Agentes efêmeros
e deploy sem susto.

# =========================================================================
# 1. PREPARAÇÃO DE UM AGENTE LINUX PARA CONEXÃO SSH (No servidor Agente)
# =========================================================================
sudo useradd -m -d /var/jenkins_agent -s /bin/bash jenkins_agent
sudo apt-get update && sudo apt-get install -y openjdk-17-jre-headless git
sudo mkdir -p /var/jenkins_agent/.ssh
# Adicione a chave pública do Controller em /var/jenkins_agent/.ssh/authorized_keys
sudo chmod 700 /var/jenkins_agent/.ssh && sudo chmod 600 /var/jenkins_agent/.ssh/authorized_keys
sudo chown -R jenkins_agent:jenkins_agent /var/jenkins_agent

# =========================================================================
# 2. EXECUÇÃO DE UM AGENTE INBOUND (JNLP / WebSocket) — Seção 3.9.1
# =========================================================================
curl -sO http://jenkins.empresa.com.br:8080/jnlpJars/agent.jar
java -jar agent.jar \
  -url https://jenkins.empresa.com.br/ \
  -webSocket \
  -secret @/etc/jenkins/agent-secret.txt \
  -name "agent-mobile-android-01" \
  -workDir "/var/jenkins_agent"

# =========================================================================
# 3. JENKINSFILE ORQUESTRANDO MÚLTIPLOS AGENTES POR EXPRESSÃO DE LABELS
# =========================================================================
pipeline {
    agent none // Nenhum agente global: cada stage aloca apenas o nó necessário!
    stages {
        stage('1. Compilação Backend Linux') {
            agent { label 'linux && jdk17' }
            steps {
                sh 'mvn clean package -DskipTests'
                // Stash guarda os artefatos compilados no Controller para usar em outro agente!
                stash includes: 'target/*.war', name: 'pacote-compilado'
            }
        }
        stage('2. Validação Cross-Platform Windows & Mobile') {
            parallel {
                stage('Teste Cliente Windows') {
                    agent { label 'windows && dotnet8' }
                    steps {
                        unstash 'pacote-compilado'
                        bat 'dir target\\'
                    }
                }
                stage('Teste Emulador Mobile') {
                    agent { label 'macos && ios-emulator' }
                    steps {
                        sh 'xcrun simctl list devices'
                    }
                }
            }
        }
    }
}

// Pipeline de produção usando Agente Efêmero Kubernetes com 4 contêineres especialistas no mesmo Pod:
// 1. maven (compilação e testes com volume de cache persistente .m2)
// 2. hadolint (auditoria do Dockerfile)
// 3. kaniko (build e push da imagem Docker SEM precisar expor /var/run/docker.sock ou root!)
// 4. trivy (scan de vulnerabilidades da imagem antes do deploy)
pipeline {
    agent {
        kubernetes {
            cloud 'k8s-prod-cluster'
            yaml '''
apiVersion: v1
kind: Pod
metadata:
  labels:
    app: jenkins-ephemeral-agent
spec:
  ServiceAccountName: jenkins-agent-sa
  containers:
  - name: maven
    image: maven:3.9.6-eclipse-temurin-17
    command: ['cat']
    tty: true
    volumeMounts:
    - name: m2-cache
      mountPath: /root/.m2
    resources:
      requests: { cpu: "500m", memory: "1Gi" }
      limits:   { cpu: "2",    memory: "3Gi" }
  - name: hadolint
    image: hadolint/hadolint:latest-debian
    command: ['cat']
    tty: true
  - name: kaniko
    image: gcr.io/kaniko-project/executor:debug
    command: ['/busybox/cat']
    tty: true
  - name: trivy
    image: aquasec/trivy:latest
    command: ['cat']
    tty: true
  volumes:
  - name: m2-cache
    persistentVolumeClaim:
      claimName: jenkins-maven-cache-pvc
'''
        }
    }
    stages {
        stage('1. Compile & Unit Tests (Container Maven)') {
            steps {
                container('maven') {
                    checkout scm
                    sh 'mvn clean package'
                }
            }
        }
        stage('2. Dockerfile Lint (Container Hadolint)') {
            steps {
                container('hadolint') {
                    sh 'hadolint Dockerfile --no-fail -f json > hadolint.json'
                }
            }
        }
        stage('3. Build & Push OCI Image Rootless (Container Kaniko)') {
            steps {
                container(name: 'kaniko', shell: '/busybox/sh') {
                    sh """
                        /kaniko/executor \\
                          --context=\$(pwd) \\
                          --dockerfile=Dockerfile \\
                          --destination=registry.interno:5000/opstree/spring3hibernate:${env.BUILD_ID} \\
                          --cache=true
                    """
                }
            }
        }
        stage('4. Container CVE Scan (Container Trivy)') {
            steps {
                container('trivy') {
                    sh "trivy image --exit-code 1 --severity CRITICAL registry.interno:5000/opstree/spring3hibernate:${env.BUILD_ID}"
                }
            }
        }
    }
}

