# Pipeline-level Variables

These variables are defined at the top of the Jenkinsfile, outside the `pipeline {}` block. They are referenced throughout the pipeline and must be set for every service.

```groovy
String GITHUB_REPOSITORY = '<service-name>'          // matches the GitHub repo name
String ECR_ACCOUNT_ID = '<ecr-account-id>'           // AWS account ID that owns the ECR registry
List<String> AWS_REGIONS = ['us-east-1']             // regions to push/scan images in
String SLACK_NOTIFICATIONS_CHANNEL = '<channel>'     // Slack channel for regression/fixed alerts
String QA_ACCOUNT_ID = '<qa-account-id>'             // AWS account ID for QA deployments
String QA_DEPLOYMENT_ROLE = '<qa-role-name>'         // IAM role to assume when deploying to QA
String PROD_ACCOUNT_ID = '<prod-account-id>'         // AWS account ID for prod deployments
String PROD_DEPLOYMENT_ROLE = '<prod-role-name>'     // IAM role to assume when deploying to prod
List<String> VULNERABILITIES_TO_IGNORE = []          // CVE IDs to suppress in dockerScan (keep minimal)
```

## Naming conventions

| Service type | `GITHUB_REPOSITORY` pattern | ECR image name |
|---|---|---|
| Fargate (OWS) | `ows-<repo-name>` | same as `GITHUB_REPOSITORY` |
| Lambda mono-repo | `lambda-<repo-name>` | `lambda-<function-name>` (underscores → hyphens) |

## Notes

- `AWS_REGIONS` is a list to support multi-region deployments; most services use `['us-east-1']` only.
- `ECR_ACCOUNT_ID` is used by both `dockerToEcr` and `dockerScan`. It identifies where images are stored, which may differ from the deployment target accounts.
- `QA_ACCOUNT_ID` / `PROD_ACCOUNT_ID` are the accounts the deployment role is assumed *into*. They are separate from `ECR_ACCOUNT_ID`.
- `VULNERABILITIES_TO_IGNORE` is passed to `dockerScan`. Keep this list as short as possible and document a reason for each suppressed CVE in a comment next to the entry.