Jenkinsfile

/**
 * Copyright (C) 2006-2026 Talend Inc. - www.talend.com
 *
 * Licensed under the Apache License, Version 2.0 (the "License");
 * you may not use this file except in compliance with the License.
 * You may obtain a copy of the License at
 *
 * http://www.apache.org/licenses/LICENSE-2.0
 *
 * Unless required by applicable law or agreed to in writing, software
 * distributed under the License is distributed on an "AS IS" BASIS,
 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 * See the License for the specific language governing permissions and
 * limitations under the License.
 */
// Imports
import java.time.LocalDateTime
import java.util.regex.Matcher

// Credentials
final def ossrhCredentials = usernamePassword(
    credentialsId: 'ossrh-credentials',
    usernameVariable: 'OSSRH_USER',
    passwordVariable: 'OSSRH_PASS')
final def nexusCredentials = usernamePassword(
    credentialsId: 'nexus-artifact-zl-credentials',
    usernameVariable: 'NEXUS_USER', passwordVariable: 'NEXUS_PASS')
final def jetbrainsCredentials = usernamePassword(
    credentialsId: 'jetbrains-credentials',
    usernameVariable: 'JETBRAINS_USER',
    passwordVariable: 'JETBRAINS_PASS')
final def jiraCredentials = usernamePassword(
    credentialsId: 'jira-credentials',
    usernameVariable: 'JIRA_USER',
    passwordVariable: 'JIRA_PASS')
final def gitCredentials = usernamePassword(
    credentialsId: 'github-credentials',
    usernameVariable: 'GITHUB_LOGIN',
    passwordVariable: 'GITHUB_TOKEN')
final def dockerCredentials = usernamePassword(
    credentialsId: 'artifactory-datapwn-credentials',
    usernameVariable: 'DOCKER_USER',
    passwordVariable: 'DOCKER_PASS')
final def sonarToken = string(
    credentialsId: 'sonar-credentials-token',
    variable: 'SONAR_TOKEN')
final def keyImportCredentials = usernamePassword(
    credentialsId: 'component-runtime-import-key-credentials',
    usernameVariable: 'KEY_USER',
    passwordVariable: 'KEY_PASS')
final def gpgCredentials = usernamePassword(
    credentialsId: 'component-runtime-gpg-credentials',
    usernameVariable: 'GPG_KEYNAME',
    passwordVariable: 'GPG_PASSPHRASE')

final String repository = 'component-runtime'

// In PR environment, the branch name is not valid and should be swap with pr name.
final String pull_request_id = env.CHANGE_ID
final String branch_name = pull_request_id != null ? env.CHANGE_BRANCH : env.BRANCH_NAME

// Job config
final Boolean isMasterBranch = branch_name == "master"
final Boolean isStdBranch = (branch_name == "master" || branch_name.startsWith("maintenance/"))
final String extraBuildParams = ""
final String buildTimestamp = String.format('-%tY%<tm%<td%<tH%<tM%<tS', LocalDateTime.now())
final String artifactoryAddr = "https://artifactory.datapwn.com"
final String artifactoryPath = "tlnd-docker-dev/talend/common/tacokit"

// Job variables declaration
String branch_user
String branch_ticket
String branch_description
String pomVersion
String finalVersion
Boolean needQualify
Boolean stdBranch_buildOnly = false
Boolean devBranch_mavenDeploy = false
Boolean devBranch_dockerPush = false


String skipOptions = "-Dspotless.apply.skip=true -Dcheckstyle.skip=true -Drat.skip=true -DskipTests -Dinvoker.skip=true"
String deployOptions = "$skipOptions -Possrh -Prelease -Pgpg2 -Denforcer.skip=true"
String nexusDeployOptions = "$skipOptions --activate-profiles private_repository -Denforcer.skip=true"


pipeline {
  libraries {
    lib("connectors-lib@1.2.0") // https://github.com/Talend/tdi-jenkins-shared-libraries
    lib("tqa-e2e-tests-tool@2.6.13-ttp2")  // https://github.com/Talend/tqa-e2e-testing-tool
  }
  agent {
    kubernetes {
      yamlFile '.jenkins/jenkins_pod.yml'
      defaultContainer 'main'
    }
  }