// Pipeline Orquestrador de Promoção CD (Figura 8.1 do livro):
// Garante que a mesma imagem imutável avance por QA -> Security -> Performance (Efêmero) -> UAT -> Prod
pipeline {
    agent { label 'cd-orchestrator' }
    parameters {
        string(name: 'RELEASE_VERSION', defaultValue: 'v1.2.0', description: 'Versão imutável já aprovada no CI')
    }
    stages {
        stage('1. Promoção para QA & Sign-off Funcional') {
            steps {
                build job: 'CD/01-deploy-qa-normal', parameters: [string(name: 'VERSION', value: params.RELEASE_VERSION)]
                build job: 'CD/01b-run-selenium-cucumber-qa'
            }
        }
        stage('2. Promoção para Security & Scan DAST') {
            steps {
                build job: 'CD/02-deploy-security-rolling', parameters: [string(name: 'NEW_VERSION', value: params.RELEASE_VERSION)]
                build job: 'CD/02b-run-owasp-zap-dast'
            }
        }
        stage('3. Ambiente Efêmero de Performance (Provision -> Test -> Teardown)') {
            steps {
                script {
                    try {
                        echo "Provisionando infraestrutura dinâmica de Performance para ${params.RELEASE_VERSION}..."
                        sh 'ansible-playbook -i hosts/perf_inventory.ini playbooks/provision_perf_env.yml -e state=present'
                        build job: 'CD/03-deploy-perf-bluegreen', parameters: [string(name: 'GREEN_VERSION', value: params.RELEASE_VERSION)]
                        build job: 'CD/03b-run-jmeter-loadtest'
                    } finally {
                        echo 'Desligando ambiente dinâmico de Performance para zerar custos ociosos (Seção 7.1.3)...'
                        sh 'ansible-playbook -i hosts/perf_inventory.ini playbooks/provision_perf_env.yml -e state=absent'
                    }
                }
            }
        }
        stage('4. Promoção para UAT (Alpha/Beta Canary)') {
            steps {
                build job: 'CD/04-deploy-uat-canary', parameters: [string(name: 'CANARY_VERSION', value: params.RELEASE_VERSION)]
            }
        }
        stage('5. Portão de Aprovação e Release em Produção') {
            steps {
                timeout(time: 24, unit: 'HOURS') {
                    input message: "UAT aprovado pelo Negócio. Autorizar Canary de ${params.RELEASE_VERSION} em Produção?",
                          submitter: 'sajal-po,adeel-lead'
                }
                build job: 'CD/05-deploy-prod-canary', parameters: [string(name: 'CANARY_VERSION', value: params.RELEASE_VERSION)]
            }
        }
    }
}

