Jenkinsfile

pipeline {
    agent any

    environment {
        // Docker registry prefix
        REGISTRY_PREFIX = "cityzen"

        // Local K3s configuration
        KUBECONFIG = "/etc/rancher/k3s/k3s.yaml"

        // Remote production server
        DEPLOY_HOST = "192.168.72.106"
        DEPLOY_USER = "saes2026"
        DEPLOY_SSH_PORT = "2222"
        DEPLOY_SSH = "ssh -p ${DEPLOY_SSH_PORT} -o StrictHostKeyChecking=no ${DEPLOY_USER}@${DEPLOY_HOST}"
        DEPLOY_SCP = "scp -P ${DEPLOY_SSH_PORT} -o StrictHostKeyChecking=no"
        DEPLOY_K8S_DIR = "/home/saes2026/k8s-deploy"

        // Define the path to the virtual environment
        VENV_PATH = "${WORKSPACE}/venv"
    }

    stages {
        stage('Checkout') {
            steps {
                echo 'Fetching source code from repository...'
                checkout scm
            }
        }

        stage('Security & Unit Tests') {
            steps {
                script {
                    // Auto-discover backend services
                    def services = sh(script: "ls -d backend/*-service | xargs -n1 basename", returnStdout: true).trim().split('\n')

                    def parallelStages = [:]

                    // Global security scans
                    parallelStages['Semgrep Scan'] = {
                        sh 'semgrep scan --config p/ci --error backend/'
                        sh 'semgrep scan --config p/ci --error frontend/'
                    }
                    parallelStages['Trivy Scan'] = {
                        sh 'trivy fs --exit-code 0 --severity HIGH,CRITICAL --skip-dirs .venv --skip-dirs node_modules .'
                    }

                    // Parallel unit tests and safety checks for each service
                    services.each { service ->
                        def svcName = service.replace('-service', '')

                        parallelStages["Unit: ${service}"] = {
                            sh "python3 -m venv ${env.VENV_PATH}-${svcName}"
                            sh "${env.VENV_PATH}-${svcName}/bin/pip install -r backend/${service}/requirements.txt"
                            sh "cd backend/${service} && ${env.VENV_PATH}-${svcName}/bin/coverage run --source=app -m unittest discover -s tests"
                            sh "cd backend/${service} && ${env.VENV_PATH}-${svcName}/bin/coverage report"
                        }

                        parallelStages["Safety: ${service}"] = {
                            sh "safety check -r backend/${service}/requirements.txt"
                        }
                    }

                    parallel parallelStages
                }
            }
        }

        stage('Build Frontend') {
            steps {
                echo 'Installing dependencies...'
                sh "cd frontend && npm ci"
            }
        }

        stage('Docker Build') {
            steps {
                script {
                    def services = sh(script: "ls -d backend/*-service | xargs -n1 basename", returnStdout: true).trim().split('\n')
                    def parallelBuilds = [:]

                    // Build all backend services in parallel
                    services.each { service ->
                        def imageName = "${env.REGISTRY_PREFIX}/${service}"
                        parallelBuilds["Build ${service}"] = {
                            sh "docker build -t ${imageName}:${env.BUILD_NUMBER} -f backend/${service}/Dockerfile backend/${service}"
                            sh "docker tag ${imageName}:${env.BUILD_NUMBER} ${imageName}:latest"
                        }
                    }

                    // Build frontend
                    parallelBuilds['Build Frontend'] = {
                        sh "docker build -t ${env.REGISTRY_PREFIX}/frontend:${env.BUILD_NUMBER} --build-arg VITE_API_URL=http://authentication-service.cityzen.svc.cluster.local:8000 -f frontend/Dockerfile frontend"
                        sh "docker tag ${env.REGISTRY_PREFIX}/frontend:${env.BUILD_NUMBER} ${env.REGISTRY_PREFIX}/frontend:latest"
                    }

                    parallel parallelBuilds
                }
            }
        }

        stage('Image Security Scan') {
            steps {
                script {
                    def services = sh(script: "ls -d backend/*-service | xargs -n1 basename", returnStdout: true).trim().split('\n')
                    def parallelScans = [:]

                    // Scan all backend service images with unique cache directories to avoid lock conflicts
                    services.each { service ->
                        def imageName = "${env.REGISTRY_PREFIX}/${service}"
                        parallelScans["Scan ${service}"] = {
                            sh "trivy image --cache-dir /tmp/trivy-cache-${service} --exit-code 1 --severity HIGH,CRITICAL ${imageName}:${env.BUILD_NUMBER}"
                        }
                    }

