String GITHUB_REPOSITORY = 'orchard-datadog-agent'
String ECR_ACCOUNT_ID = '086679231553'
List<String> AWS_REGIONS = ['us-east-1']
String PROD_ACCOUNT_ID = '437795906767'
String PROD_DEPLOYMENT_ROLE = 'prod-jenkins-aws-pipeline-agent'
String SLACK_NOTIFICATIONS_CHANNEL = '#devops'

PROD_SERVICES = [
    [serviceName: 'datadog-agent-mysql-direct-delivery', imageName: "${GITHUB_REPOSITORY}-mysql"],
    [serviceName: 'datadog-agent-mysql-art-relations', imageName: "${GITHUB_REPOSITORY}-mysql"],
]

List<String> COMMON_VULNERABILITIES_TO_IGNORE = [
    'CVE-2026-48526',    // pyjwt-2.12.1.dist-info - requires new agent release
    'CVE-2026-42504',    // pkg:generic/trace-loader?go_toolchain=1.25.10 - requires new agent release
]

pipeline {
    agent any

    options {
        ansiColor('xterm')
        disableConcurrentBuilds()
        timestamps()
    }

    parameters {
        string(name: 'SHARED_LIBRARIES_VERSION', defaultValue: 'master', description: 'The version of the Jenkins shared libraries to use. Can be a branch, tag or Git revision.')
    }

    triggers {
        issueCommentTrigger('.*retest this please.*')
    }

    stages {
        stage('Load Shared Libraries') {
            steps {
                library "jenkins-global-libraries@${params.SHARED_LIBRARIES_VERSION}"
            }
        }
        stage('Compliance Checks') {
            steps {
                complianceChecks()
            }
        }
        stage('Validate Software Catalog Definitions') {
            steps {
                script {
                    parallel(PROD_SERVICES.collectEntries { service ->
                        return [
                            (service.serviceName): {
                                echo "Validating Software Catalog definition for ${service.serviceName}"
                                datadogSoftwareCatalogValidate(
                                    serviceDefinitionFilePath: "mysql/software_catalog/${service.serviceName}.yaml",
                                    servicePath: 'mysql'
                                )
                            }
                        ]
                    })
                }
            }
        }
        stage('Static Application Security Tests') {
            steps {
                sastTests()
            }
        }
        stage('Create a Release') {
            steps {
                dockerToEcr awsRegions: AWS_REGIONS,
                    ecrAccountId: ECR_ACCOUNT_ID,
                    imageName: GITHUB_REPOSITORY,
                    imageTag: env.GIT_COMMIT,
                    pushLatest: false
            }
        }
        stage('Scan orchard-datadog-agent') {
            steps {
                dockerScan awsRegion: AWS_REGIONS[0],
                ecrAccountId: ECR_ACCOUNT_ID, imageName: GITHUB_REPOSITORY,
                imageTag: env.GIT_COMMIT,
                vulnerabilitiesToIgnore: COMMON_VULNERABILITIES_TO_IGNORE
            }
        }
        stage('Push orchard-datadog-agent image as Latest'){
            when {
                branch 'master'
            }
            environment {
                AWS_DEFAULT_REGION = "${AWS_REGIONS[0]}"
                ECR_ACCOUNT_ID = "${ECR_ACCOUNT_ID}"
                ECR = "${GITHUB_REPOSITORY}"
                GIT_COMMIT = "${env.GIT_COMMIT}"
            }
            steps{
                script {
                    sh './push_image_as_latest.sh'
                }
            }
        }
        stage('Create Integration Releases') {
            parallel {
                stage('Create a JMX Integration Release') {
                    steps {
                        dockerToEcr awsRegions: AWS_REGIONS,
                            ecrAccountId: ECR_ACCOUNT_ID,
                            imageName: "${GITHUB_REPOSITORY}-jmx",
                            imageTag: env.GIT_COMMIT,
                            dockerBuildFile: './jmx/Dockerfile',
                            dockerBuildContext: './jmx',
                            pushLatest: false
                    }
                }
                stage('Create an SNMP Integration Release') {
                    steps {
                        dockerToEcr awsRegions: AWS_REGIONS,
                            ecrAccountId: ECR_ACCOUNT_ID,
                            imageName: "${GITHUB_REPOSITORY}-snmp",
                            imageTag: env.GIT_COMMIT,
                            dockerBuildFile: './snmp/Dockerfile',
                            dockerBuildContext: './snmp',
                            dockerBuildArgs: [
                                'BASE_IMAGE_TAG': env.GIT_COMMIT
                            ],
                            pushLatest: false
                    }
                }
                stage('Create a MySQL Integration Release') {
                    steps {
                        dockerToEcr awsRegions: AWS_REGIONS,
                            ecrAccountId: ECR_ACCOUNT_ID,
                            imageName: "${GITHUB_REPOSITORY}-mysql",
                            imageTag: env.GIT_COMMIT,
                            dockerBuildFile: './mysql/Dockerfile',
                            dockerBuildContext: './mysql',
                            dockerBuildArgs: [
                                'BASE_IMAGE_TAG': env.GIT_COMMIT
                            ],
                            pushLatest: false
                    }
                }
            }
        }
        stage('Scan Docker Image') {
            parallel {
                stage('Scan orchard-datadog-agent-jmx') {
                    steps {
                        dockerScan awsRegion: AWS_REGIONS[0],
                        ecrAccountId: ECR_ACCOUNT_ID, imageName: "${GITHUB_REPOSITORY}-jmx",
                        imageTag: env.GIT_COMMIT,
                        vulnerabilitiesToIgnore: COMMON_VULNERABILITIES_TO_IGNORE
                    }
                }
                stage('Scan orchard-datadog-agent-snmp') {
                    steps {
                        dockerScan awsRegion: AWS_REGIONS[0],
                        ecrAccountId: ECR_ACCOUNT_ID, imageName: "${GITHUB_REPOSITORY}-snmp",
                        imageTag: env.GIT_COMMIT,
                        vulnerabilitiesToIgnore: COMMON_VULNERABILITIES_TO_IGNORE
                    }
                }
                stage('Scan orchard-datadog-agent-mysql') {
                    steps {
                        dockerScan awsRegion: AWS_REGIONS[0],
                        ecrAccountId: ECR_ACCOUNT_ID, imageName:"${GITHUB_REPOSITORY}-mysql",
                        imageTag: env.GIT_COMMIT,
                        vulnerabilitiesToIgnore: COMMON_VULNERABILITIES_TO_IGNORE
                    }
                }
            }
        }