  environment {
    MAVEN_OPTS = "-Dformatter.skip=true -Dmaven.artifact.threads=256"
    BUILD_ARGS = "-Dgpg.skip=true -Denforcer.skip=true"
    ARTIFACTORY_REGISTRY = "artifactory.datapwn.com"
    VERACODE_APP_NAME = 'Talend Component Kit'
    VERACODE_SANDBOX = 'component-runtime'
    APP_ID = '579232'
  }

  options {
    buildDiscarder(logRotator(artifactNumToKeepStr: '10', numToKeepStr: branch_name == 'master' ? '15' : '10'))
    timeout(time: 180, unit: 'MINUTES')
    skipStagesAfterUnstable()
  }

  triggers {
    cron(branch_name == "master" ? "0 0 * * *" : "")
  }

  parameters {
    ///////////////////////////////////////////////////////////////////////////////////////////////////////////////
    separator(name: "BASIC_CONFIG", sectionHeader: "Basic configuration",
              sectionHeaderStyle: """ background-color: #ABEBC6;
                text-align: center; font-size: 35px !important; font-weight : bold; """)
    ///////////////////////////////////////////////////////////////////////////////////////////////////////////////
    choice(
        name: 'ACTION',
        choices: ['STANDARD', 'RELEASE'],
        description: 'Kind of running:\nSTANDARD: (default) classical CI\nRELEASE: Build release')

    booleanParam(
        name: 'FORCE_DOC',
        defaultValue: false,
        description: 'Force documentation stage for development branches. No effect on master and maintenance.')

    string(name: 'JAVA_VERSION',
           defaultValue: 'from .tool-versions',
           description: """Provided java version will be installed with asdf  
                        Examples: adoptopenjdk-11.0.22+7, adoptopenjdk-17.0.11+9 """)

    string(name: 'MAVEN_VERSION',
           defaultValue: 'from .tool-versions',
           description: """Provided maven version will be installed with asdf  
                        Examples: 3.8.8, 3.9.9, 4.0.0-beta-4
                        """)

    ///////////////////////////////////////////////////////////////////////////////////////////////////////////////
    separator(name: "DEPLOY_CONFIG", sectionHeader: "Deployment configuration",
              sectionHeaderStyle: """ background-color: #F9E79F;
                text-align: center; font-size: 35px !important; font-weight : bold; """)
    ///////////////////////////////////////////////////////////////////////////////////////////////////////////////
    booleanParam(
        name: 'MAVEN_DEPLOY',
        defaultValue: false,
        description: '''
            Force MAVEN deploy stage for development branches. No effect on master and maintenance.
            INFO: master/maintenance branch deploys artefacts on <oss.sonatype.org>
                  dev branches deploy artefacts on <artifacts-zl.talend.com>''')
    booleanParam(
        name: 'DOCKER_PUSH',
        defaultValue: false,
        description: '''
            Force DOCKER push stage for development branches. No effect on master and maintenance.
            INFO: master/maintenance and dev branches deploy artefacts on <artifactory.datapwn.com>''')
    choice(
        name: 'DOCKER_CHOICE',
        choices: ['component-server',
                  'component-starter-server',
                  'remote-engine-customizer',
                  'All'],
        description: 'Choose which Docker image you want to build and push. Only available if DOCKER_PUSH == True.')

    ///////////////////////////////////////////////////////////////////////////////////////////////////////////////
    separator(name: "QUALIFIER_CONFIG",
              sectionHeader: "Qualifier configuration",
              sectionHeaderStyle: """ background-color: #AED6F1;
                text-align: center; font-size: 35px !important; font-weight : bold;
			          """)
    ///////////////////////////////////////////////////////////////////////////////////////////////////////////////
    string(
        name: 'VERSION_QUALIFIER',
        defaultValue: 'DEFAULT',
        description: '''
            Deploy jars with the given version qualifier. No effect on master and maintenance.
             - DEFAULT means the qualifier will be the Jira id extracted from the branch name.
               From "user/JIRA-12345_some_information" the qualifier will be JIRA-12345.
            If you want to deploy a snapshot version without qualifier, use the NO_QUALIFIER parameter below
            ''')

    ///////////////////////////////////////////////////////////////////////////////////////////////////////////////
    separator(name: "ADVANCED_CONFIG",
              sectionHeader: "Advanced configuration",
              sectionHeaderStyle: """ background-color: #F8C471;
                text-align: center; font-size: 35px !important; font-weight : bold;
			          """)
    ///////////////////////////////////////////////////////////////////////////////////////////////////////////////
    string(
        name: 'EXTRA_BUILD_PARAMS',
        defaultValue: '',
        description: 'Add some extra parameters to all maven commands.')
    booleanParam(
        name: 'DISABLE_SONAR',
        defaultValue: false,
        description: 'Cancel the Sonar analysis stage execution')
    booleanParam(
        name: 'FORCE_SECURITY_ANALYSIS',
        defaultValue: false,
        description: 'Force OSS security analysis stage for branches.')
    booleanParam(
        name: 'FORCE_DEPS_REPORT',
        defaultValue: false,
        description: 'Force dependencies report stage for branches.')

