[CI] issue: INFINIOPS-770 Update secret-scan container registry

.ci/Jenkinsfile

@@ -2,7 +2,7 @@
 
 // load pipeline functions
 // Requires pipeline-github-lib plugin to load library from github
-@Library('github.com/Mellanox/ci-demo@stable')
+@Library('github.com/Mellanox/ci-demo@stable_media')
 def matrix = new com.mellanox.cicd.Matrix()
 
 matrix.main()

.ci/antivirus.sh

@@ -0,0 +1,37 @@
+#!/bin/bash -uxe
+
+echo -e "\n\n**********************************"
+echo -e "\n\nStarting antivirus.sh script...\n\n"
+echo -e "**********************************\n\n"
+
+[[ -z "${WORKSPACE:-}" ]] && { echo "ERROR: WORKSPACE variable is empty"; exit 1; }
+[[ ! -d "${WORKSPACE}" ]] && { echo "ERROR: ${WORKSPACE} does not exist"; exit 1; }
+[[ -z "${release_folder:-}" ]] && { echo "ERROR: release_folder variable is empty"; exit 1; }
+[[ ! -d "${release_folder}" ]] && { echo "ERROR: ${release_folder} does not exist"; exit 1; }
+[[ -z "${release_tag:-}" ]] && { echo "ERROR: release_tag variable is empty"; exit 1; }
+
+if [ -z "${revision:-}" ]; then
+    echo "WARN: 'revision' was not set, defaulting to 1"
+    revision=1
+fi
+
+mkdir -p "${WORKSPACE}/logs/"
+
+release_src_folder="${release_folder}/vma_v_${release_tag}-0/src"
+pkg_name="libvma-${release_tag}-${revision}.src.rpm"
+tarball_name="libvma-${release_tag}.tar.gz"
+rpm_log="${WORKSPACE}/logs/${pkg_name}_antivirus.log"
+tarball_log="${WORKSPACE}/logs/${tarball_name}_antivirus.log"
+
+[[ ! -d "${release_src_folder}" ]] && { echo "ERROR: ${release_src_folder} does not exist."; exit 1; }
+[[ ! -e "${release_src_folder}/${pkg_name}" ]] && { echo "ERROR: ${release_src_folder}/${pkg_name} does not exist."; exit 1; }
+[[ ! -e "${release_src_folder}/${tarball_name}" ]] && { echo "ERROR: ${release_src_folder}/${tarball_name} does not exist."; exit 1; }
+
+/auto/GLIT/SCRIPTS/HELPERS/antivirus-scan.sh "${release_src_folder}/${pkg_name}" |& tee "${rpm_log}"
+/auto/GLIT/SCRIPTS/HELPERS/antivirus-scan.sh "${release_src_folder}/${tarball_name}" |& tee "${tarball_log}"
+
+if grep -q 'Possibly Infected:.............     0' "${rpm_log}" && grep -q 'Possibly Infected:.............     0' "${tarball_log}"; then
+    exit 0
+else
+    exit 1
+fi