// =========================================================================
// 1. ARQUIVO GHERKIN: src/test/resources/features/teleconsulta.feature (Seção 7.2.2)
// =========================================================================
Feature: Agendamento e Triagem na Plataforma de Telemedicina
  Scenario: Paciente agenda consulta com especialista disponível
    Given que o paciente acessa o portal de teleconsulta autenticado
    When ele filtra pela especialidade "Cardiologia" e escolhe o horário "14:00"
    Then o agendamento é confirmado com status "CONFIRMADO" e link da sala de vídeo

// =========================================================================
// 2. CONFIGURAÇÃO SELENIUM HEADLESS EM CONTAINER LINUX (Sem erro de memória /dev/shm)
// =========================================================================
// ChromeOptions options = new ChromeOptions();
// options.addArguments("--headless=new", "--no-sandbox", "--disable-dev-shm-usage", "--window-size=1920,1080");
// WebDriver driver = new ChromeDriver(options);

// =========================================================================
// 3. ESTÁGIOS NO JENKINSFILE: REGRESSÃO + BDD EM QA E OWASP ZAP EM SEGURANÇA
// =========================================================================
stage('Post-Deployment Validation | QA (Selenium + Cucumber) & Security (OWASP ZAP)') {
    parallel {
        stage('QA: Regression & Cucumber BDD (Headless)') {
            agent {
                docker {
                    image 'markhobson/maven-chrome:jdk-17'
                    args '--shm-size=2g -v $HOME/.m2:/root/.m2'
                }
            }
            steps {
                sh '''
                    mvn test-compile failsafe:integration-test \
                      -Dbrowser=chrome-headless \
                      -Dapp.base.url=http://qa-spring.opstree.com \
                      -Dcucumber.plugin="json:target/cucumber.json,html:target/cucumber-report.html"
                '''
            }
            post {
                always {
                    junit 'target/failsafe-reports/*.xml'
                    publishHTML([
                        allowMissing: false,
                        alwaysLinkToLastBuild: true,
                        keepAll: true,
                        reportDir: 'target',
                        reportFiles: 'cucumber-report.html',
                        reportName: 'Cucumber BDD Acceptance Report'
                    ])
                }
            }
        }
        stage('Security Env: OWASP ZAP Active & Passive DAST') {
            agent {
                docker {
                    image 'ghcr.io/zaproxy/zaproxy:stable'
                    args '-u root'
                }
            }
            steps {
                sh '''
                    mkdir -p zap-output
                    # Executa spider + varredura passiva e ativa contra o Ambiente de Segurança:
                    zap-full-scan.py \
                      -t http://sec-spring.opstree.com \
                      -m 5 \
                      -r zap-output/owasp-zap-dast.html \
                      -J zap-output/owasp-zap-dast.json \
                      -I
                '''
            }
            post {
                always {
                    publishHTML([
                        allowMissing: false,
                        alwaysLinkToLastBuild: true,
                        keepAll: true,
                        reportDir: 'zap-output',
                        reportFiles: 'owasp-zap-dast.html',
                        reportName: 'OWASP ZAP DAST Security Report'
                    ])
                }
            }
        }
    }
}

// Estágio completo de validação de API (SoapUI) e Carga (Apache JMeter) com portão automático de SLA:
stage('CD API & Performance Validation') {
    steps {
        // 1. Execução Headless dos testes funcionais e de segurança de API no SoapUI:
        sh '''
            /opt/soapui/bin/testrunner.sh \
              -s"Telemedicina_API_Suite" \
              -r -j -f target/soapui-reports \
              -PhostUrl=http://green-pt-spring.opstree.com \
              tests/api/Telemedicina-soapui-project.xml
        '''
        // 2. Execução do Teste de Carga no Apache JMeter em modo Non-GUI (-n) com parâmetros dinâmicos (-J):
        sh '''
            rm -rf target/jmeter-results.jtl target/jmeter-dashboard
            jmeter -n \
              -t tests/performance/teleconsulta_load_test.jmx \
              -JtargetHost=green-pt-spring.opstree.com \
              -JtargetPort=80 \
              -JvirtualUsers=150 \
              -JrampUpSeconds=30 \
              -JdurationSeconds=180 \
              -l target/jmeter-results.jtl \
              -e -o target/jmeter-dashboard
        '''
        // 3. Portão Automatizado em Python que analisa o arquivo .jtl do JMeter e reprova o pipeline se violar o SLA:
        sh '''
            python3 - <<'PY'
            import csv, sys