    ///////////////////////////////////////////////////////////////////////////////////////////////////////////////
    separator(name: "EXPERT_CONFIG",
              sectionHeader: "Expert configuration",
              sectionHeaderStyle: """ background-color: #A9A9A9;
                text-align: center; font-size: 35px !important; font-weight : bold;
			          """)
    ///////////////////////////////////////////////////////////////////////////////////////////////////////////////
    booleanParam(
        name: 'TRIVY_SCAN',
        defaultValue: !isStdBranch,
        description: '''
            This is for trivy scan, by default this checkbox is false on master or maintenance branch.
            It will generate the trivy report on Jenkins, the report name is `CVE Trivy Vulnerability Report`
            ''')
    string(
        name: 'PACKAGE_FILTER_NAME',
        defaultValue: "",
        description: '''
            This input box is used to filter the results of the `mvn dependency:tree` command.
            This input box only works when TRIVY_SCAN checkbox is true.
            By entering the package name, you can find out which components are affected and thus the scope of the test.
            For example: org.eclipse.jetty:jetty-http, org.apache.avro:avro, org.apache.geronimo ...''')
    ///////////////////////////////////////////////////////////////////////////////////////////////////////////////
    separator(name: "DEBUG_CONFIG",
              sectionHeader: "Jenkins job debug configuration ",
              sectionHeaderStyle: """ background-color: #FF0000;
                text-align: center; font-size: 35px !important; font-weight : bold;
			          """)
    ///////////////////////////////////////////////////////////////////////////////////////////////////////////////
    booleanParam(
        name: 'JENKINS_DEBUG',
        defaultValue: false,
        description: 'Add an extra step to the pipeline to keep the pod alive for debug purposes.')
    booleanParam(
        name: 'NO_QUALIFIER',
        defaultValue: false,
        description: '''
            DEBUG ONLY - do not use on a branch that others rely on.
            Skips the version qualifier and overwrites the branch name mechanism to run as if this were master branch,
            so you can test Jenkins pipeline changes (e.g. the Maven deploy stages) end to end from a dev branch.
            WARNING: the resulting artifact uses the exact same (unqualified) SNAPSHOT
            version as master. If this build deploys, it WILL OVERWRITE the artifacts
            currently published by the master branch build on both the internal Nexus
            and Sonatype/OSSRH repositories. If you do it, be sure that your branch is up to date with master.
            Only to test Jenkins job evolution, never for real development work.''')
    booleanParam(
        name: 'NO_SONATYPE',
        defaultValue: false,
        description: '''
            DEBUG ONLY - skips the Sonatype/OSSRH deploy stage entirely, whatever the branch.
            Use this to test the pipeline faster when the slow/unreliable Sonatype deploy
            is not what you want to validate (e.g. only testing the internal Nexus deploy stage).''')
  }

  stages {
    stage('Preliminary steps') {
      steps {

        ///////////////////////////////////////////
        // Login tasks
        ///////////////////////////////////////////
        script {
          withCredentials([gitCredentials]) {
            GitController.gitLogin()
          }
          withCredentials([dockerCredentials]) {
            sh """ bash .jenkins/scripts/docker_login.sh "${ARTIFACTORY_REGISTRY}" "\${DOCKER_USER}" "\${DOCKER_PASS}" """
          }
          withCredentials([keyImportCredentials]) {
            sh """ bash .jenkins/scripts/setup_gpg.sh """
          }
        }

        ///////////////////////////////////////////
        // edit mvn and java version
        ///////////////////////////////////////////
        script {
          String javaVersion = JenkinsPodConfig.asdfSetVersion("$env.WORKSPACE/.tool-versions", 'java', params.JAVA_VERSION)
          String mavenVersion = JenkinsPodConfig.asdfSetVersion("$env.WORKSPACE/.tool-versions", 'maven', params.MAVEN_VERSION)
          JenkinsStatusController.jobDescriptionAppend("Use java $javaVersion with maven  $mavenVersion  ")
          JenkinsPodConfig.asdfInstall()
        }