.ci/blackduck_source.sh

@@ -0,0 +1,47 @@
+#!/bin/bash -Exel
+
+topdir=$(git rev-parse --show-toplevel)
+cd "$topdir"
+
+# Check if the variables and pipeline attributes are set
+[[ -z "${WORKSPACE}" ]] && { echo "Error: WORKSPACE variable is not set"; exit 1; }
+[[ -z "$BLACKDUCK_API_TOKEN" ]] && { echo "Error: BLACKDUCK_API_TOKEN variable is not set"; exit 1; }
+[[ ! -d "${WORKSPACE}/logs" ]] && mkdir -p "${WORKSPACE}/logs"
+
+# Create valid JSON for further authentication in BlackDuck server
+json=$(jq -n \
+  --arg token "$BLACKDUCK_API_TOKEN" \
+  '{"blackduck.url": "https://blackduck.mellanox.com/", "blackduck.api.token": $token }')
+
+export SPRING_APPLICATION_JSON="$json"
+export PROJECT_NAME=LibVMA
+export PROJECT_VERSION="$sha1"
+export PROJECT_SRC_PATH="$topdir"/
+echo "Running BlackDuck (SRC) on $name"
+echo "CONFIG:"
+echo "        NAME: ${PROJECT_NAME}"
+echo "     VERSION: ${PROJECT_VERSION}"
+echo "    SRC_PATH: ${PROJECT_SRC_PATH}"
+
+# clone BlackDuck
+[[ -d /tmp/blackduck ]] && rm -rf /tmp/blackduck
+sudo -u swx-jenkins git clone -c core.sshCommand="ssh -l svc-nbu-swx-media -i ~/.ssh/id_ed25519_svc-nbu-swx-media_gerrit" -b master --single-branch --depth=1 ssh://git-nbu.nvidia.com:12023/DevOps/Tools/blackduck /tmp/blackduck
+cd /tmp/blackduck
+
+# disable check errors
+set +e
+timeout 3600 ./run_bd_scan.sh signature
+exit_code=$?
+# enable back
+set -e
+
+# copy run log to a place that jenkins job will archive it
+REPORT_NAME="BlackDuck_source_${PROJECT_NAME}_${PROJECT_VERSION}"
+cat "log/${PROJECT_NAME}_${PROJECT_VERSION}"*.log > "${WORKSPACE}/logs/${REPORT_NAME}.log" || true
+cat "log/${PROJECT_NAME}_${PROJECT_VERSION}"*.log || true
+
+if [ "$exit_code" == "0" ]; then
+    cp -v /tmp/blackduck/report/*.pdf "${WORKSPACE}/logs/${REPORT_NAME}.pdf"
+fi
+
+exit $exit_code

.ci/do_release.sh

@@ -0,0 +1,92 @@
+#!/bin/bash -Exel
+
+echo "**********************************"
+echo "Starting do_release.sh script..."
+echo "**********************************"
+
+set -o pipefail
+
+print_help() {
+    set +xv
+    echo -e "\n\n"
+    echo "--------------------------------------------------"
+    echo "Usage: release_folder=<release folder> release_tag=<release tag> [revision=<revision>] [do_release=<true|false>] $0"
+    echo "       Where release folder is a path to NFS folder to copy the package into"
+    echo "       Where release tag is a git tag to release (must be already tagged in the git repo)"
+    echo "       Where revision is a number postfix to add the to package indicating which version of the tag it is - OPTIONAL, default value 1"
+    echo "       Where do_release is a boolean value indicating if the script will copy the created package into the release folder location - OPTIONAL, default value false"
+    exit 1
+}
+
+if [ -z "${release_folder}" ]; then
+    echo "ERROR: 'release_folder' was not set."
+    print_help
+fi
+
+if [ ! -e "${release_folder}" ] || [ ! -d "${release_folder}" ]; then
+    echo "ERROR: [${release_folder}] directory doesn't exist."
+    print_help
+fi
+
+if [ -z "${release_tag}" ]; then
+    echo "ERROR: 'release_tag' was not set."
+    print_help
+fi
+
+if [ -z "${revision}" ]; then
+    echo "WARN: 'revision' was not set, defaulting to 1"
+    revision=1
+fi
+
+if [ -z "${do_release}" ]; then
+    echo "WARN: 'do_release' was not set, defaulting to false (package will not be release)"
+    do_release=false
+fi
+
+MAJOR_VERSION=$(grep -e "define(\[prj_ver_major\]" configure.ac | awk '{ printf $2 };' | sed  's/)//g')
+MINOR_VERSION=$(grep -e "define(\[prj_ver_minor\]" configure.ac | awk '{ printf $2 };' | sed  's/)//g')
+REVISION_VERSION=$(grep -e "define(\[prj_ver_revision\]" configure.ac | awk '{ printf $2 };' | sed  's/)//g')
+configure_ac_version="${MAJOR_VERSION}.${MINOR_VERSION}.${REVISION_VERSION}"
+pkg_folder=pkg/packages
+pkg_name="libvma-${release_tag}-${revision}.src.rpm"
+tarball_name="libvma-${release_tag}.tar.gz"
+DST_DIR=${release_folder}/vma_v_${release_tag}-0/src
+echo "FULL_VERSION from configure.ac: [${configure_ac_version}]"
+
+# Creating both tarball and src.rpm
+env PRJ_RELEASE="${revision}" contrib/build_pkg.sh -s -t
+
+if [[ "${release_tag}" != "${configure_ac_version}" ]]; then
+    echo "ERROR: FULL_VERSION: ${configure_ac_version} from configure.ac doesn't match tag: ${release_tag} provided! Exit"
+    exit 1
+fi
+
+if [ "${do_release}" = true ] ; then
+    echo "do_release is set to true, will release package into ${DST_DIR}"
+
+    if [ ! -d "${pkg_folder}" ]; then
+        echo "ERROR: [${pkg_folder}] directory doesn't exist. Exit"
+        exit 1
+    fi
+
+    if [[ -e "${DST_DIR}/${pkg_name}" || -e "${DST_DIR}/${tarball_name}" ]]; then
+        echo "ERROR: [${DST_DIR}/${pkg_name}] or [${DST_DIR}/${tarball_name}] file already exist. Exit"
+        exit 1
+    fi
+    files_dir=$(pwd)
+    pushd "${release_folder}" || { echo "ERROR: Failed to pushd to ${release_folder}. Exit" ; exit 1; }
+    mkdir -p "$DST_DIR"
+    cp -v "${files_dir}/${pkg_folder}/${pkg_name}" "$DST_DIR"
+    cp -v "${files_dir}/${pkg_folder}/${tarball_name}" "$DST_DIR"
+    ln -s "${DST_DIR}/${pkg_name}" "${release_folder}/source_rpms/${pkg_name}"
+    popd || { echo "ERROR: Failed to popd from ${release_folder}. Exit" ; exit 1; }
+
+    echo "INFO: Release found at $DST_DIR"
+else
+     echo "INFO: do_release is set to false, skipping package release."
+fi
+
+set +x
+echo "**********************************"
+echo "Finished do_release.sh script..."
+echo "**********************************"

