Jenkinsfile_nightly

#!groovy

properties([
    // H allow predefined but random minute see https://en.wikipedia.org/wiki/Cron#Non-standard_characters
    //CCD-3539 (Stop running Nightly builds on weekends) - At 07:00 on every day-of-week from Monday through Friday.  Original schedule was 'H 07 * * *'
    pipelineTriggers([cron('H 17 * * 1-5')])
])

@Library("Infrastructure")

def type = "java"
def product = "ccd"
def component = "data-store-api"

def secrets = [
    'ccd-${env}': [
        secret('ccd-caseworker-autotest-email', 'CCD_CASEWORKER_AUTOTEST_EMAIL'),
        secret('ccd-caseworker-autotest-password', 'CCD_CASEWORKER_AUTOTEST_PASSWORD'),
        secret('ccd-importer-autotest-email', 'CCD_IMPORT_AUTOTEST_EMAIL'),
        secret('ccd-importer-autotest-password', 'CCD_IMPORT_AUTOTEST_PASSWORD'),
        secret('ccd-private-caseworker-email', 'CCD_PRIVATE_CASEWORKER_EMAIL'),
        secret('ccd-private-caseworker-password', 'CCD_PRIVATE_CASEWORKER_PASSWORD'),
        secret('ccd-private-caseworker-autotest-1and2-password', 'CCD_PRIVATE_CASEWORKER_AUTOTEST_1AND2_PASSWORD'),
        secret('ccd-restricted-caseworker-email', 'CCD_RESTRICTED_CASEWORKER_EMAIL'),
        secret('ccd-restricted-caseworker-password', 'CCD_RESTRICTED_CASEWORKER_PASSWORD'),
        secret('ccd-private-caseworker-solicitor-email', 'CCD_PRIVATE_CASEWORKER_SOLICITOR_EMAIL'),
        secret('ccd-private-caseworker-solicitor-password', 'CCD_PRIVATE_CASEWORKER_SOLICITOR_PASSWORD'),
        secret('ccd-private-cross-case-type-worker-email', 'CCD_PRIVATE_CROSS_CASE_TYPE_CASEWORKER_EMAIL'),
        secret('ccd-private-cross-case-type-caseworker-password', 'CCD_PRIVATE_CROSS_CASE_TYPE_CASEWORKER_PASSWORD'),
        secret('ccd-private-cross-case-type-solicitor-email', 'CCD_PRIVATE_CROSS_CASE_TYPE_SOLICITOR_EMAIL'),
        secret('ccd-private-cross-case-type-solicitor-password', 'CCD_PRIVATE_CROSS_CASE_TYPE_SOLICITOR_PASSWORD'),
        secret('ccd-restricted-cross-case-type-caseworker-email', 'CCD_RESTRICTED_CROSS_CASE_TYPE_CASEWORKER_EMAIL'),
        secret('ccd-restricted-cross-case-type-caseworker-password', 'CCD_RESTRICTED_CROSS_CASE_TYPE_CASEWORKER_PASSWORD'),
        secret('ccd-api-gateway-oauth2-client-secret', 'OAUTH2_CLIENT_SECRET'),

        //Required for FTA test RDM-6943
        secret('ccd-befta-caseworker-2-solicitor-1-pwd', 'CCD_BEFTA_CASEWORKER_2_SOLICITOR_1_PWD'),
        secret('ccd-befta-caseworker-2-solicitor-2-pwd', 'CCD_BEFTA_CASEWORKER_2_SOLICITOR_2_PWD'),
        secret('ccd-befta-caseworker-2-solicitor-3-pwd', 'CCD_BEFTA_CASEWORKER_2_SOLICITOR_3_PWD'),
        secret('ccd-befta-caseworker-1-pwd', 'CCD_BEFTA_CASEWORKER_1_PWD'),
        secret('ccd-befta-caseworker-2-pwd', 'CCD_BEFTA_CASEWORKER_2_PWD'),
        secret('ccd-befta-caseworker-3-pwd', 'CCD_BEFTA_CASEWORKER_3_PWD'),
        secret('ccd-befta-citizen-2-pwd', 'CCD_BEFTA_CITIZEN_2_PWD'),
        secret('ccd-befta-citizen-3-pwd', 'CCD_BEFTA_CITIZEN_3_PWD'),
        secret('ccd-befta-solicitor-3-pwd', 'CCD_BEFTA_SOLICITOR_3_PWD'),
        secret('ccd-befta-caseworker-1-no-profile-pwd', 'CCD_BEFTA_CASEWORKER_1_NO_PROFILE_PWD'),
        secret('ccd-befta-caseworker-caa-pwd', 'CCD_BEFTA_CASEWORKER_CAA_PWD'),
        secret('ccd-befta-master-caseworker-pwd', 'CCD_BEFTA_MASTER_CASEWORKER_PWD'),
        secret('ccd-befta-master-solicitor1-pwd', 'CCD_BEFTA_MASTER_SOLICITOR_1_PWD'),
        secret('ccd-befta-master-solicitor2-pwd', 'CCD_BEFTA_MASTER_SOLICITOR_2_PWD'),