        ///////////////////////////////////////////
        // Variables init
        ///////////////////////////////////////////
        script {
          stdBranch_buildOnly = (isStdBranch || params.NO_QUALIFIER) && params.ACTION != 'RELEASE'
          devBranch_mavenDeploy = !isStdBranch && params.MAVEN_DEPLOY
          devBranch_dockerPush = !isStdBranch && params.DOCKER_PUSH

          // NO_QUALIFIER forces the same (unqualified) version as master, see param warning
          needQualify = (devBranch_mavenDeploy || devBranch_dockerPush) && !params.NO_QUALIFIER

          if (needQualify) {
            // Qualified version have to be released on talend_repository
            // Overwrite the deployOptions
            deployOptions = nexusDeployOptions
          }

          // hack to overwrite the skip of studio modules that we can't deploy in release mode into Sonatype repo
          // assume that we don't use this Jenkinsfile for release anymore
          deployOptions = deployOptions.replace("-Prelease", "-Psnapshot")

          // By default the doc is skipped for standards branches
          Boolean skip_documentation = !(params.FORCE_DOC || isStdBranch)
          extraBuildParams = assemblyExtraBuildParams(skip_documentation)

        }
        ///////////////////////////////////////////
        // Pom version and Qualifier management
        ///////////////////////////////////////////
        script {
          final def pom = readMavenPom file: 'pom.xml'
          pomVersion = pom.version

          echo 'Manage the version qualifier'
          if (!needQualify) {
            println """
              No need to add qualifier in followings cases:
              - We are on Master or Maintenance branch
              - We do not want to deploy on dev branch
              """.stripIndent()
            finalVersion = pomVersion
          } else {
            branch_user = ""
            branch_ticket = ""
            branch_description = ""
            if (params.VERSION_QUALIFIER != ("DEFAULT")) {
              // If the qualifier is given, use it
              println """No need to add qualifier, use the given one: "$params.VERSION_QUALIFIER" """
            } else {
              println "Validate the branch name"

              (branch_user,
              branch_ticket,
              branch_description) = extract_branch_info(branch_name)

              // Check only branch_user, because if there is an error all three params are empty.
              if (branch_user == ("")) {
                println """
                  ERROR: The branch name doesn't comply with the format: user/JIRA-1234-Description
                  It is MANDATORY for artifact management.
                  You have few options:
                  - You do not need to deploy, uncheck MAVEN_DEPLOY checkbox
                  - Change the VERSION_QUALIFIER text box to a personal qualifier, BUT you need to do it on ALL se/ee and cloud-components build
                  - Rename your branch
                  """.stripIndent()
                currentBuild.description = ("ERROR: The branch name is not correct")
                sh """exit 1"""
              }
            }

            echo "Insert a qualifier in pom version..."
            finalVersion = add_qualifier_to_version(
                pomVersion,
                branch_ticket,
                "$params.VERSION_QUALIFIER" as String)

            echo """
                          Configure the version qualifier for the curent branche: $branch_name  
                          requested qualifier: $params.VERSION_QUALIFIER  
                          with User = $branch_user, Ticket = $branch_ticket, Description = $branch_description  
                          Qualified Version = $finalVersion  """

            // On development branches the connectors version shall be edited for deployment
            // Maven documentation about maven_version:
            // https://docs.oracle.com/middleware/1212/core/MAVEN/maven_version.htm
            println "Edit version on dev branches, new version is ${finalVersion}"
            sh """\
                        #!/usr/bin/env bash
                        mvn versions:set --define newVersion=${finalVersion}
                        """.stripIndent()
          }

        }
        ///////////////////////////////////////////
        // Updating build displayName and description
        ///////////////////////////////////////////
        script {
          String deploy_info = ''
          if (stdBranch_buildOnly || devBranch_mavenDeploy) {
            deploy_info = deploy_info + '+DEPLOY'
          }
          if (devBranch_dockerPush) {
            deploy_info = deploy_info + '+DOCKER'
          }

          JenkinsStatusController.jobNameCreation("$params.ACTION" + deploy_info)