        stage('Push Image as Latest'){
            environment {
                AWS_DEFAULT_REGION = "${AWS_REGIONS[0]}"
                ECR_ACCOUNT_ID = "${ECR_ACCOUNT_ID}"
                GIT_COMMIT = "${env.GIT_COMMIT}"
            }
            when {
                branch 'master'
            }
            parallel {
                stage('Push orchard-datadog-agent-jmx as latest') {
                    environment {
                        ECR = "${GITHUB_REPOSITORY}-jmx"
                    }
                    steps{
                        script {
                            sh './push_image_as_latest.sh'
                        }
                    }
                }
                stage('Push orchard-datadog-agent-snmp as latest') {
                    environment {
                        ECR = "${GITHUB_REPOSITORY}-snmp"
                    }
                    steps{
                        script {
                            sh './push_image_as_latest.sh'
                        }
                    }
                }
                stage('Push orchard-datadog-agent-mysql as latest') {
                    environment {
                        ECR = "${GITHUB_REPOSITORY}-mysql"
                    }
                    steps{
                        script {
                            sh './push_image_as_latest.sh'
                        }
                    }
                }
            }
        }
        stage('Deploy to Prod') {
            when {
                branch 'master'
            }
            steps {
                script {
                    parallel(PROD_SERVICES.collectEntries {service ->
                        [
                            (service.serviceName): {
                                fargateDeploy environment: 'prod',
                                    awsRegions: AWS_REGIONS,
                                    gitCommit: env.GIT_COMMIT,
                                    serviceName: service.serviceName,
                                    ecrRegistryAccountId: ECR_ACCOUNT_ID,
                                    imageNameOverride: service.imageName,
                                    awsDeploymentTargetAccountId: PROD_ACCOUNT_ID,
                                    awsDeploymentRoleName: PROD_DEPLOYMENT_ROLE,
                                    updateTimeout: 600
                            }
                        ]
                    })
                }
            }
        }
        stage('Publish Software Catalog Definition') {
            when {
                allOf {
                    branch 'master'
                }
            }
            steps {
                script {
                    parallel(PROD_SERVICES.collectEntries { service ->
                        return [
                            (service.serviceName): {
                                echo "Publishing Software Catalog definition for ${service.serviceName}"
                                datadogSoftwareCatalogPublish(
                                    serviceDefinitionFilePath: "mysql/software_catalog/${service.serviceName}.yaml",
                                    servicePath: 'mysql'
                                )
                            }
                        ]
                    })
                }
            }
        }
    }

    post {
        regression {
            script {
                if (env.BRANCH_NAME == 'master') {
                    slackNotify channel: SLACK_NOTIFICATIONS_CHANNEL
                }
            }
        }
        fixed {
            script {
                if (env.BRANCH_NAME == 'master') {
                    slackNotify channel: SLACK_NOTIFICATIONS_CHANNEL
                }
            }
        }
    }
}