host-${OS_NAME}.yaml"
    def manifest_data = readYaml file: "${manifest}";
    // TODO - stop using the ref in favor of oscontainer:// pivot
    def ref = manifest_data.ref;
    def version_prefix = manifest_data["mutate-os-release"];

    utils.inside_assembler_container("") {
        def treecompose_workdir = "${WORKSPACE}/treecompose";
        def repo = "${treecompose_workdir}/repo";

        stage("Prepare configuration") {
            utils.prepare_configuration();
        }

        stage("Pull and run oscontainer") {
            withCredentials([
                usernameColonPassword(credentialsId: params.REGISTRY_CREDENTIALS, variable: 'CREDS'),
            ]) {
                utils.openshift_login("${OPENSHIFT_URL}", "${CREDS}", "rhcos")
                utils.registry_login("${OSCONTAINER_IMG}", "${CREDS}")
                sh """
                    if ! skopeo inspect docker://${OSCONTAINER_IMG}:buildmaster; then
                        ./scripts/pull-mount-oscontainer ${treecompose_workdir} ${OSCONTAINER_IMG}:latest
                    else
                        ./scripts/pull-mount-oscontainer ${treecompose_workdir} ${OSCONTAINER_IMG}:buildmaster
                    fi
                """
            }
        }

        def last_build_version, force_nocache
        stage("Check for Changes") { sh """
            rpm-ostree compose tree --dry-run --repo=${repo} --touch-if-changed=$WORKSPACE/build.stamp ${manifest}
        """
            last_build_version = utils.get_rev_version(repo, ref)
            if (fileExists('force-nocache-build')) {
                force_nocache = readFile('force-nocache-build').trim();
            }
        }

        if (!params.DRY_RUN && !fileExists('build.stamp') && last_build_version != force_nocache) {
            echo "No changes."
            currentBuild.result = 'SUCCESS'
            currentBuild.description = '(No changes)'
            return
        }

        // Note that we don't keep history in the ostree repo, so we
        // delete the ref head (so rpm-ostree won't add a parent) and
        // then we do a repo prune after.
        def composeMeta;
        try {
            stage("Compose Tree") {
                sh """./scripts/run-treecompose ${repo} ${ref} ${manifest} ${COMPOSEFLAGS} --add-metadata-string=version=${version_prefix}.${env.BUILD_NUMBER}"""
                composeMeta = readJSON file: "compose.json"
                currentBuild.description = "🆕 ${composeMeta.version} (commit ${composeMeta.commit})";
            }
        } finally {
            archiveArtifacts artifacts: "compose.json"
            archiveArtifacts artifacts: "pkg-diff.txt", allowEmptyArchive: true
        }

        // This takes OSTree repo and copies it out of the original
        // container into our working directory, which then gets put
        // into a new container image.  This is slow, but it's hard to do better
        // with Docker/OCI images.  Ideally there'd be a way to "bind mount" content
        // into the build environment rather than copying.
        stage("Prepare repo copy") { sh """
            original_repo=\$(readlink ${treecompose_workdir}/repo)
            rm ${repo}
            cp -a --reflink=auto \${original_repo} ${repo}
            podman kill oscontainer
            podman rm oscontainer
        """ }

        stage("Build new container") { sh """
            podman build --build-arg OS_VERSION=${composeMeta.version} \
                         --build-arg OS_COMMIT=${composeMeta.commit} \
                         -t ${OSCONTAINER_IMG}:buildmaster \
                         -f ${WORKSPACE}/Dockerfile.rollup ${WORKSPACE}
            podman tag ${OSCONTAINER_IMG}:buildmaster ${OSCONTAINER_IMG}:${composeMeta.commit}
        """ }

        if (params.DRY_RUN) {
            echo "DRY_RUN set, skipping push"
            currentBuild.result = 'SUCCESS'
            currentBuild.description = '(dry run)'
            return
        }

        stage("Push container") { sh """
            podman push ${OSCONTAINER_IMG}:buildmaster
            skopeo inspect docker://${OSCONTAINER_IMG}:buildmaster | jq '.Digest' > imgid.txt
        """
            def cid = readFile('imgid.txt').trim().replaceAll('"','');
            // tag the image by SHA256 using OpenShift means
            sh """oc tag os-${OS_NAME}@${cid} os-${OS_NAME}:${composeMeta.commit}"""
            currentBuild.description = "🆕 ${OSCONTAINER_IMG}@${cid} (${composeMeta.version})";
        }

        stage("rsync out") {
            withCredentials([
               string(credentialsId: params.ARTIFACT_SERVER, variable: 'ARTIFACT_SERVER'),
               sshUserPrivateKey(credentialsId: params.ARTIFACT_SSH_CREDS_ID, keyFileVariable: 'KEY_FILE'),
            ]) {
            sh """
               /usr/app/ostree-releng-scripts/rsync-repos \
                   --dest ${ARTIFACT_SERVER}:${artifact_repo} --src=${repo}/ \
                   --rsync-opt=--stats --rsync-opt=-e \
                   --rsync-opt='ssh -i ${KEY_FILE} -o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no'
            """
        } }

        stage("Cleanup") { sh """
            rm ${treecompose_workdir} -rf
        """ }

        // Trigger downstream jobs
        build job: 'coreos-rhcos-cloud', wait: false
    }
    } catch (Throwable e) {
        currentBuild.result = 'FAILURE'
        throw e
    } finally {
        utils.notify_status_change currentBuild
    }
}