Jenkinsfile-security

def version = "8.1"
def slackResponse = slackSend(channel: "ci-security", message: "${version} - dependency check - <"+currentBuild.absoluteUrl+"|Link>", color: "#00A8E1")

def errors = []
def running = []

def changeUrl = env.CHANGE_URL


updateSlack(errors, running, slackResponse, version, changeUrl)

// Check vulns in dependencies on repo branches
def failedBuild = false

pipeline {
    agent none
    triggers { cron('@daily') }

    stages {
        stage('deps-webapp') {
            when { not { changeRequest() } }
            agent {
                dockerfile {
                    filename 'webapp/sources/Dockerfile'
                    additionalBuildArgs "--build-arg USER_ID=${JENKINS_UID}"
                    // and share maven cache
                    args '-v /srv/cache/maven:/home/jenkins/.m2'
                }
            }
            steps {
                script {
                    running.add("webapp")
                    updateSlack(errors, running, slackResponse, version, changeUrl)
                }
                catchError(buildResult: 'SUCCESS', stageResult: 'FAILURE') {
                    dir('webapp/sources') {
                        sh script: 'mvn --batch-mode -DfailBuildOnCVSS=7 -DcveValidForHours=48 -DsuppressionFiles=dependency-check-suppression.xml -DossindexAnalyzerEnabled=false org.owasp:dependency-check-maven:aggregate', label: "check webapp dependencies"
                        sh script: 'mvn --batch-mode license:aggregate-third-party-report', label: 'list webapp dependencies'
                    }
                }
            }
            post {

                always {
                    archiveArtifacts artifacts: 'webapp/sources/target/dependency-check-report.html, webapp/sources/target/site/aggregate-third-party-report.html'
                }

                failure {
                    script {
                        errors.add("webapp")
                        webapp = false
                        failedBuild = true
                        //notifier.notifyResult("scala-team")
                        slackSend(channel: slackResponse.threadId, message: "Dependency check error on webapp - <${currentBuild.absoluteUrl}console|Console>", color: "#CC3421")
                    }
                }
                cleanup {
                    script {
                        running.remove("webapp")
                        updateSlack(errors, running, slackResponse, version, changeUrl)
                    }
                }
            }
        }

        stage('deps-npm') {
            when { not { changeRequest() } }
            agent {
                dockerfile {
                    filename 'webapp/sources/Dockerfile'
                    additionalBuildArgs "--build-arg USER_ID=${JENKINS_UID}"
                    // and share maven cache
                    args '-v /srv/cache/maven:/home/jenkins/.m2'
                }
            }
            steps {
                catchError(buildResult: 'SUCCESS', stageResult: 'FAILURE') {
                    dir('webapp/sources/rudder/rudder-web/src/main/') {
                        sh script: 'npm_config_loglevel=error npm ci --no-audit', label: "install dependencies"
                        sh script: 'npx better-npm-audit audit --level high', label: "check npm dependencies"
                    }
                }
            }
            post {
                failure {
                    script {
                        npm = false
                        failedBuild = true
                        //notifier.notifyResult("scala-team")
                        slackSend(channel: slackResponse.threadId, message: "Dependency check error on npm - <${currentBuild.absoluteUrl}console|Console>", color: "#CC3421")
                    }
                }
            }
        }
        stage('deps-rust') {
            when { not { changeRequest() } }
            agent {
                dockerfile {
                    filename 'relay/sources/relayd/Dockerfile'
                    additionalBuildArgs "--build-arg USER_ID=${JENKINS_UID}"
                    // mount cache
                    args '-v /srv/cache/cargo:/usr/local/cargo/registry'
                }
            }
            steps {
                catchError(buildResult: 'SUCCESS', stageResult: 'FAILURE') {
                    sh script: 'mkdir -p target', label: 'create target directory'
                    sh script: 'cargo deny check', label: 'check relayd dependencies'
                    sh script: 'cargo deny list > target/rust-dependencies.txt', label: 'list rust dependencies'
                }
            }
            post {
                failure {
                    script {
                        errors.add("rust")
                        failedBuild = true
                        slackSend(channel: slackResponse.threadId, message: "Dependency check error on rust - <${currentBuild.absoluteUrl}console|Console>", color: "#CC3421")
                        //notifier.notifyResult("rust-team")
                    }
                }

                cleanup {
                    script {
                        running.remove("rust")
                        updateSlack(errors, running, slackResponse, version, changeUrl)
                    }
                }
                always {
                    archiveArtifacts artifacts: 'target/*-dependencies.txt'
                }
            }
        }
        stage('End') {
            steps {
                script {
                    if (failedBuild) {
                        error 'End of build'
                    } else {
                        echo 'End of build '
                    }
                }
            }
        }
    }
}


def updateSlack(errors, running, slackResponse, version, changeUrl) {

echo env.CHANGE_URL

def msg ="*${version} - dependency check* - <"+currentBuild.absoluteUrl+"|Link>"

if (changeUrl != null) {
  msg ="*${version} PR - dependency check* - <"+currentBuild.absoluteUrl+"|Link> - <"+changeUrl+"|Pull request>"
}

def color = "#00A8E1"

if (! errors.isEmpty()) {
    msg += "\n*Errors* :x: ("+errors.size()+")\n  • " + errors.join("\n  • ")
    color = "#CC3421"
}
if (! running.isEmpty()) {
    msg += "\n*Running* :arrow_right: ("+running.size()+")\n  • " + running.join("\n  • ")
}

if (errors.isEmpty() && running.isEmpty()) {
    msg +=  " => All dependencies checked! :white_check_mark:"
	color = "good"
}
  slackSend(channel: slackResponse.channelId, message: msg, timestamp: slackResponse.ts, color: color)
}