            tempos, total, erros = [], 0, 0
            with open("target/jmeter-results.jtl", "r", encoding="utf-8") as f:
                for row in csv.DictReader(f):
                    total += 1
                    tempos.append(int(row["elapsed"]))
                    if row["success"].lower() != "true":
                        erros += 1

            tempos.sort()
            p95 = tempos[int(len(tempos) * 0.95) - 1] if tempos else 0
            taxa_erro = (erros / total * 100) if total else 0
            print(f"[JMeter Gate] Amostras={total} | Latência p95={p95}ms (SLA <=350ms) | Taxa de Erro={taxa_erro:.2f}% (SLA <=0.50%)")
            if p95 > 350 or taxa_erro > 0.50:
                sys.exit("REPROVADO NO GATE DE PERFORMANCE: Latência ou taxa de erro acima do limite!")
            PY
        '''
    }
    post {
        always {
            junit 'target/soapui-reports/*.xml'
            publishHTML([
                allowMissing: false,
                alwaysLinkToLastBuild: true,
                keepAll: true,
                reportDir: 'target/jmeter-dashboard',
                reportFiles: 'index.html',
                reportName: 'JMeter Load Test Dashboard'
            ])
        }
    }
}

# =========================================================================
# 1. INFRAESTRUTURA DO LOAD BALANCER TRAEFIK: docker-compose.yml (Código 8.1)
# =========================================================================
version: "3.3"
services:
  traefik:
    image: "traefik:v2.8"
    container_name: "traefik"
    command:
      - "--api.insecure=true"
      - "--providers.docker=true"
      - "--providers.docker.exposedbydefault=false"
      - "--entrypoints.web.address=:80"
    ports:
      - "80:80"
      - "8080:8080"
    volumes:
      - "/var/run/docker.sock:/var/run/docker.sock:ro"
    network_mode: bridge
# Subir com: docker compose up -d (Código 8.2)

// =========================================================================
// 2. JENKINSFILE — NORMAL / RECREATE DEPLOYMENT EM QA (Código 8.3)
// =========================================================================
node("deployment") {
    properties([parameters([string(defaultValue: 'latest', name: 'VERSION', trim: true)])])
    stage("Cloning codebase for QA Deployment") {
        checkout scm
    }
    stage("Deploying the ${VERSION} on QA Environment") {
        sh """
            if ! sudo docker inspect spring3hibernate > /dev/null 2>&1
            then
                sudo docker run -itd --name spring3hibernate --label traefik.enable=true \\
                  --label 'traefik.http.routers.spring3hibernate.rule=Host(`qa-spring.opstree.com`)' \\
                  --label "traefik.port=8080" opstree/spring3hibernate:${VERSION}
            else
                sudo docker rm -f spring3hibernate
                sudo docker run -itd --name spring3hibernate --label traefik.enable=true \\
                  --label 'traefik.http.routers.spring3hibernate.rule=Host(`qa-spring.opstree.com`)' \\
                  --label "traefik.port=8080" opstree/spring3hibernate:${VERSION}
            fi
        """
    }
}