          // updating build description
          String description = """
                      Version = $finalVersion - $params.ACTION Build
                      Disable Sonar: $params.DISABLE_SONAR  
                      Debug: $params.JENKINS_DEBUG  
                      Extra build args: $extraBuildParams  """.stripIndent()
          JenkinsStatusController.jobDescriptionAppend(description)
          if (params.NO_QUALIFIER) {
            JenkinsStatusController.jobDescriptionAppend("⚠️ NO_QUALIFIER debug mode: unqualified version, deploy stages forced as on master/maintenance  ")
          }
        }
      }
      post {
        always {
          println "Artifact Poms files for analysis if needed"
          archiveArtifacts artifacts: '**/*pom.*', allowEmptyArchive: false, onlyIfSuccessful: false
        }
      }
    }
    stage('Post login') {
      steps {
        withCredentials([gitCredentials,
                         dockerCredentials,
                         ossrhCredentials,
                         jetbrainsCredentials,
                         jiraCredentials,
                         gpgCredentials]) {
          script {
            sh """\
              #!/usr/bin/env bash
              bash .jenkins/scripts/npm_fix.sh
              """.stripIndent()

            // If needed, use jenkins replay function then uncomment this to add your temporary bash command
            // This replace the POST_LOGIN_SCRIPT variable used prior to https://qlik-dev.atlassian.net/browse/QTDI-740
            // sh """\
            //  #!/usr/bin/env bash
            //  bash but anything needed here
            //  """.stripIndent()
          }
        }
      }
    }
    stage('Maven validate to install') {
      when { expression { params.ACTION != 'RELEASE' } }
      steps {
        withCredentials([ossrhCredentials,
                         nexusCredentials]) {
          sh """\
            #!/usr/bin/env bash
            set -xe
            mvn clean install $BUILD_ARGS \
                              $extraBuildParams \
                              --settings .jenkins/settings.xml
            """.stripIndent()
        }
      }
      post {
        always {
          recordIssues(
              enabledForFailure: false,
              tools: [
                  junitParser(
                      id: 'unit-test',
                      name: 'Unit Test',
                      pattern: '**/target/surefire-reports/*.xml'
                  )
              ]
          )
        }
      }
    }
    stage('Maven deploy - Nexus') {
      // Deploy to internal Nexus first on master/maintenance builds so that
      // connectors-se Jenkins agents (which cannot reach central.sonatype.com)
      // can resolve SNAPSHOT dependencies as soon as possible, independent of
      // whether the Sonatype deploy stage below is slow or times out.
      when {
        expression { stdBranch_buildOnly }
      }
      steps {
        withCredentials([nexusCredentials]) {
          sh """\
            #!/usr/bin/env bash
            set -xe
            mvn deploy ${nexusDeployOptions} \
                        ${extraBuildParams} \
                        --settings .jenkins/settings.xml
            """.stripIndent()
        }
      }
    }
    stage('Maven deploy - Sonatype') {
      // Sonatype/OSSRH deploy has a history of being slow/unreliable and can
      // otherwise consume the whole pipeline timeout; bound it to its own
      // timeout and degrade to UNSTABLE instead of failing the build outright
      // (the Nexus deploy stage above already unblocks downstream consumers).
      when {
        allOf {
          expression { !params.NO_SONATYPE }
          anyOf {
            expression { stdBranch_buildOnly }
            expression { devBranch_mavenDeploy }
          }
        }
      }
      steps {
        script {
          catchError(buildResult: 'SUCCESS', stageResult: 'UNSTABLE') {
            timeout(time: 60, unit: 'MINUTES') {
              withCredentials([ossrhCredentials,
                               gpgCredentials,
                               nexusCredentials]) {
                sh """\
                  #!/usr/bin/env bash
                  set -xe
                  bash mvn deploy $deployOptions \
                                  $extraBuildParams \
                                  --settings .jenkins/settings.xml
                  """.stripIndent()
              }
            }
          }
        }
        // Add description to job
        script {
          def repo
          String nexusSnapshotUrl = 'https://artifacts-zl.talend.com/nexus/content/repositories/snapshots/org/talend/sdk/component'
          if (devBranch_mavenDeploy) {
            repo = ['artifacts-zl.talend.com', nexusSnapshotUrl]
          } else {
            repo = ['oss.sonatype.org',
                    'https://central.sonatype.com/repository/maven-snapshots/org/talend/sdk/component/']
          }

