Jenkinsfile-security

pipeline {
    agent any
    environment {
        PATH = "$PATH:/usr/local/bin/"
        IMAGETAG = ""
    }
    tools {
        maven 'maven@latest'
    }
    triggers {
        GenericTrigger (
            causeString: 'Triggered on push', genericVariables: [[defaultValue: '', key: 'branch', regexpFilter: '', value: '$.push.changes[0].old.name']], printContributedVariables: true, printPostContent: true, regexpFilterExpression: '^(master)*?$', regexpFilterText: '$branch', token: 'demo', tokenCredentialId: ''
        )
    }
    stages {
        stage('Git Clone') {
            steps {
                // cleanWs()
                git branch: 'master', credentialsId: 'github-login', url: 'https://github.com/watri/demo.git'
            }
        }
        stage('Change Jar Version') {
            steps {
                sh '''
                #!/bin/bash
                sed -i "s|dcid|${BUILD_NUMBER}|g" pom.xml
                sed -i "s|dcid|${BUILD_NUMBER}|g" Dockerfile
                chmod +x mvnw
                whoami
                '''
            }
        }
        stage('Secret Scanning') {
            steps {
                script {
                    sh "trufflehog filesystem --json --no-update ${WORKSPACE} --fail > trufflehog_output.json"
                }
            }
        }
        stage('Build') {
            steps {
                sh 'mvn clean install -Dmaven.test.skip=true'
            }
        }
        stage('Test') {
            steps {
                sh 'mvn test'
            }
        }
        stage('Dockerfie Scan Hadolint') {
            steps {
                sh 'hadolint --config hadolint.yaml Dockerfile'
            }
        }
        stage('SCA Using OWASP Dependency-Check') {
            steps {
                withCredentials([string(credentialsId: 'NVD-KEY', variable: 'NVD_KEY')]) {
                dependencyCheck additionalArguments: ''' 
                            -o './'
                            -s './'
                            -f 'ALL' 
                            --nvdApiKey=${NVD_KEY}
                            --prettyPrint
                            ''', odcInstallation: 'OWASP dependency-check'
                
                dependencyCheckPublisher pattern: 'dependency-check-report.xml'
                }
            }
        }
        stage('SAST Using Sonarcloud') {
            environment {
                SCANNER_HOME = tool 'sonarcloud5'
                ORGANIZATION = "watri"
                PROJECT_NAME = "watri_demo"
            }
            steps {
                withSonarQubeEnv('sonarcloud') {
                    sh '''$SCANNER_HOME/bin/sonar-scanner -Dsonar.organization=$ORGANIZATION \
                        -Dsonar.projectName=demo \
                        -Dsonar.java.binaries=target/classes \
                        -Dsonar.projectKey=$PROJECT_NAME \
                        -Dsonar.coverage.jacoco.xmlReportPaths=target/site/jacoco/jacoco.xml \
                        -Dsonar.exclusions=*.html
                        '''
                }
            }
        }
        stage("Quality Gate"){
            steps {
                timeout(time: 1, unit: 'HOURS') {
                    script {
                        def qg = waitForQualityGate() 
                        if (qg.status != 'OK') {
                            error "Pipeline aborted due to quality gate failure: ${qg.status}"
                        }
                    }
                }
            }
        }
        stage('Build Image') {
            steps {
                script{
                    IMAGETAG = sh(script: 'git rev-parse --short HEAD', returnStdout: true).trim() + BUILD_NUMBER
                    echo "Image Tag: ${IMAGETAG}"
                }
                sh "docker build -t watri/demo:${IMAGETAG} -f Dockerfile ."
            }
        }
        stage('Image Scan Trivy') {
            steps {
                sh "trivy image --cache-dir /var/lib/jenkins/trivy/ --config trivy.yaml watri/demo:${IMAGETAG}"
            }
        }
        stage('Push Image to Registry') {
            steps {
                withDockerRegistry([ credentialsId: 'docker-hub-cred', url: '' ]) {
                sh  "docker push watri/demo:${IMAGETAG}"
                }
            }
        }
        stage('Update Values File for ArgoCD') {
            environment {
                GIT_REPO_NAME = "demo-chart"
                GIT_USER_NAME = "watri"
            }
            steps {
                dir('demo-chart') {
                    git branch: 'master', credentialsId: 'github-login', url: 'https://github.com/watri/demo-chart.git'
                    
                    withCredentials([string(credentialsId: 'github-key', variable: 'GITHUB_TOKEN')]) {
                        script {
                            sh """
                                git config user.email "chieewhatt@gmail.com" 
                                git config user.name "watri"
                                currenttag=\$(yq .image.tag charts/demo/values-prod.yaml)
                                yq -i '.image.tag = "${IMAGETAG}"' charts/demo/values-prod.yaml
                                git add charts/demo/values-prod.yaml
                                git commit -m "Update image to version ${IMAGETAG}"
                                git push https://${GITHUB_TOKEN}@github.com/${GIT_USER_NAME}/${GIT_REPO_NAME} HEAD:master
                            
                            """  
                        }
                    }
                }
            }
        }
        stage('Wait The Deployment') {
            steps {
                sleep(time: 5, unit: 'MINUTES')
                sh 'kubectl rollout status deployment/demo-service -n prod --timeout=300s'
            }
        }
        stage('DAST Using OWASP ZAP') {
            steps {
                script {
                    def currentDate = sh(script: 'date +%Y%m%d%H%M%S', returnStdout: true).trim()
                    env.reportFileName = "OWASP_${currentDate}.html"

                    sh "docker exec owasp zap-baseline.py -t http://watri.site:30001 -r ${reportFileName} -I"
                }
            }
        }
        stage('Copy Report to Workspace') {
        steps {
            script {
                sh """
                docker cp owasp:/zap/wrk/${env.reportFileName} ${WORKSPACE}/${env.reportFileName}
                """
                }
            }
        }

        // ##### Stage for deploy using jenkins ###### 
        // stage('Deploy to Cluster') {
        //     steps {
        //         sh '''
        //         #!/bin/bash
        //         echo "Deploying to Docker destop Cluster"
        //         helm upgrade --install --wait --timeout=300s demo-service demo/demo --set=image.tag=$(git rev-parse --short HEAD)${BUILD_NUMBER} --namespace=prod --kube-context=docker-desktop -f deployment/values-prod.yaml
        //         '''
        //         // sed -i "s|latest|$(git rev-parse --short HEAD)${BUILD_NUMBER}|g" deployment/deployment.yaml 
        //         // kubectl config use-context docker-desktop && kubectl apply -f deployment/deployment.yaml 

        //         sh '''
        //         #!/bin/bash
        //         echo "Deployment Check Development"
        //         kubectl config use-context docker-desktop && kubectl rollout status deployment/demo-service -n prod --timeout=300s
        //         '''
        //     }
        // }
    }

    post {
        always {
            archiveArtifacts artifacts: 'result.html, OWASP_*.html, trufflehog_output.json', followSymlinks: false
        }
    }
}