JenkinsFile

#!/usr/bin/groovy

node {
    def root = pwd()
    def mvn = tool 'M3'
    def projectId = "venicegeo:beachfront:beachfront-py"
    def appvers = ""
    def appName = ""

  stage("Config") {
    // clone the configuration repository and copy the current configuration
    def configDir = "${root}/configuration"
    def configFile = "${root}/config.json"
    dir(configDir) {
      git url: "${env.CONFIGURATION_URL}", credentialsId: "${env.CONFIGURATION_CREDS}"
      sh "mv ${configDir}/${ENVIRONMENT}-config.json ${configFile}"
      deleteDir()
    }
    // read the current configuration
    def configJson = readJSON file: "${configFile}"
    for (param in configJson.credparams + configJson.jobparams) { 
      env."${param.name}" = (param.type == "booleanParam") ? "${param.defaultvalue}".toBoolean() : "${param.defaultvalue}"
    }
  }
	
  stage("Setup") {
    deleteDir()
      if(env.USE_GIT_CREDS.toBoolean()) {
        git url: "${env.GIT_URL}", branch: "${env.GIT_BRANCH}", credentialsId: "${env.GITLAB_CREDS}"
      } else {
        git url: "${env.GIT_URL}", branch: "${env.GIT_BRANCH}"
      }

    appvers = sh(script: """git describe --long --tags --always | sed 's/\\./-/'g""", returnStdout: true).trim()
    appName = "beachfront-py-${appvers}"
  }

  if(!env.SKIP_SCANS.toBoolean()) {
    stage("Dependency Check") {
      withCredentials([
        [$class: 'StringBinding', credentialsId: "${env.THREADFIX_API_KEY}", variable: "THREADFIX_KEY"]
      ]) {
        dir("beachfront") {
          def depHome = tool 'owasp_dependency_check'
          withEnv(["PATH+=${depHome}/bin"]) {
            sh 'dependency-check.sh --project "beachfront-py" --scan "." --format "XML" --enableExperimental --disableBundleAudit'
            sh "/bin/curl -v --insecure -H 'Accept: application/json' -X POST --form file=@dependency-check-report.xml ${env.THREADFIX_URL}/rest/latest/applications/${env.THREADFIX_ID}/upload?apiKey=${THREADFIX_KEY}"
          }
        }
      }
    }

    stage("Fortify Scans") {
      withCredentials([
        [$class: 'StringBinding', credentialsId: "${env.THREADFIX_API_KEY}", variable: "THREADFIX_KEY"]
      ]) {
        dir("beachfront") {
          sh "/opt/hp_fortify_sca/bin/sourceanalyzer -b ${env.BUILD_NUMBER} ./{*.py,**/*.py} -exclude **/test/*"
          sh "/opt/hp_fortify_sca/bin/sourceanalyzer -b ${env.BUILD_NUMBER}  -scan -Xmx8G -f fortifyResults-${env.BUILD_NUMBER}.fpr"
          sh "/bin/curl -v --insecure -H 'Accept: application/json' -X POST --form file=@fortifyResults-${env.BUILD_NUMBER}.fpr ${env.THREADFIX_URL}/rest/latest/applications/${THREADFIX_ID}/upload?apiKey=${THREADFIX_KEY}"
        }
      }
    }
  }
}