          JenkinsStatusController.jobDescriptionAppend("Maven artefact deployed as ${finalVersion} on [${repo[0]}](${repo[1]})  ")
          if (stdBranch_buildOnly) {
            JenkinsStatusController.jobDescriptionAppend("Maven artefact also deployed as ${finalVersion} on [artifacts-zl.talend.com](${nexusSnapshotUrl})  ")
          }
        }
      }
    }
    stage('Docker build/push') {
      when {
        anyOf {
          expression { stdBranch_buildOnly }
          expression { devBranch_dockerPush }
        }
      }
      steps {
        script {
          configFileProvider([configFile(fileId: 'maven-settings-nexus-zl', variable: 'MAVEN_SETTINGS')]) {

            String images_options = ''
            if (isStdBranch) {
              // Build and push all images
              JenkinsStatusController.jobDescriptionAppend("Docker images deployed: component-server, component-starter-server and remote-engine-customizer  ")
            } else {
              String image_list
              if (params.DOCKER_CHOICE == 'All') {
                images_options = 'false'
              } else {
                images_options = 'false ' + params.DOCKER_CHOICE
              }

              if (params.DOCKER_CHOICE == 'All') {
                JenkinsStatusController.jobDescriptionAppend("All docker images deployed  ")

                JenkinsStatusController.jobDescriptionAppend("As ${finalVersion}${buildTimestamp} on " +
                                                                 "[artifactory.datapwn.com]" +
                                                                 "($artifactoryAddr/$artifactoryPath)  ")
                JenkinsStatusController.jobDescriptionAppend("docker pull $artifactoryAddr/$artifactoryPath" +
                                                                 "/component-server:${finalVersion}${buildTimestamp}  ")
                JenkinsStatusController.jobDescriptionAppend("docker pull $artifactoryAddr/$artifactoryPath" +
                                                                 "/component-starter-server:${finalVersion}${buildTimestamp}  ")
                JenkinsStatusController.jobDescriptionAppend("docker pull $artifactoryAddr/$artifactoryPath" +
                                                                 "/remote-engine-customize:${finalVersion}${buildTimestamp}  ")

              } else {
                JenkinsStatusController.jobDescriptionAppend("Docker images deployed: $params.DOCKER_CHOICE  ")
                JenkinsStatusController.jobDescriptionAppend("As ${finalVersion}${buildTimestamp} on " +
                                                                 "[artifactory.datapwn.com]($artifactoryAddr/$artifactoryPath)  ")
                JenkinsStatusController.jobDescriptionAppend("docker pull $artifactoryAddr/$artifactoryPath/$params.DOCKER_CHOICE:" +
                                                                 "${finalVersion}${buildTimestamp}  ")

              }

            }

            // Build and push specific image
            sh """
                bash .jenkins/scripts/docker_build.sh \
                  ${finalVersion}${buildTimestamp} \
                  ${images_options}
              """
          }

        }
      }
    }
    stage('Documentation') {
      when {
        expression {
          params.FORCE_DOC || (params.ACTION != 'RELEASE' && isMasterBranch)
        }
      }
      steps {
        withCredentials([ossrhCredentials, gitCredentials]) {
          sh """\
            #!/usr/bin/env bash 
            set -xe                       
            mvn verify pre-site --file documentation/pom.xml \
                                --settings .jenkins/settings.xml \
                                --activate-profiles gh-pages \
                                --define gpg.skip=true \
                                $skipOptions \
                                $extraBuildParams 
            """.stripIndent()
        }
      }
    }
    stage('OSS security analysis') {
      when {
        anyOf {
          expression { params.ACTION != 'RELEASE' && branch_name == 'master' }
          expression { params.FORCE_SECURITY_ANALYSIS == true }
        }
      }
      steps {
        withCredentials([ossrhCredentials]) {
          catchError(buildResult: 'SUCCESS', stageResult: 'FAILURE') {
            sh """
               bash .jenkins/scripts/mvn-ossindex-audit.sh
               """
          }
        }
      }
      post {
        always {
          publishHTML(
              target: [
                  allowMissing         : true,
                  alwaysLinkToLastBuild: false,
                  keepAll              : true,
                  reportDir            : 'target/',
                  reportFiles          : 'audit.txt',
                  reportName           : "security::audit"
              ])
        }
      }
    }
    stage('Deps report') {
      when {
        anyOf {
          expression { params.ACTION != 'RELEASE' && branch_name == 'master' }
          expression { params.FORCE_DEPS_REPORT == true }
        }
      }
      steps {
        withCredentials([ossrhCredentials,
                         nexusCredentials]) {
          catchError(buildResult: 'SUCCESS', stageResult: 'FAILURE') {
            sh """
                           bash .jenkins/scripts/mvn_dependency_updates_report.sh
                        """
          }
        }
      }
      post {
        always {
          publishHTML(
              target: [
                  allowMissing         : true,
                  alwaysLinkToLastBuild: false,
                  keepAll              : true,
                  reportDir            : 'target/reports/',
                  reportFiles          : 'dependency-updates-report.html',
                  reportName           : "outdated::dependency"
              ])
          publishHTML(
              target: [
                  allowMissing         : true,
                  alwaysLinkToLastBuild: false,
                  keepAll              : true,
                  reportDir            : 'target/reports/',
                  reportFiles          : 'plugin-updates-report.html',
                  reportName           : "outdated::plugins"
              ])
        }
      }
    }
    stage('Sonar') {
      when {
        expression { (params.ACTION != 'RELEASE') && !params.DISABLE_SONAR }
      }
      steps {
        script {
          withCredentials([nexusCredentials,
                           sonarToken,
                           gitCredentials]) {