.ci/dockerfiles/Dockerfile.fedora-rawhide

@@ -0,0 +1,9 @@
+FROM docker.io/library/fedora:rawhide
+
+RUN dnf install --allowerasing -y procps-ng \
+    bsdtar git-core autoconf automake \
+    libtool gcc gcc-c++ make pkgconf-pkg-config \
+    rdma-core-devel libnl3-devel gzip\
+ && ln -sf /usr/bin/bsdtar /usr/local/bin/tar \
+ && dnf clean all \
+ && rm -rf /var/cache/dnf

.ci/dockerfiles/Dockerfile.rhel8.6

@@ -0,0 +1,34 @@
+ARG HARBOR_URL=nbu-harbor.gtm.nvidia.com
+ARG ARCH=x86_64
+FROM $HARBOR_URL/hpcx/x86_64/rhel8.6/core:latest as core
+ARG WEBREPO_URL=webrepo.gtm.nvidia.com
+
+RUN sed -i "s/webrepo/${WEBREPO_URL}/" /etc/yum.repos.d/* && \
+    sed -i 's/mirrorlist/#mirrorlist/;s!#baseurl=http://mirror.centos.org!baseurl=http://vault.centos.org!' /etc/yum.repos.d/* && \
+    echo "[mlnx-opt]" > /etc/yum.repos.d/mlnx-opt.repo && \
+    echo "name=RHEL 8.6 mirror" >> /etc/yum.repos.d/mlnx-opt.repo && \
+    echo "baseurl=http://${WEBREPO_URL}/RH/optional/8.6/x86_64/" >> /etc/yum.repos.d/mlnx-opt.repo && \
+    echo "enabled=1" >> /etc/yum.repos.d/mlnx-opt.repo && \
+    echo "gpgcheck=0" >> /etc/yum.repos.d/mlnx-opt.repo && \
+    yum makecache
+
+RUN yum install --allowerasing -y \
+    java-11-openjdk jq git && \
+    yum clean all && \
+    rm -rf /var/cache/yum
+
+FROM core as bduck
+ARG _UID=6213
+ARG _GID=101
+ARG _LOGIN=swx-jenkins
+ARG _HOME=/var/home/$_LOGIN
+RUN echo "${_LOGIN} ALL=(ALL) NOPASSWD: ALL" >> /etc/sudoers && \
+    echo "root ALL=(ALL) NOPASSWD: ALL" >> /etc/sudoers && \
+    mkdir -p ${_HOME} && \
+    groupadd -f -g "$_GID" "$_LOGIN" && \
+    useradd -u "$_UID" -g "$_GID" -s /bin/bash -m -d ${_HOME} "${_LOGIN}" && \
+    chown -R ${_LOGIN} ${_HOME} && \
+    yum install --allowerasing -y \
+    jq git java-11-openjdk sudo && \
+    yum clean all && \
+    rm -rf /var/cache/yum

