Jenkinsfile

/*
 * Copyright (C) 2020 Bosch.IO GmbH
 *
 * Licensed under the Apache License, Version 2.0 (the "License");
 * you may not use this file except in compliance with the License.
 * You may obtain a copy of the License at
 *
 *     http://www.apache.org/licenses/LICENSE-2.0
 *
 * Unless required by applicable law or agreed to in writing, software
 * distributed under the License is distributed on an "AS IS" BASIS,
 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 * See the License for the specific language governing permissions and
 * limitations under the License.
 *
 * SPDX-License-Identifier: Apache-2.0
 * License-Filename: LICENSE
 */

/**
 * Required Jenkins plugins:
 * - https://plugins.jenkins.io/pipeline-utility-steps/
 */

import com.cloudbees.groovy.cps.NonCPS

import java.io.IOException

final DOCKER_BUILD_ARGS = '--build-arg http_proxy=$http_proxy --build-arg https_proxy=$https_proxy'

// Disable the entry point to work around https://issues.jenkins-ci.org/browse/JENKINS-51307.
final DOCKER_RUN_ARGS = '-e http_proxy -e https_proxy --entrypoint=""'

// The status code ORT commands return for failures (like rule violations), not errors (like existing output files).
final ORT_FAILURE_STATUS_CODE = 2

@NonCPS
static sortProjectsByPathDepth(projects) {
    return projects.toSorted { it.definition_file_path.count("/") }
}

def projectVcsCredentials = []
def ortConfigVcsCredentials = []

pipeline {
    agent none

    parameters {
        /*
         * Parameters about the project to run ORT on.
         */

        string(
            name: 'PROJECT_VCS_URL',
            description: 'VCS clone URL of the project',
            defaultValue: 'https://github.com/vdurmont/semver4j.git'
        )

        string(
            name: 'PROJECT_VCS_REVISION',
            description: 'VCS revision of the project (prefix Git tags with "refs/tags/")',
            defaultValue: ''
        )

        credentials(
            name: 'PROJECT_VCS_CREDENTIALS',
            description: 'Optional Jenkins credentials id to use for VCS checkout',
            defaultValue: ''
        )

        /*
         * General ORT parameters.
         */

        string(
            name: 'ORT_CONFIG_VCS_URL',
            description: 'Optional VCS clone URL of the ORT configuration',
            defaultValue: ''
        )

        string(
            name: 'ORT_CONFIG_VCS_REVISION',
            description: 'Optional VCS revision of the ORT configuration (prefix Git tags with "refs/tags/")',
            defaultValue: ''
        )

        credentials(
            name: 'ORT_CONFIG_VCS_CREDENTIALS',
            description: 'Optional Jenkins credentials id to use for VCS checkout',
            defaultValue: ''
        )

        choice(
            name: 'LOG_LEVEL',
            description: 'Log message level',
            choices: ['--info', '--performance', '--debug', '']
        )

        booleanParam(
            name: 'STACKTRACE',
            defaultValue: false,
            description: 'Show stacktrace of all exceptions'
        )

        /*
         * ORT analyzer tool parameters.
         */

        booleanParam(
            name: 'ALLOW_DYNAMIC_VERSIONS',
            defaultValue: false,
            description: 'Allow dynamic versions of dependencies (support projects without lock files)'
        )

        booleanParam(
            name: 'USE_CLEARLY_DEFINED_CURATIONS',
            defaultValue: true,
            description: 'Use package curation data from the ClearlyDefined service'
        )

        /*
         * ORT scanner tool parameters.
         */

        booleanParam(
            name: 'RUN_SCANNER',
            defaultValue: true,
            description: 'Run the scanner tool'
        )

        /*
         * ORT evaluator tool parameters.
         */

        booleanParam(
            name: 'RUN_EVALUATOR',
            defaultValue: true,
            description: 'Run the evaluator tool'
        )

        /*
         * ORT reporter tool parameters.
         */

        booleanParam(
            name: 'RUN_REPORTER',
            defaultValue: true,
            description: 'Run the reporter tool'
        )
    }

    stages {
        stage('Configure pipeline') {
            agent any

            steps {
                script {
                    if (!params.PROJECT_VCS_CREDENTIALS.allWhitespace) {
                        projectVcsCredentials += usernamePassword(credentialsId: params.PROJECT_VCS_CREDENTIALS, usernameVariable: 'LOGIN', passwordVariable: 'PASSWORD')
                    }

                    if (!params.ORT_CONFIG_VCS_CREDENTIALS.allWhitespace) {
                        ortConfigVcsCredentials += usernamePassword(credentialsId: params.ORT_CONFIG_VCS_CREDENTIALS, usernameVariable: 'LOGIN', passwordVariable: 'PASSWORD')
                    }
                }
            }
        }