        secret('ccd-api-gateway-oauth2-client-secret', 'CCD_API_GATEWAY_OAUTH2_CLIENT_SECRET'),
        secret('definition-importer-username', 'DEFINITION_IMPORTER_USERNAME'),
        secret('definition-importer-password', 'DEFINITION_IMPORTER_PASSWORD'),

        secret('idam-data-store-system-user-username','ROLE_ASSIGNMENT_USER_EMAIL'),
        secret('idam-data-store-system-user-password','ROLE_ASSIGNMENT_USER_PASSWORD')
    ],
    's2s-${env}': [
        secret('microservicekey-ccd-gw', 'CCD_API_GATEWAY_S2S_KEY'),
        secret('microservicekey-ccd-gw', 'BEFTA_S2S_CLIENT_SECRET'),
        secret('microservicekey-aac-manage-case-assignment', 'BEFTA_S2S_CLIENT_SECRET_OF_AAC_MANAGE_CASE_ASSIGNMENT'),
        secret('microservicekey-ccd-data', 'BEFTA_S2S_CLIENT_SECRET_OF_CCD_DATA'),
        secret('microservicekey-xui-webapp', 'BEFTA_S2S_CLIENT_SECRET_OF_XUI_WEBAPP')
    ]
]

static LinkedHashMap<String, Object> secret(String secretName, String envVar) {
    [$class     : 'AzureKeyVaultSecret',
     secretType : 'Secret',
     name       : secretName,
     version    : '',
     envVariable: envVar
    ]
}

def vaultOverrides = [
    'preview' : 'aat',
    'spreview': 'saat'
]
// vars needed for functional tests
// Assume a feature build branched off 'develop', with dependencies develop-to-develop.
env.TEST_URL = "http://ccd-data-store-api-aat.service.core-compute-aat.internal"
// Prevent Docker hub rate limit errors by ensuring that testcontainers uses images from hmctsprod ACR
env.TESTCONTAINERS_HUB_IMAGE_NAME_PREFIX = "hmctsprod.azurecr.io/imported/"

// Other env variables needed for BEFTA.
env.BEFTA_S2S_CLIENT_ID = "ccd_gw"
env.ROLE_ASSIGNMENT_API_GATEWAY_S2S_CLIENT_ID = "ccd_data"
env.BEFTA_S2S_CLIENT_ID_OF_CCD_DATA = "ccd_data"
env.DM_STORE_BASE_URL = "http://dm-store-aat.service.core-compute-aat.internal"
env.CASE_DOCUMENT_AM_URL = "http://ccd-case-document-am-api-aat.service.core-compute-aat.internal"
env.RD_LOCATION_REF_API_BASE_URL = "http://rd-location-ref-api-aat.service.core-compute-aat.internal"
env.RD_PROFESSIONAL_API_BASE_URL = "http://rd-professional-api-aat.service.core-compute-aat.internal"
env.BEFTA_RESPONSE_HEADER_CHECK_POLICY="JUST_WARN" // Temporary workaround for platform changes: turn BEFTA header checks to warning mode
env.ELASTIC_SEARCH_FTA_ENABLED = "true"
env.DEFAULT_COLLECTION_ASSERTION_MODE="UNORDERED"
env.BEFTA_TEST_STUB_SERVICE_BASE_URL = "http://ccd-test-stubs-service-aat.service.core-compute-aat.internal"
env.DEFINITION_STORE_HOST = "http://ccd-definition-store-api-aat.service.core-compute-aat.internal"
// BEFTA retry env variables
env.BEFTA_RETRY_MAX_ATTEMPTS = "3"
env.BEFTA_RETRY_STATUS_CODES = "500,502,503,504"
env.BEFTA_RETRY_MAX_DELAY = "1000"
env.BEFTA_RETRY_NON_RETRYABLE_HTTP_METHODS = "POST,PUT"

withNightlyPipeline(type, product, component) {

    stage('Wait for ccd-definition-store-api job') {
        script {
            echo "Waiting for upstream ccd-definition-store-api job to complete..."
            build job: 'HMCTS_a_to_c_Nightly/ccd-definition-store-api/master', wait: true, propagate: false
        }
    }

    overrideVaultEnvironments(vaultOverrides)
    disableLegacyDeploymentOnAAT()
    loadVaultSecrets(secrets)
    enableDbMigration('ccd')
    disableLegacyDeployment()
    enableHighLevelDataSetup()
    enableFortifyScan()