            SonarController.runSonar(branch_name,
                                     env.CHANGE_TARGET,
                                     pull_request_id,
                                     extraBuildParams,
                                     'jacoco.xml', // jacocoGlob
                                     false) // useCache false https://qlik-dev.atlassian.net/browse/QTDI-234
          }
        }
      }
    }
    stage('Release') {
      when {
        allOf {
          expression { params.ACTION == 'RELEASE' }
          expression { isStdBranch }
        }
      }
      steps {
        script {
          withCredentials([gitCredentials, dockerCredentials, ossrhCredentials, jetbrainsCredentials, jiraCredentials, gpgCredentials, nexusCredentials]) {
            configFileProvider([configFile(fileId: 'maven-settings-nexus-zl', variable: 'MAVEN_SETTINGS')]) {
              sh """
                            bash .jenkins/scripts/release_legacy.sh $branch_name $finalVersion $extraBuildParams
                            """
            }
          }
        }
      }
    }
    stage('Trivy scan') {
      when {
        expression { params.ACTION == 'STANDARD' && params.TRIVY_SCAN == true }
      }
      steps {
        script {
          trivyTools.generateTrivyReport('output/trivy-results.json',
                                         'output/trivy-results.html')
          publishHtmlReportTools.publishHtmlReport('output/trivy-results.html',
                                                   'CVE Trivy Vulnerability Report')
        }
      }
      post {
        always {
          catchError(buildResult: 'SUCCESS', stageResult: 'FAILURE') {
            archiveArtifacts artifacts: "output/trivy-results.*", allowEmptyArchive: true, onlyIfSuccessful: false
          }
        }
      }
    }
    stage('Mvn dependency:tree') {
      when {
        expression { params.ACTION == 'STANDARD' && params.TRIVY_SCAN == true }
      }
      steps {
        script {
          mvnDependencyTreeTools.generateScopeOfImpactReport("output/${repository}.txt", params.PACKAGE_FILTER_NAME, "output/${repository}--ScopeOfImpact.txt", repository)
          publishHtmlReportTools.publishHtmlReport("output/${repository}.html", 'CVE mvn dependency:tree Report')
          publishHtmlReportTools.publishHtmlReport("output/${repository}--ScopeOfImpact.html", 'CVE Scope Of Impact Report')
        }
      }
      post {
        always {
          catchError(buildResult: 'SUCCESS', stageResult: 'FAILURE') {
            archiveArtifacts artifacts: "output/${repository}.txt, output/${repository}--ScopeOfImpact.txt", allowEmptyArchive: true, onlyIfSuccessful: false
          }
        }
      }
    }
  }
  post {
    success {
      script {
        println "====== Publish Coverage"
        publishCoverage adapters: [jacocoAdapter('**/jacoco-aggregate/*.xml')]
        publishCoverage adapters: [jacocoAdapter('**/jacoco-it/*.xml')]
        publishCoverage adapters: [jacocoAdapter('**/jacoco-ut/*.xml')]
        println "====== Publish HTML API Coverage"
        publishHTML([
            allowMissing         : false,
            alwaysLinkToLastBuild: false,
            keepAll              : true,
            reportDir            : 'reporting/target/site/jacoco-aggregate',
            reportFiles          : 'index.html',
            reportName           : 'Coverage',
            reportTitles         : 'Coverage'
        ])
      }
    }
    always {
      script {
        String prevResult = null
        if (currentBuild.previousBuild) {
          prevResult = currentBuild.previousBuild.result
        }

