DevSecOps-OTT-Platform/Jenkinsfile at main · KomalSingh21/DevSecOps-OTT-Platform · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
```groovy
pipeline {
    agent any
    tools {
        jdk 'jdk21'
        nodejs 'nodejs20'
    }
    environment {
        SCANNER_HOME = tool 'sonar-scanner'
    }
    stages {
        stage('Clean Workspace') {
            steps {
                cleanWs()
            }
        }
        stage('Checkout from Git') {
            steps {
                git branch: 'main',
                url: 'https://github.com/KomalSingh21/DevSecOps-OTT-Platform.git'
            }
        }
        stage('SonarQube Analysis') {
            steps {
                withSonarQubeEnv('sonar-server') {
                    sh '''
                        $SCANNER_HOME/bin/sonar-scanner \\
                        -Dsonar.projectName=ott \\
                        -Dsonar.projectKey=ott
                    '''
                }
            }
        }
        stage('Quality Gate') {
            steps {
                script {
                    waitForQualityGate(
                        abortPipeline: true,
                        credentialsId: 'sonar-token'
                    )
                }
            }
        }
        stage('Install Dependencies') {
            steps {
                sh 'yarn install --frozen-lockfile'
            }
        }
        stage('OWASP FS Scan') {
            steps {
                dependencyCheck(
                    additionalArguments: '--scan ./ --disableYarnAudit --disableNodeAudit',
                    odcInstallation: 'DP-Check'
                )
                dependencyCheckPublisher(
                    pattern: '**/dependency-check-report.xml'
                )
            }
        }
        stage('Trivy FS Scan') {
            steps {
                sh 'trivy fs . > trivyfs.txt'
            }
        }
        stage('Docker Build & Push') {
            steps {
                script {
                    withDockerRegistry(
                        credentialsId: 'docker',
                        toolName: 'docker'
                    ) {
                        withCredentials([
                            string(
                                credentialsId: 'tmdb-api-key',
                                variable: 'TMDB_V3_API_KEY'
                            )
                        ]) {
                            sh '''
                                docker build \\
                                --build-arg TMDB_V3_API_KEY="$TMDB_V3_API_KEY" \\
                                -t ott .
                            '''
                            sh 'docker tag ott comal21/ott:latest'
                            sh 'docker push comal21/ott:latest'
                        }
                    }
                }
            }
        }
        stage('Trivy Image Scan') {
            steps {
                sh 'trivy image comal21/ott:latest > trivyimage.txt'
            }
        }
        stage('Deploy to Container') {
            steps {
                sh 'docker run -d --name ott -p 8081:80 comal21/ott:latest'
            }
        }
        stage('Deploy to kubernetes') {
            steps {
                script {
                    dir('Kubernetes') {
                        withKubeConfig(caCertificate: '', clusterName: '', contextName: '', credentialsId: 'k8s', namespace: '', restrictKubeConfigAccess: false, serverUrl: '') {
                            sh 'kubectl apply -f deployment.yml'
                            sh 'kubectl apply -f service.yml'
                        }
                    }
                }
                post {
                    always {
                        emailext attachLog: true,
                        subject: "'${currentBuild.result}'",
                        body: "Project: ${env.JOB_NAME}<br/>" + "Build Number: ${env.BUILD_NUMBER}<br/>"
                            + "URL: ${env.BUILD_URL}<br/>",
                        to: 'comalsingh12@gmail.com', #change mail here
                        attachmentsPattern: 'trivyfs.txt,trivyimage.txt'
                    }
                }
            }
        }