.ci/dockerfiles/Dockerfile.rhel8.6.release

@@ -0,0 +1,29 @@
+ARG HARBOR_URL=nbu-harbor.gtm.nvidia.com
+FROM $HARBOR_URL/hpcx/x86_64/rhel8.6/core:latest
+ARG WEBREPO_URL=webrepo.gtm.nvidia.com
+ARG _UID=6213
+ARG _GID=101
+ARG _LOGIN=swx-jenkins
+ARG _HOME=/var/home/$_LOGIN
+
+RUN sed -i "s#http://webrepo#http://${WEBREPO_URL}#" /etc/yum.repos.d/* && \
+    sed -i 's/mirrorlist/#mirrorlist/;s!#baseurl=http://mirror.centos.org!baseurl=http://vault.centos.org!' /etc/yum.repos.d/* && \
+    echo "[mlnx-opt]" > /etc/yum.repos.d/mlnx-opt.repo && \
+    echo "name=RHEL 8.6 mirror" >> /etc/yum.repos.d/mlnx-opt.repo && \
+    echo "baseurl=http://${WEBREPO_URL}/RH/optional/8.6/x86_64/" >> /etc/yum.repos.d/mlnx-opt.repo && \
+    echo "enabled=1" >> /etc/yum.repos.d/mlnx-opt.repo && \
+    echo "gpgcheck=0" >> /etc/yum.repos.d/mlnx-opt.repo && \
+    yum makecache
+
+RUN echo "${_LOGIN} ALL=(ALL) NOPASSWD: ALL" >> /etc/sudoers && \
+    echo "root ALL=(ALL) NOPASSWD: ALL" >> /etc/sudoers && \
+    mkdir -p ${_HOME} && \
+    groupadd -f -g "$_GID" "$_LOGIN" && \
+    useradd -u "$_UID" -g "$_GID" -s /bin/bash -m -d ${_HOME} "${_LOGIN}" && \
+    chown -R ${_LOGIN} ${_HOME}
+
+RUN yum install --allowerasing -y \
+    git autoconf automake libtool gcc \
+    sudo gcc-c++ libibverbs-devel rdma-core \
+    librdmacm unzip patch wget make \
+    libnl3-devel rpm-build

.ci/dockerfiles/Dockerfile.rhel9.4

@@ -0,0 +1,37 @@
+ARG HARBOR_URL=nbu-harbor.gtm.nvidia.com
+ARG ARCH=x86_64
+FROM $HARBOR_URL/swx-infra/media/$ARCH/base/rhel:9.4
+ARG WEBREPO_URL=webrepo.gtm.nvidia.com
+ARG ARCH
+ARG _UID=6213
+ARG _GID=101
+ARG _LOGIN=swx-jenkins
+ARG _HOME=/var/home/$_LOGIN
+
+RUN sed -i "s#http://webrepo#http://${WEBREPO_URL}#" /etc/yum.repos.d/* && \
+    sed -i 's/mirrorlist/#mirrorlist/;s!#baseurl=http://mirror.centos.org!baseurl=http://vault.centos.org!' /etc/yum.repos.d/* && \
+    echo "[mlnx-9.4-BaseOS]" > /etc/yum.repos.d/mlnx-9.4-BaseOS.repo && \
+    echo "name=RHEL 9.4 mirror BaseOS" >> /etc/yum.repos.d/mlnx-9.4-BaseOS.repo && \
+    echo "baseurl=http://${WEBREPO_URL}/RH/9.4/$ARCH/BaseOS/" >> /etc/yum.repos.d/mlnx-9.4-BaseOS.repo && \
+    echo "enabled=1" >> /etc/yum.repos.d/mlnx-9.4-BaseOS.repo && \
+    echo "gpgcheck=0" >> /etc/yum.repos.d/mlnx-9.4-BaseOS.repo && \
+    echo "[mlnx-9.4-AppStream]" > /etc/yum.repos.d/mlnx-9.4-AppStream.repo && \
+    echo "name=RHEL 9.4 mirror AppStream" >> /etc/yum.repos.d/mlnx-9.4-AppStream.repo && \
+    echo "baseurl=http://${WEBREPO_URL}/RH/9.4/$ARCH/AppStream/" >> /etc/yum.repos.d/mlnx-9.4-AppStream.repo && \
+    echo "enabled=1" >> /etc/yum.repos.d/mlnx-9.4-AppStream.repo && \
+    echo "gpgcheck=0" >> /etc/yum.repos.d/mlnx-9.4-AppStream.repo && \
+    yum makecache
+
+RUN echo "${_LOGIN} ALL=(ALL) NOPASSWD: ALL" >> /etc/sudoers && \
+    echo "root ALL=(ALL) NOPASSWD: ALL" >> /etc/sudoers && \
+    mkdir -p ${_HOME} && \
+    groupadd -f -g "$_GID" "$_LOGIN" && \
+    useradd -u "$_UID" -g "$_GID" -s /bin/bash -m -d ${_HOME} "${_LOGIN}" && \
+    chown -R ${_LOGIN} ${_HOME}
+
+RUN dnf install --allowerasing -y \
+    git autoconf automake libtool gcc \
+    sudo gcc-c++ libibverbs-devel rdma-core \
+    librdmacm unzip patch wget make \
+    libnl3-devel rpm-build && \
+    dnf clean all && rm -rf /var/cache/dnf/*