                    // Scan frontend image
                    parallelScans['Scan Frontend'] = {
                        sh "trivy image --cache-dir /tmp/trivy-cache-frontend --exit-code 1 --severity HIGH,CRITICAL ${env.REGISTRY_PREFIX}/frontend:${env.BUILD_NUMBER}"
                    }

                    parallel parallelScans
                }
            }
        }

        stage('Deploy to Staging') {
            steps {
                script {
                    def services = sh(script: "ls -d backend/*-service | xargs -n1 basename", returnStdout: true).trim().split('\n')

                    // Import all backend service images into local K3s
                    services.each { service ->
                        def imageName = "${env.REGISTRY_PREFIX}/${service}"
                        sh "docker save ${imageName}:${env.BUILD_NUMBER} | sudo k3s ctr images import -"
                        sh "sudo k3s ctr images tag docker.io/${imageName}:${env.BUILD_NUMBER} docker.io/${imageName}:latest"
                    }

                    // Import frontend image
                    sh "docker save ${env.REGISTRY_PREFIX}/frontend:${env.BUILD_NUMBER} | sudo k3s ctr images import -"

                    // Create namespace and apply manifests
                    sh "kubectl create namespace cityzen --dry-run=client -o yaml | kubectl apply -f -"

                    // Create secrets for all backend services using Jenkins credentials
                    services.each { service ->
                        def credId = service.replace('-service', '-env')
                        def secretName = service.replace('-service', '-secret')
                        withCredentials([file(credentialsId: credId, variable: 'ENV_FILE')]) {
                            sh "kubectl create secret generic ${secretName} --from-env-file=${ENV_FILE} -n cityzen --dry-run=client -o yaml | kubectl apply -f -"
                        }
                    }

                    // Create minio secret
                    withCredentials([file(credentialsId: 'minio-env', variable: 'MINIO_ENV_FILE')]) {
                        sh "kubectl create secret generic minio-secret --from-env-file=${MINIO_ENV_FILE} -n cityzen --dry-run=client -o yaml | kubectl apply -f -"
                    }

                    sh "kubectl apply -f k8s/"

                    // Restart all deployments
                    sh "kubectl rollout restart deployments -n cityzen"

                    // Wait for all rollouts to complete before proceeding to API tests
                    services.each { service ->
                        sh "kubectl rollout status deployment/${service} -n cityzen --timeout=120s"
                    }
                    sh "kubectl rollout status deployment/frontend -n cityzen --timeout=120s"
                }
            }
        }

        stage('API Tests') {
            steps {
                script {
                    // Wait for all pods to be ready
                    sh 'kubectl wait --for=condition=ready pod --all -n cityzen --timeout=120s'

                    // Install newman if not present
                    sh 'which newman || npm install -g newman'

                    // Start port-forwards for all services
                    sh '''
                        SERVICES="authentication-service:8000 ticket-service:8002 account-service:8003 parameter-configuration-service:8004 assignment-service:8005 media-service:8006 registration-service:8007 analytics-service:8008 feedback-service:8009 map-service:8030 geolocation-service:8040 report-service:8050 notification-service:8060"
                        for svc in $SERVICES; do
                            name=$(echo $svc | cut -d: -f1)
                            port=$(echo $svc | cut -d: -f2)
                            kubectl port-forward -n cityzen svc/$name $port:$port &
                        done
                        sleep 5
                    '''

                    try {
                        // Find all Postman collections and run tests in parallel
                        def collections = sh(script: "ls -1 '${WORKSPACE}/postman'/*.postman_collection.json", returnStdout: true).trim().split('\n')
                        def parallelTests = [:]

                        collections.each { collection ->
                            def collectionName = collection.split('/').last().replace('.postman_collection.json', '')
                            parallelTests["Test: ${collectionName}"] = {
                                sh "newman run '${collection}' --environment '${WORKSPACE}/postman/CityZen-Jenkins.postman_environment.json' --delay-request 100"
                            }
                        }

                        parallel parallelTests
                    } finally {
                        // Cleanup port-forwards
                        sh 'pkill -f "kubectl port-forward" || true'
                    }
                }
            }
        }

        stage('Deploy to Production') {
            steps {
                script {
                    def services = sh(script: "ls -d backend/*-service | xargs -n1 basename", returnStdout: true).trim().split('\n')
                    def sshCmd = "${env.DEPLOY_SSH}"