// =========================================================================
// 3. JENKINSFILE — ROLLING DEPLOYMENT COM HEALTH CHECK EM SEGURANÇA (Código 8.4)
// =========================================================================
node("deployment") {
    properties([parameters([
        string(defaultValue: 'v1.0', name: 'OLDER_VERSION', trim: true),
        string(defaultValue: 'v1.1', name: 'NEW_VERSION',   trim: true)
    ])])
    stage("Cloning codebase for Security Environment Deployment") {
        checkout scm
    }
    stage("Deploying the ${NEW_VERSION} on Security Environment") {
        sh """
            sudo docker run -itd --name spring3hibernate-${NEW_VERSION} opstree/spring3hibernate:${NEW_VERSION}
        """
    }
    stage("Validating the ${NEW_VERSION}") {
        sh """
            sleep 10s
            NEW_IP=\$(sudo docker inspect -f '{{range.NetworkSettings.Networks}}{{.IPAddress}}{{end}}' spring3hibernate-${NEW_VERSION})
            response=\$(curl --write-out '%{http_code}' --silent --output /dev/null http://\${NEW_IP}:8080)
            if [ "\${response}" != "200" ]; then
                echo "Application is not working fine (HTTP \${response})"
                sudo docker rm -f spring3hibernate-${NEW_VERSION}
                exit 1
            fi
        """
    }
    stage("Add the new version to load balancer") {
        sh """
            sudo docker rm -f spring3hibernate-${NEW_VERSION}
            sudo docker run -itd --name spring3hibernate-${NEW_VERSION} --label traefik.enable=true \\
              --label 'traefik.http.routers.spring3hibernate.rule=Host(`sec-spring.opstree.com`)' \\
              --label "traefik.port=8080" opstree/spring3hibernate:${NEW_VERSION}
        """
    }
    stage("Removing old version") {
        sh """
            sudo docker rm -f spring3hibernate-${OLDER_VERSION} || true
        """
    }
}

// =========================================================================
// 1. ARQUIVO: blue-green-performance/green-update.json (Cut-Over para Green)
// =========================================================================
{
  "Comment": "Cut-over de trafego para a nova versao Green",
  "Changes": [{
    "Action": "UPSERT",
    "ResourceRecordSet": {
      "Name": "pt-spring.opstree.com.",
      "Type": "CNAME",
      "TTL": 15,
      "ResourceRecords": [{ "Value": "green-pt-spring.opstree.com" }]
    }
  }]
}

// =========================================================================
// 2. ARQUIVO: blue-green-performance/blue-update.json (Rollback para Blue)
// =========================================================================
{
  "Comment": "Rollback imediato de trafego para a versao estavel Blue",
  "Changes": [{
    "Action": "UPSERT",
    "ResourceRecordSet": {
      "Name": "pt-spring.opstree.com.",
      "Type": "CNAME",
      "TTL": 15,
      "ResourceRecords": [{ "Value": "blue-pt-spring.opstree.com" }]
    }
  }]
}

// =========================================================================
// 3. JENKINSFILE — BLUE/GREEN DEPLOYMENT COMPLETO (Código 8.5 do Capítulo 8)
// =========================================================================
node("deployment") {
    properties([parameters([
        string(defaultValue: 'v1.1', name: 'GREEN_VERSION', trim: true, description: 'Green is newer version'),
        string(defaultValue: 'v1.0', name: 'BLUE_VERSION',  trim: true, description: 'Blue is older version')
    ])])
    stage("Cloning codebase for Performance Environment Deployment") {
        checkout scm
    }
    stage("Deploying the Green version on PT Environment") {
        sh """
            sudo docker rm -f spring3hibernate-green || true
            sudo docker run -itd --name spring3hibernate-green --label traefik.enable=true \\
              --label 'traefik.http.routers.spring3hibernate-green.rule=Host(`green-pt-spring.opstree.com`)' \\
              --label "traefik.port=8080" opstree/spring3hibernate:${GREEN_VERSION}
        """
    }
    stage("Pause pipeline for Green version validation") {
        input 'Do you want to proceed further?'
    }
    stage("Cut-over of traffic on Green version from Blue version") {
        sh """
            aws route53 change-resource-record-sets --hosted-zone-id Z10166071X5VNARP9PUCV \\
              --change-batch file://blue-green-performance/green-update.json
        """
    }
    stage("Validation of Performance Testing Environment") {
        returnValue = input message: 'Do you want to proceed further?',
                            parameters: [choice(choices: ['Rollback', 'Proceed'], name: 'action')]
    }
    if ("${returnValue}" == "Rollback") {
        stage("Rollback in case of failure") {
            sh """
                aws route53 change-resource-record-sets --hosted-zone-id Z10166071X5VNARP9PUCV \\
                  --change-batch file://blue-green-performance/blue-update.json
            """
        }
    } else if ("${returnValue}" == "Proceed") {
        stage("Live the traffic") {
            sh """
                sudo docker rm -f spring3hibernate-green
                sudo docker rm -f spring3hibernate-blue || true
                sudo docker run -itd --name spring3hibernate-blue --label traefik.enable=true \\
                  --label 'traefik.http.routers.spring3hibernate-blue.rule=Host(`blue-pt-spring.opstree.com`)' \\
                  --label "traefik.port=8080" opstree/spring3hibernate:${GREEN_VERSION}
            """
        }
    }
}