        alertingTools.slack_result(
            env.SLACK_CI_CHANNEL,
            currentBuild.result,
            prevResult,
            true, // Post for success
            true, // Post for failure
            "Failure of $pomVersion $params.ACTION.")
      }
      recordIssues(
          enabledForFailure: false,
          tools: [
              taskScanner(
                  id: 'disabled',
                  name: '@Disabled',
                  includePattern: '**/src/**/*.java',
                  ignoreCase: true,
                  normalTags: '@Disabled'
              ),
              taskScanner(
                  id: 'todo',
                  name: 'Todo(low)/Fixme(high)',
                  includePattern: '**/src/**/*.java',
                  ignoreCase: true,
                  highTags: 'FIX_ME, FIXME',
                  lowTags: 'TO_DO, TODO'
              )
          ]
      )
      script {
        println '====== Archive jacoco reports artifacts'
        archiveArtifacts artifacts: "${'**/jacoco-aggregate/**/*.*'}", allowEmptyArchive: true, onlyIfSuccessful: false
      }

      script {
        if (params.JENKINS_DEBUG) {
          JenkinsController.jenkinsBreakpoint()
        }
      }
    }
  }
}

/**
 * Assembly all needed items to put inside extraBuildParams
 *
 * @param Boolean skip_doc, if set to true documentation build will be skipped
 *
 * @return extraBuildParams as a string ready for mvn cmd
 */
private String assemblyExtraBuildParams(Boolean skip_doc) {
  String extraBuildParams

  println 'Processing extraBuildParams'
  final List<String> buildParamsAsArray = []

  println 'Manage user params'
  if (params.EXTRA_BUILD_PARAMS) {
    buildParamsAsArray.add(params.EXTRA_BUILD_PARAMS as String)
  }

  println 'Manage the skip_doc option'
  if (skip_doc) {
    buildParamsAsArray.add('--projects !documentation')
    buildParamsAsArray.add('--define documentation.skip=true')
  }

  println 'Construct final params content'
  extraBuildParams = buildParamsAsArray.join(' ')
  println "extraBuildParams: $extraBuildParams"

  return extraBuildParams
}

/**
 * create a new version from actual one and given jira ticket or user qualifier
 * Priority to user qualifier
 *
 * The branch name has comply with the format: user/JIRA-1234-Description
 * It is MANDATORY for artifact management.
 *
 * @param String version actual version to edit
 * @param GString ticket
 * @param GString user_qualifier to be checked as priority qualifier
 *
 * @return String new_version with added qualifier
 */
private static String add_qualifier_to_version(String version, String ticket, String user_qualifier) {
  String new_version

  if (user_qualifier.contains("DEFAULT")) {
    if (version.contains("-SNAPSHOT")) {
      new_version = version.replace("-SNAPSHOT", "-$ticket-SNAPSHOT" as String)
    } else {
      new_version = "$version-$ticket".toString()
    }
  } else {
    new_version = version.replace("-SNAPSHOT", "-$user_qualifier-SNAPSHOT" as String)
  }
  return new_version
}

/**
 * extract given branch information
 *
 * The branch name has comply with the format: user/JIRA-1234-Description
 * It is MANDATORY for artifact management.
 *
 * @param branch_name row name of the branch
 *
 * @return A list containing the extracted: [user, ticket, description]
 * The method also raise an assert exception in case of wrong branch name
 */
private static ArrayList<String> extract_branch_info(String branch_name) {

  String branchRegex = /^(?<user>.*)\/(?<ticket>[A-Z]{2,8}-\d{1,6})[_-](?<description>.*)/
  Matcher branchMatcher = branch_name =~ branchRegex

  try {
    assert branchMatcher.matches()
  }
  catch (AssertionError ignored) {
    return ["", "", ""]
  }

  String user = branchMatcher.group("user")
  String ticket = branchMatcher.group("ticket")
  String description = branchMatcher.group("description")

  return [user, ticket, description]
}