    afterAlways('fortify-scan') {
        steps.archiveArtifacts allowEmptyArchive: true, artifacts: '**/Fortify Scan/**/*'
    }

    afterAlways('fortify-scan') {

        stage('Suppress and Send Slack Notification') {

            script {
                if (env.CHANGE_ID) {
                    echo "This is a PR: #${env.CHANGE_ID}"
                    echo "Source branch: ${env.CHANGE_BRANCH}"
                    echo "Target branch: ${env.CHANGE_TARGET}"
                } else {
                    echo "Not a pull request — branch: ${env.BRANCH_NAME}"
                }
            }

            def suppressionFile = ''
            script {
                suppressionFile = sh(
                    script: './gradlew printSuppressionFile -q',
                    returnStdout: true
                ).trim().split("=")[1]

                echo "Suppression file and path: ${suppressionFile}"

                sh """
                  echo 'Current contents of ${suppressionFile}:'
                  cat '${suppressionFile}'
                """
            }

            def slackNotificationChannel = '#nightly_cve_suppressions'
            def branch = env.BRANCH_NAME

            if (env.CHANGE_ID) {
                // If this is a PR, push changes to the PR branch
                branch = env.CHANGE_BRANCH
            }

            sh './gradlew suppressCves'

            // Store the list of changed files
            def changedFiles = ''

            // Store the changes in the suppression file
            def changes = ''

            script {
                // Stage all modified tracked files
                sh 'git add -u'

                changedFiles = sh(
                    script: 'git diff --cached --name-only',
                    returnStdout: true
                ).trim().split("\n").findAll { it?.trim() } as List

                echo "List of changed files: ${changedFiles}"

                if (changedFiles.isEmpty()) {
                    echo "No changed files to extract."
                } else {
                    def fileName = sh(
                        script: """
                            echo '${changedFiles}' | tr -d '[]' | xargs basename
                        """,
                        returnStdout: true
                    ).trim()

                    echo "Extracted file name: ${fileName}"
                }

                if (changedFiles.size() == 1 && changedFiles[0] == suppressionFile) {
                    echo "✅ Only suppression file changed. Proceeding..."

                    // Verify it includes CVE-related changes
                    changes = sh(
                        script: """
                          git diff --cached ${suppressionFile} | grep '^+' | grep '<cve>' || true
                        """,
                        returnStdout: true
                    ).trim()

                    if (changes) {
                        echo "✅ CVE-related changes found in suppression file."
                    } else {
                        echo "⚠️ No CVE-related changes detected."
                    }

                } else {
                    echo "✅ Suppression file not changed — marking step as successfull"
                }
            }

            if (changes) {

                // Clean and format CVE lines
                def simplifiedChanges = changes
                    .readLines()
                    .collect { it.replaceFirst(/\+/, '').trim() }                // Remove leading '+'
                    .collect { it.replaceAll(/<\/?[^>]+>/, '') }                 // Strip XML/HTML tags
                //.collect { it.replace('[Ticket]', '<https://yourtracker.example/TICKET-ID|Ticket>') } // Optional link
                    .join('\n')

                def message = """
                                📦 *CVE Suppression File Updated*

                                *Detected CVE changes (Please create Jira backlog ticket):*

                                ${simplifiedChanges}

                                *Build Info:*
                                • *Job*: ${env.JOB_NAME}
                                • *Build*: #${env.BUILD_NUMBER}
                                • *URL*: ${env.BUILD_URL}
                               """.stripIndent().trim()

                slackSend(
                    channel: slackNotificationChannel,
                    color: '#439FE0',
                    message: message
                )

                echo "Staged files: ${changedFiles}"
                echo "Changes: ${changes}"

                echo "Commiting changes into branch ${branch}"
                sh 'git commit -m "Suppressing CVE - Actions"'
                echo "Pushing changes"

                def credentialsId = env.GIT_CREDENTIALS_ID

                withCredentials([
                    gitUsernamePassword(credentialsId: credentialsId, gitToolName: 'Default')
                ]) {
                    sh """
                        git push origin HEAD:${branch}
                    """
                }
            } else {
                echo "✅ Suppression file not changed — skipping Slack notification"
            }
        }
    }

    afterAlways('test') {
        // hmcts/cnp-jenkins-library may fail to copy artifacts after checkstyle error so repeat command (see /src/uk/gov/hmcts/contino/GradleBuilder.groovy)
        steps.archiveArtifacts allowEmptyArchive: true, artifacts: '**/reports/checkstyle/*.html'
    }

    enableFullFunctionalTest(200)

    afterAlways('fullFunctionalTest') {
        steps.archiveArtifacts allowEmptyArchive: true, artifacts: '**/BEFTA Report for Functional Tests/**/*'
    }
    enableSlackNotifications('#ccd-nightly-builds')
}