// Jenkinsfile completo reproduzindo o Código 8.6 (Capítulos 8.5 e 8.6) para UAT e Produção:
node("deployment") {
    properties([parameters([
        string(defaultValue: 'v1.0', name: 'BASELINE_VERSION', trim: true, description: 'Older stable version (90% traffic)'),
        string(defaultValue: 'v1.1', name: 'CANARY_VERSION',   trim: true, description: 'Newer canary version (10% traffic)')
    ])])
    stage("Cloning codebase for UAT/Prod Environment Deployment") {
        checkout scm
    }
    stage("Deploy the Canary version (10%) alongside Baseline (90%)") {
        sh """
            sudo docker rm -f spring3hibernate-canary || true
            sudo docker run -itd --name spring3hibernate-canary --label traefik.enable=true \\
              --label 'traefik.http.routers.spring3hibernate-canary.rule=Host(`uat-spring.opstree.com`)' \\
              --label "traefik.port=8080" --label "traefik.weight=10" --label "traefik.backend=app_weighted" \\
              opstree/spring3hibernate:${CANARY_VERSION}

            sudo docker rm -f spring3hibernate-baseline || true
            sudo docker run -itd --name spring3hibernate-baseline --label traefik.enable=true \\
              --label 'traefik.http.routers.spring3hibernate-baseline.rule=Host(`uat-spring.opstree.com`)' \\
              --label "traefik.port=8080" --label "traefik.weight=90" --label "traefik.backend=app_weighted" \\
              opstree/spring3hibernate:${BASELINE_VERSION}
        """
    }
    stage("Validation for Application (Telemetry & User Experience)") {
        returnValue = input message: 'Canary receiving 10% live traffic. Do you want to proceed further?',
                            parameters: [choice(choices: ['Rollback', 'Proceed'], name: 'action')]
    }
    if ("${returnValue}" == "Rollback") {
        stage("Rollback complete traffic to Baseline (100%)") {
            sh """
                sudo docker rm -f spring3hibernate-baseline
                sudo docker run -itd --name spring3hibernate-baseline --label traefik.enable=true \\
                  --label 'traefik.http.routers.spring3hibernate-baseline.rule=Host(`uat-spring.opstree.com`)' \\
                  --label "traefik.port=8080" --label "traefik.weight=100" --label "traefik.backend=app_weighted" \\
                  opstree/spring3hibernate:${BASELINE_VERSION}
                sudo docker rm -f spring3hibernate-canary
            """
        }
    } else if ("${returnValue}" == "Proceed") {
        stage("Shifting all traffic to Canary (100% Live)") {
            sh """
                sudo docker rm -f spring3hibernate-baseline
                sudo docker rm -f spring3hibernate-canary
                sudo docker run -itd --name spring3hibernate-canary --label traefik.enable=true \\
                  --label 'traefik.http.routers.spring3hibernate-baseline.rule=Host(`uat-spring.opstree.com`)' \\
                  --label "traefik.port=8080" --label "traefik.weight=100" --label "traefik.backend=app_weighted" \\
                  opstree/spring3hibernate:${CANARY_VERSION}
            """
        }
    }
}