                    // Transfer and import all backend service images into K3s on .106
                    services.each { service ->
                        def imageName = "${env.REGISTRY_PREFIX}/${service}"
                        sh "docker save ${imageName}:${env.BUILD_NUMBER} | ${sshCmd} 'sudo k3s ctr images import -'"
                        sh "${sshCmd} \"sudo k3s ctr images tag docker.io/${imageName}:${env.BUILD_NUMBER} docker.io/${imageName}:latest\""
                    }

                    // Transfer and import frontend image
                    sh "docker save ${env.REGISTRY_PREFIX}/frontend:${env.BUILD_NUMBER} | ${sshCmd} 'sudo k3s ctr images import -'"
                    sh "${sshCmd} \"sudo k3s ctr images tag docker.io/${env.REGISTRY_PREFIX}/frontend:${env.BUILD_NUMBER} docker.io/${env.REGISTRY_PREFIX}/frontend:latest\""

                    // Copy k8s manifests to .106
                    sh "${env.DEPLOY_SCP} -r ${WORKSPACE}/k8s/ ${env.DEPLOY_USER}@${env.DEPLOY_HOST}:${env.DEPLOY_K8S_DIR}/"

                    // Create namespace on .106
                    sh "${sshCmd} 'sudo k3s kubectl create namespace cityzen 2>/dev/null || true'"

                    // Create secrets for all backend services using Jenkins credentials
                    services.each { service ->
                        def credId = service.replace('-service', '-env')
                        def secretName = service.replace('-service', '-secret')
                        withCredentials([file(credentialsId: credId, variable: 'ENV_FILE')]) {
                            sh "${sshCmd} 'rm -f /tmp/${secretName}.env'"
                            sh "${env.DEPLOY_SCP} ${ENV_FILE} ${env.DEPLOY_USER}@${env.DEPLOY_HOST}:/tmp/${secretName}.env"
                            sh "${sshCmd} 'sudo k3s kubectl delete secret ${secretName} -n cityzen --ignore-not-found'"
                            sh "${sshCmd} 'sudo k3s kubectl create secret generic ${secretName} --from-env-file=/tmp/${secretName}.env -n cityzen'"
                            sh "${sshCmd} 'rm -f /tmp/${secretName}.env'"
                        }
                    }

                    // Create minio secret
                    withCredentials([file(credentialsId: 'minio-env', variable: 'MINIO_ENV_FILE')]) {
                        sh "${sshCmd} 'rm -f /tmp/minio-secret.env'"
                        sh "${env.DEPLOY_SCP} ${MINIO_ENV_FILE} ${env.DEPLOY_USER}@${env.DEPLOY_HOST}:/tmp/minio-secret.env"
                        sh "${sshCmd} 'sudo k3s kubectl delete secret minio-secret -n cityzen --ignore-not-found'"
                        sh "${sshCmd} 'sudo k3s kubectl create secret generic minio-secret --from-env-file=/tmp/minio-secret.env -n cityzen'"
                        sh "${sshCmd} 'rm -f /tmp/minio-secret.env'"
                    }

                    sh "${sshCmd} 'sudo k3s kubectl apply -f ${env.DEPLOY_K8S_DIR}/k8s/'"

                    // Ensure Traefik is disabled so NGINX Ingress Controller can bind to port 80
                    sh "${sshCmd} 'sudo k3s kubectl scale deployment traefik -n kube-system --replicas=0 2>/dev/null' || true"

                    // Ensure NGINX Ingress Controller is exposed as LoadBalancer on port 80
                    sh "${sshCmd} \"sudo k3s kubectl patch svc ingress-nginx-controller -n ingress-nginx -p '{\\\"spec\\\":{\\\"type\\\":\\\"LoadBalancer\\\"}}' || true\""

                    // Restart all deployments
                    sh "${sshCmd} 'sudo k3s kubectl rollout restart deployments -n cityzen'"

                    // Rollout status
                    services.each { service ->
                        sh "${sshCmd} 'sudo k3s kubectl rollout status deployment/${service} -n cityzen --timeout=120s'"
                    }
                    sh "${sshCmd} 'sudo k3s kubectl rollout status deployment/frontend -n cityzen --timeout=120s'"
                }
            }
        }
    }

    post {
        success {
            echo 'CI/CD Pipeline finished successfully. Application is up and running.'
        }
        failure {
            echo 'Pipeline failed. Please review the security scan or test logs.'
        }
    }
}