String GITHUB_REPOSITORY = 'prisma-cloud-defender'
String ECR_ACCOUNT_ID = '086679231553'
List<String> AWS_REGIONS = ['us-east-1']
String SLACK_NOTIFICATIONS_CHANNEL = '#devops'

pipeline {
    agent any

    options {
        ansiColor('xterm')
        disableConcurrentBuilds()
        skipDefaultCheckout()
        timestamps()
    }

    parameters {
        string(name: 'SHARED_LIBRARIES_VERSION', defaultValue: 'master', description: 'The version of the Jenkins shared libraries to use. Can be a branch, tag or Git revision.')
    }

    triggers {
        issueCommentTrigger('.*retest this please.*')
    }

    stages {
        stage('Checkout') {
            steps {
                script {
                    cleanWs()
                    def scmVars = checkout scm
                    // Set SCM vars as environment variables to replicate default checkout functionality
                    scmVars.each { k, v ->
                        env."${k}" = v
                    }
                }
            }
        }
        stage('Load Shared Libraries') {
            steps {
                library "jenkins-global-libraries@${params.SHARED_LIBRARIES_VERSION}"
            }
        }
        stage('Compliance Checks') {
            steps {
                complianceChecks()
            }
        }
        stage('Static Application Security Tests') {
            steps {
                sastTests()
            }
        }
        stage('Create a Release') {
            steps {
                dockerToEcr awsRegions: AWS_REGIONS, ecrAccountId: ECR_ACCOUNT_ID, imageName: GITHUB_REPOSITORY, imageTag: env.GIT_COMMIT,
                    pushLatest: (env.BRANCH_NAME == 'master')
            }
        }
        stage('Scan Docker Image') {
            steps {
                dockerScan awsRegion: AWS_REGIONS[0],
                           ecrAccountId: ECR_ACCOUNT_ID,
                           imageName: GITHUB_REPOSITORY,
                           imageTag: env.GIT_COMMIT,
                           vulnerabilitiesToIgnore: [
                             'CVE-2024-3056',
                             'CVE-2025-4953',
                             'CVE-2025-46569',
                             'CVE-2025-66506',
                             'CVE-2026-24051',
                             'CVE-2026-33186',
                             // TODO: Remove once defender image is bumped beyond 34.04.160 (requires RHEL 9.8 base + updated Go deps)
                             'CVE-2026-33845',
                             'CVE-2026-39821',
                             'CVE-2026-39830',
                             'CVE-2026-39831',
                             'CVE-2026-39832',
                             'CVE-2026-39833',
                             'CVE-2026-39834',
                             'CVE-2026-42010',
                             'CVE-2026-42508',
                             'CVE-2026-46595',
                             'CVE-2026-2100',
                             'CVE-2026-29181',
                             'CVE-2026-33414',
                             'CVE-2026-33811',
                             'CVE-2026-33814',
                             'CVE-2026-33846',
                             'CVE-2026-33997',
                             'CVE-2026-34040',
                             'CVE-2026-34986',
                             'CVE-2026-35469',
                             'CVE-2026-3833',
                             'CVE-2026-39820',
                             'CVE-2026-39829',
                             'CVE-2026-39836',
                             'CVE-2026-39883',
                             'CVE-2026-4046',
                             'CVE-2026-42009',
                             'CVE-2026-42011',
                             'CVE-2026-42012',
                             'CVE-2026-42013',
                             'CVE-2026-42499',
                             'CVE-2026-4437',
                             'CVE-2026-45186',
                             'CVE-2026-46597',
                             'CVE-2026-4878',
                             'CVE-2026-5260',
                             'GHSA-fqw6-gf59-qr4w'
                           ]
            }
        }
    }

    post {
        regression {
            script {
                if (env.BRANCH_NAME == 'master') {
                    slackNotify channel: SLACK_NOTIFICATIONS_CHANNEL
                }
            }
        }
        fixed {
            script {
                if (env.BRANCH_NAME == 'master') {
                    slackNotify channel: SLACK_NOTIFICATIONS_CHANNEL
                }
            }
        }
    }
}