        /*
         * This is a "dummy" stage to build the Docker image explicitly (if needed) so that the time for building the
         * image is not included in other stages.
         */
        stage('Build ORT Docker image') {
            agent {
                dockerfile {
                    additionalBuildArgs DOCKER_BUILD_ARGS
                    args DOCKER_RUN_ARGS
                }
            }

            environment {
                HOME = "${env.WORKSPACE}@tmp"
            }

            steps {
                sh '''
                    if [ "$STACKTRACE" = "true" ]; then
                        STACKTRACE_OPTION="--stacktrace"
                    fi

                    /opt/ort/bin/ort $LOG_LEVEL $STACKTRACE_OPTION --version
                '''
            }
        }

        stage('Clone project') {
            agent {
                dockerfile {
                    additionalBuildArgs DOCKER_BUILD_ARGS
                    args DOCKER_RUN_ARGS
                }
            }

            environment {
                HOME = "${env.WORKSPACE}@tmp"
                PROJECT_DIR = "${env.HOME}/project"
            }

            steps {
                withCredentials(projectVcsCredentials) {
                    sh '''
                        echo "default login $LOGIN password $PASSWORD" > $HOME/.netrc

                        if [ "$STACKTRACE" = "true" ]; then
                            STACKTRACE_OPTION="--stacktrace"
                        fi

                        if [ -n "$PROJECT_VCS_REVISION" ]; then
                            VCS_REVISION_OPTION="--vcs-revision $PROJECT_VCS_REVISION"
                        fi

                        rm -fr $PROJECT_DIR
                        /opt/ort/bin/ort $LOG_LEVEL $STACKTRACE_OPTION download --project-url $PROJECT_VCS_URL $VCS_REVISION_OPTION -o $PROJECT_DIR/source

                        rm -f $HOME/.netrc
                    '''
                }
            }
        }

        stage('Clone ORT configuration') {
            agent {
                dockerfile {
                    additionalBuildArgs DOCKER_BUILD_ARGS
                    args DOCKER_RUN_ARGS
                }
            }

            when {
                beforeAgent true

                expression {
                    !params.ORT_CONFIG_VCS_URL.allWhitespace
                }
            }

            environment {
                HOME = "${env.WORKSPACE}@tmp"
                ORT_DATA_DIR = "${env.HOME}/.ort"
            }

            steps {
                withCredentials(ortConfigVcsCredentials) {
                    sh '''
                        echo "default login $LOGIN password $PASSWORD" > $HOME/.netrc

                        if [ "$STACKTRACE" = "true" ]; then
                            STACKTRACE_OPTION="--stacktrace"
                        fi

                        if [ -n "$ORT_CONFIG_VCS_REVISION" ]; then
                            VCS_REVISION_OPTION="--vcs-revision $ORT_CONFIG_VCS_REVISION"
                        fi

                        rm -fr $ORT_DATA_DIR/config
                        /opt/ort/bin/ort $LOG_LEVEL $STACKTRACE_OPTION download --project-url $ORT_CONFIG_VCS_URL $VCS_REVISION_OPTION -o $ORT_DATA_DIR/config

                        rm -f $HOME/.netrc
                    '''
                }
            }
        }

        stage('Run ORT analyzer') {
            agent {
                dockerfile {
                    additionalBuildArgs DOCKER_BUILD_ARGS
                    args DOCKER_RUN_ARGS
                }
            }

            environment {
                HOME = "${env.WORKSPACE}@tmp"
                PROJECT_DIR = "${env.HOME}/project"
            }

            steps {
                script {
                    def status = sh returnStatus: true, script: '''
                        /opt/ort/bin/set_gradle_proxy.sh

                        if [ "$STACKTRACE" = "true" ]; then
                            STACKTRACE_OPTION="--stacktrace"
                        fi

                        if [ "$USE_CLEARLY_DEFINED_CURATIONS" = "true" ]; then
                            USE_CLEARLY_DEFINED_CURATIONS_OPTION="--clearly-defined-curations"
                        fi

                        rm -fr out/results
                        /opt/ort/bin/ort $LOG_LEVEL $STACKTRACE_OPTION -P ort.analyzer.allowDynamicVersions=$ALLOW_DYNAMIC_VERSIONS analyze $USE_CLEARLY_DEFINED_CURATIONS_OPTION -i $PROJECT_DIR/source -o out/results/analyzer
                    '''

                    if (status >= ORT_FAILURE_STATUS_CODE) unstable('Analyzer issues found.')
                    else if (status != 0) error('Error executing the analyzer.')
                }

                sh 'ln -frs out/results/analyzer/analyzer-result.yml out/results/current-result.yml'

                script {
                    try {
                        def result = readYaml file: 'out/results/analyzer/analyzer-result.yml'
                        def projects = result.analyzer?.result?.projects

