Jenkinsfile.blackduck

pipeline {
    agent { label 'linux-docker' }
    options {
        timeout(time: 1, unit: 'HOURS')
        disableConcurrentBuilds()
        buildDiscarder(logRotator(artifactNumToKeepStr: '5', numToKeepStr: '20'))
    }
    parameters {
        booleanParam name: "DO_BLACKDUCK_SCAN", description: "Select true to run a blackduck scan. This is only available on trunk and release/* branches."
    }
    environment {
        TAG = "${BRANCH_NAME}-${BUILD_NUMBER}"
        PROJECT_NAME = "esg-grafana"
        VERSION = "3.0"
        QUIET = "yes"
    }
    stages {
        stage('Security Scan'){
            when {
                expression { return params.DO_BLACKDUCK_SCAN }
            }
            steps {
                script {
                    docker.build("perf-analyzer-blackduck", "./blackduck").inside("-u 0") {
                        sh "cd ./plugins/eseries_monitoring/collector && pip --default-timeout=5 --retries 15 install -r requirements.txt"
                        sh "cd ./ansible && pip --default-timeout=5 --retries 15 install -r requirements.txt"

                        // Scan the source code of the project
                        synopsys_detect detectProperties: """
                            --detect.python.python3=true
                            --detect.pip.project.name=${PROJECT_NAME}
                            --detect.pip.project.version.name=${VERSION}
                            --detect.project.name=${PROJECT_NAME}
                            --detect.project.version.name=${VERSION}
                            --detect.cleanup=false
                            --detect.output.path=/tmp/scanTempDir
                            --detect.project.code.location.unmap=true
                            --detect.detector.search.depth=25
                            --detect.code.location.name=${PROJECT_NAME}_${VERSION}_code
                            --detect.bom.aggregate.name=${PROJECT_NAME}_${VERSION}_bom
                            --detect.detector.search.exclusion.paths=scanTempDir
                            --detect.blackduck.signature.scanner.exclusion.patterns=scanTempDir
                        """
                        // This error occurs when using a non-root user within the container:
                        //    Error creating directory /synopsys-detect/download.
                        //    The curl response was 000, which is not successful - please check your configuration and environment.
                        // So after the scan do a chmod on the files so that the workspace can be cleaned.
                        sh "chmod -R 777 ."
                    }

                    // The container images are not published by NetApp and therefore do not need to be scanned.
                    // The Blackduck project will have manual entries added for these component versions.
                    // Keeping this code around just in case scans are needed in the future.
                    //
                    // def images = [
                    //     "${PROJECT_NAME}/ansible:${TAG}",
                    //     "${PROJECT_NAME}/influxdb:${TAG}",
                    //     "${PROJECT_NAME}/grafana:${TAG}",
                    //     "${PROJECT_NAME}-plugin/eseries_monitoring/collector:latest",
                    //     "${PROJECT_NAME}-plugin/eseries_monitoring/webservices:latest"
                    // ]
                    // // For each image, perform the blackduck scan.
                    // images.each() {
                    //     def scanImage = it.substring(it.lastIndexOf("/") + 1, it.lastIndexOf(":"))
                    //     synopsys_detect detectProperties: """
                    //         --detect.project.name=${PROJECT_NAME} \
                    //         --detect.project.version.name=${VERSION} \
                    //         --detect.cleanup=false \
                    //         --detect.output.path=scanTempDir \
                    //         --detect.detector.search.exclusion.paths=scanTempDir/ \
                    //         --detect.detector.search.depth=25 \
                    //         --detect.tools=DOCKER \
                    //         --detect.tools=SIGNATURE_SCAN
                    //         --detect.code.location.name=${PROJECT_NAME}_${VERSION}_container_${scanImage}_code \
                    //         --detect.bom.aggregate.name=${PROJECT_NAME}_${VERSION}_container_${scanImage}_bom \
                    //         --detect.docker.image=${it} \
                    //     """
                    // }
                }
            }
        }
    }
    post {
        always {
            cleanWs deleteDirs: true
        }
    }
}