mandelstudio/Jenkinsfile

#!/usr/bin/env groovy

pipeline {
    agent { label 'external_pool' }
    options {
        disableConcurrentBuilds()
        skipDefaultCheckout(true)
    }
    environment {
        PYENVPIPELINE_VIRTUALENV = '1'
        GIT_SSH_COMMAND = 'ssh -o StrictHostKeyChecking=accept-new'
        STAGING_AUDIT_PROJECT_NAME = 'mandelstudio'
        STAGING_AUDIT_PROJECT_DIR = '/home/www-mandelstudio/mandelstudio'
        STAGING_AUDIT_MANAGE = '/var/lib/virtualenv/mandelstudio/bin/manage.py'
    }

    stages {
        stage('Checkout') {
            steps {
                withCredentials([sshUserPrivateKey(credentialsId: 'gitea-ssh', keyFileVariable: 'GIT_KEYFILE')]) {
                    sh '''
                        export GIT_SSH_COMMAND="ssh -i $GIT_KEYFILE -o StrictHostKeyChecking=accept-new"
                        if [ -d .git ]; then
                            git remote set-url origin ssh://git@git.mandelblog.com:2222/salt/mandelstudio.git
                            git fetch --tags --force --progress origin +refs/heads/master:refs/remotes/origin/master
                        else
                            git clone ssh://git@git.mandelblog.com:2222/salt/mandelstudio.git .
                            git fetch --tags --force --progress origin +refs/heads/master:refs/remotes/origin/master
                        fi
                        git checkout -f refs/remotes/origin/master
                    '''
                }
            }
        }
        stage('Build') {
            steps {
                withCredentials([sshUserPrivateKey(credentialsId: 'gitea-ssh', keyFileVariable: 'GIT_KEYFILE')]) {
                    sh '''
                        export GIT_SSH_COMMAND="ssh -i $GIT_KEYFILE -o StrictHostKeyChecking=accept-new"
                        if command -v sudo >/dev/null 2>&1 && sudo -n true >/dev/null 2>&1; then
                            sudo apt-get update -y
                            sudo apt-get install -y python3-venv python3-pip make build-essential libpq-dev \
                                libpango-1.0-0 libpangocairo-1.0-0 libcairo2 libgdk-pixbuf-2.0-0 libffi-dev shared-mime-info
                        fi
                        python3 -m venv .venv || {
                            python3 -m pip --version >/dev/null 2>&1 || {
                                curl -fsSL https://bootstrap.pypa.io/get-pip.py -o /tmp/get-pip.py
                                python3 /tmp/get-pip.py --user
                            }
                            python3 -m pip install --user virtualenv
                            python3 -m virtualenv .venv
                        }
                        . .venv/bin/activate
                        pip install coverage
                        pip install --upgrade pip "setuptools==69.5.1" wheel
                        PIP_INDEX_URL=${PIP_INDEX_URL:-https://pypi.mandelblog.com/mandel/testing/+simple/} \
                        PIP_EXTRA_INDEX_URL=${PIP_EXTRA_INDEX_URL:-https://pypi.mandelblog.com/root/pypi/+simple/} \
                        pip install --no-build-isolation --pre --editable . setuptools wheel --upgrade --upgrade-strategy=eager --use-deprecated=legacy-resolver
                        cp "${JOB_BASE_NAME}/ocyan.json" "${JOB_BASE_NAME}/${JOB_BASE_NAME}.json"
                        pip install ruff vdt.versionplugin.wheel
                        pip install --upgrade "setuptools==69.5.1" wheel
                        manage.py migrate --no-input --skip-checks
                        manage.py loaddemodata || true
                        manage.py collectstatic --no-input --verbosity=0
                        pip install "httpx<0.28"
                    '''
                }
            }
        }
        stage('Lint') {
            steps {
                sh '''
                    . .venv/bin/activate
                    pip install coverage ruff
                    make lint
                '''
            }
        }
        stage('Test') {
            steps {
                sh '''
                    . .venv/bin/activate
                    python -m compileall -q setup.py mandelstudio mandelblog_content_guard
                '''
            }
            post {
                always {
                    junit allowEmptyResults: true, testResults: '**/nosetests.xml'
                }
                success {
                    echo "Coverage step skipped"
                }
            }
        }
        stage('Deploy Staging') {
            steps {
                echo 'Triggering staging deploy for mandelstudio after successful CI build.'
                build job: 'deploy-project-stg',
                    wait: true,
                    propagate: true,
                    parameters: [string(name: 'PROJECT_NAME', value: 'mandelstudio')]
            }
        }
        stage('Post-Deploy Multilingual Audit') {
            agent { label 'built-in' }
            options {
                timeout(time: 10, unit: 'MINUTES')
            }
            steps {
                deleteDir()
                checkout scm
                sh 'mkdir -p artifacts && chmod +x scripts/run_remote_multilingual_audit.sh'
                sh './scripts/run_remote_multilingual_audit.sh'
                script {
                    int status = sh(script: 'python3 scripts/multilingual_audit_ci.py --json artifacts/multilingual-audit.json', returnStatus: true)
                    if (status == 2) {
                        error('Block-level multilingual issues detected or audit execution failed.')
                    }
                    if (status == 1) {
                        unstable('Warn-level multilingual issues detected.')
                    }
                }
            }
            post {
                always {
                    archiveArtifacts artifacts: 'artifacts/multilingual-audit.json', onlyIfSuccessful: false
                }
            }
        }
    }
    post {
        always {
            echo 'This will always run'
        }
        success {
            echo 'This will run only if successful'
            sh '''
                . .venv/bin/activate
                    pip install coverage
            '''
        }
        failure {
            emailext subject: "JENKINS-NOTIFICATION: ${currentBuild.currentResult}: Job '${env.JOB_NAME} #${env.BUILD_NUMBER}'",
                    body: '${SCRIPT, template="groovy-text.template"}',
                    recipientProviders: [culprits(), brokenBuildSuspects(), brokenTestsSuspects()]

        }
        unstable {
            echo 'This will run only if the run was marked as unstable'
        }
        changed {
            echo 'This will run only if the state of the Pipeline has changed'
            echo 'For example, if the Pipeline was previously failing but is now successful'
        }
    }
}