Jenkinsfile-release

#!/usr/bin/env groovy

currentBuild.description = "${ref} -> ${tag}"
// https://semver.org/#is-there-a-suggested-regular-expression-regex-to-check-a-semver-string
def semverPattern = /^(0|[1-9]\d*)\.(0|[1-9]\d*)\.(0|[1-9]\d*)(?:-((?:0|[1-9]\d*|\d*[a-zA-Z-][0-9a-zA-Z-]*)(?:\.(?:0|[1-9]\d*|\d*[a-zA-Z-][0-9a-zA-Z-]*))*))?(?:\+([0-9a-zA-Z-]+(?:\.[0-9a-zA-Z-]+)*))?$/

pipeline {
  agent {
    kubernetes {
      cloud 'SLKE'
      defaultContainer 'maven'
      yaml """
kind: Pod
spec:
  # All containers should have the same UID
  securityContext:
    runAsUser: 0
  containers:
  - name: maven
    image: harbor.softleader.com.tw/library/maven:3-eclipse-temurin-17
    imagePullPolicy: Always
    command: ['cat']
    tty: true
    resources:
      limits:
        memory: "1Gi"
        cpu: "2"
    volumeMounts:
    - name: m2
      mountPath: /root/.m2
    - name: gpg
      mountPath: /var/gpg
  - name: git
    image: harbor.softleader.com.tw/library/git:2
    command: ['cat']
    tty: true
    resources:
      limits:
        memory: "100Mi"
        cpu: "100m"
  volumes:
  - name: m2
    persistentVolumeClaim:
      claimName: m2-claim
  - name: gpg
    persistentVolumeClaim:
      claimName: gpg-claim
"""
    }
  }

  environment {
    // 在 Jenkins 中 System Configuration > Manage Credential
    // ref: https://docs.cloudbees.com/docs/cloudbees-ci/latest/cloud-secure-guide/injecting-secrets
    CREDENTIAL = credentials("a84db61d-b4a4-4e05-a368-c1b283860090")
    MAVEN_OPTS="-Xmx768m -XX:MaxMetaspaceSize=128m"
  }

  stages {

    stage('Setup') {
      steps {
        container('git') {
          script {
            env.GIT_PATH = sh(
              script: 'echo $GIT_URL | awk -F"github.com/" "{print \\\$2}"',
              returnStdout: true
            ).trim()
            sh """
            git remote set-url origin https://$CREDENTIAL_USR:"$CREDENTIAL_PSW"@github.com/$GIT_PATH".git"
            git config --global user.email "jenkins-bot@softleader.com.tw"
            git config --global user.name "jenkins[bot]"
            echo $CREDENTIAL_PSW | gh auth login --with-token
            """
          }
        }
        sh 'printenv'
        sh 'java -version'
        sh 'mvn --version'
        echo "${params}"
      }
    }

    stage ('Preflight Checks') {
      steps {
        container('git') {
          script {
            def isSemVer = ("${tag}" ==~ semverPattern)
            if (!isSemVer) {
              error "Tag must matches semantic versioning 2 (https://semver.org/) but got: ${tag}";
            }
            TAG_EXISTS = sh(
              script: 'gh release view ${tag} --json name',
              returnStatus: true
            )
            def tagExists = ("${TAG_EXISTS}" == "0")
            if (tagExists) {
              error "Tag ${tag} already exists";
            }
          }
        }
      }
    }

    stage ('Create Release') {
      steps {
        container('git') {
          sh "gh release create ${tag} --target ${ref} --generate-notes --draft"
        }
      }
    }

    stage ('Publish Release') {
      steps {
        sh """
        echo /var/gpg/softleader.passphrase | gpg --batch --yes --import /var/gpg/softleader.key
        make release
        """
      }
      post {
        success {
          script {
            container('git') {
              sh """
              gh release edit ${tag} --draft=false --latest
              """
            }
          }
        }
      }
    }
  }

  post {
    failure {
      slackSend(
        color: "danger",
        channel: "@matt",
        message: "Attention @here, The pipeline <$BUILD_URL|*${env.JOB_NAME} #${env.BUILD_NUMBER}*> has failed! :omg:\n>Last commit by ${env.LAST_COMMIT_AUTHOR_NAME} (${env.LAST_COMMIT_AUTHOR_EMAIL}) @ ${env.LAST_COMMIT_TIME}"
      )
    }
  }
}