.ci/dockerfiles/Dockerfile.rhel9.6

@@ -0,0 +1,21 @@
+ARG HARBOR_URL=nbu-harbor.gtm.nvidia.com
+ARG ARCH=x86_64
+ARG OS_VERSION=9.6
+
+FROM $HARBOR_URL/swx-infra/media/$ARCH/base/rhel:$OS_VERSION
+ARG _UID=6213
+ARG _GID=101
+ARG _LOGIN=swx-jenkins
+ARG _HOME=/var/home/$_LOGIN
+RUN echo "${_LOGIN} ALL=(ALL) NOPASSWD: ALL" >> /etc/sudoers && \
+    echo "root ALL=(ALL) NOPASSWD: ALL" >> /etc/sudoers && \
+    mkdir -p ${_HOME} && \
+    groupadd -f -g "$_GID" "$_LOGIN" && \
+    useradd -u "$_UID" -g "$_GID" -s /bin/bash -m -d ${_HOME} "${_LOGIN}" && \
+    chown -R ${_LOGIN} ${_HOME}
+
+RUN dnf install --allowerasing -y json-c-devel curl \
+    autoconf automake make libtool \
+    gcc-c++ diffutils rpm-build \
+ && dnf clean all \
+ && rm -rf /var/cache/dnf

.ci/fedora_matrix_job.yaml

@@ -0,0 +1,37 @@
+---
+job: LIBVMA
+
+timeout_minutes: 30
+
+registry_host: nbu-harbor.gtm.nvidia.com
+registry_auth: swx-infra_harbor_credentials
+registry_path: /swx-infra/media
+
+kubernetes:
+  privileged: true
+  cloud: il-ipp-blossom-prod
+  namespace: swx-media
+  nodeSelector: 'beta.kubernetes.io/os=linux'
+  limits: '{memory: 8Gi, cpu: 8000m}'
+  requests: '{memory: 8Gi, cpu: 8000m}'
+  arch_table:
+    x86_64:
+      nodeSelector: 'kubernetes.io/arch=amd64'
+      jnlpImage: '${registry_host}/toolbox/c3po-jnlp:latest'
+
+runs_on_dockers:
+  - {name: 'fedora-rawhide', file: '.ci/dockerfiles/Dockerfile.fedora-rawhide', uri: 'vma/$arch/$name', arch: 'x86_64', tag: '20260420', build_args: '--no-cache --pull'}
+
+matrix:
+  axes:
+    flags:
+      - default
+
+steps:
+  - name: Build
+    run: |
+      env WORKSPACE=$PWD TARGET=${flags} jenkins_test_build=yes ./contrib/test_jenkins.sh
+    onfail: |
+      ./.ci/artifacts.sh
+    archiveArtifacts-onfail: |
+      jenkins/**/arch-*.tar.gz