                        if (projects) {
                            // Determine the / a root project simply by sorting by path depth.
                            def sortedProjects = sortProjectsByPathDepth(projects)

                            // There is always at least one (unmanaged) project.
                            def rootProjectId = sortedProjects.first().id

                            currentBuild.displayName += ": $rootProjectId"
                        }
                    } catch (IOException e) {
                        // Ignore and just skip setting a custom display name.
                    }
                }
            }

            post {
                always {
                    archiveArtifacts(
                        artifacts: 'out/results/analyzer/*',
                        fingerprint: true
                    )
                }
            }
        }

        stage('Run ORT scanner') {
            when {
                beforeAgent true

                expression {
                    params.RUN_SCANNER
                }
            }

            agent {
                dockerfile {
                    additionalBuildArgs DOCKER_BUILD_ARGS
                    args DOCKER_RUN_ARGS
                }
            }

            environment {
                HOME = "${env.WORKSPACE}@tmp"
            }

            steps {
                withCredentials(projectVcsCredentials) {
                    script {
                        def status = sh returnStatus: true, script: '''
                            if [ "$STACKTRACE" = "true" ]; then
                                STACKTRACE_OPTION="--stacktrace"
                            fi

                            echo "default login $LOGIN password $PASSWORD" > $HOME/.netrc    
                            /opt/ort/bin/ort $LOG_LEVEL $STACKTRACE_OPTION scan -i out/results/current-result.yml -o out/results/scanner
                            rm -f $HOME/.netrc
                        '''

                        if (status >= ORT_FAILURE_STATUS_CODE) unstable('Scanner issues found.')
                        else if (status != 0) error('Error executing the scanner.')
                    }

                    sh 'ln -frs out/results/scanner/scan-result.yml out/results/current-result.yml'
                }
            }

            post {
                always {
                    archiveArtifacts(
                        artifacts: 'out/results/scanner/*',
                        fingerprint: true
                    )
                }
            }
        }

        stage('Run ORT evaluator') {
            when {
                beforeAgent true

                expression {
                    params.RUN_EVALUATOR
                }
            }

            agent {
                dockerfile {
                    additionalBuildArgs DOCKER_BUILD_ARGS
                    args DOCKER_RUN_ARGS
                }
            }

            environment {
                HOME = "${env.WORKSPACE}@tmp"
            }

            steps {
                withCredentials(projectVcsCredentials) {
                    script {
                        def status = sh returnStatus: true, script: '''
                            if [ "$STACKTRACE" = "true" ]; then
                                STACKTRACE_OPTION="--stacktrace"
                            fi

                            /opt/ort/bin/ort $LOG_LEVEL $STACKTRACE_OPTION evaluate -i out/results/current-result.yml -o out/results/evaluator
                        '''

                        if (status >= ORT_FAILURE_STATUS_CODE) unstable('Rule violations found.')
                        else if (status != 0) error('Error executing the evaluator.')
                    }

                    sh 'ln -frs out/results/evaluator/evaluation-result.yml out/results/current-result.yml'
                }
            }

            post {
                always {
                    archiveArtifacts(
                        artifacts: 'out/results/evaluator/*',
                        fingerprint: true
                    )
                }
            }
        }

        stage('Run ORT reporter') {
            when {
                beforeAgent true

                expression {
                    params.RUN_REPORTER
                }
            }

            agent {
                dockerfile {
                    additionalBuildArgs DOCKER_BUILD_ARGS
                    args DOCKER_RUN_ARGS
                }
            }

            environment {
                HOME = "${env.WORKSPACE}@tmp"
            }

            steps {
                sh '''
                    if [ "$STACKTRACE" = "true" ]; then
                        STACKTRACE_OPTION="--stacktrace"
                    fi

                    /opt/ort/bin/ort $LOG_LEVEL $STACKTRACE_OPTION report \
                        -f CycloneDX,NoticeTemplate,SpdxDocument,StaticHTML,WebApp \
                        -O NoticeTemplate=template.id=default,summary \
                        -i out/results/current-result.yml \
                        -o out/results/reporter
                '''
            }

            post {
                always {
                    archiveArtifacts(
                        artifacts: 'out/results/reporter/*',
                        fingerprint: true
                    )
                }
            }
        }
    }
}