Jenkinsfile-security-taint-analysis

#!/usr/bin/env groovy

def actions

pipeline {
    agent {
        label 'docker'
    }
    triggers { cron('H 5 * * 1-5') }

    stages {
        stage('Checkout') {
            steps {
                checkout scm
            }
        }

        stage('Prepare') {
            steps {
                dir ('results') {
                    deleteDir()
                }
                script { actions = load 'sources/tests/actions.groovy' }
                dir ('sources') {
                    withCredentials([
                        usernamePassword(
                            credentialsId: 'nexus.enalean.com_readonly',
                            passwordVariable: 'NPM_PASSWORD',
                            usernameVariable: 'NPM_USER'
                        ),
                        string(credentialsId: 'github-token-composer', variable: 'COMPOSER_GITHUB_AUTH')
                    ]) {
                        script { actions.prepareSources('dev') }
                    }
                }
            }
        }

        stage('Psalm taint analysis') {
            agent {
                docker {
                    image 'ghcr.io/enalean/tuleap-test-phpunit:el9-php82'
                    reuseNode true
                    args '--network none'
                }
            }
            steps {
                script {
                    actions = load 'sources/tests/actions.groovy'
                    actions.runPsalmTaintAnalysis('tests/psalm/psalm.xml')
                }
            }
            post {
                always {
                    recordIssues enabledForFailure: true, minimumSeverity: 'NORMAL', tools: [checkStyle(id: 'checkstyle_psalm', pattern: 'results/psalm/checkstyle.xml')]
                }
            }
        }
    }

    post {
        always {
            archiveArtifacts allowEmptyArchive: true, artifacts: 'results/'
        }
        failure {
            withCredentials([string(credentialsId: 'email-notification-rd-team', variable: 'email')]) {
                mail to: email,
                subject: "${currentBuild.fullDisplayName} is broken",
                body: "See ${env.BUILD_URL}"
            }
        }
        unstable {
            withCredentials([string(credentialsId: 'email-notification-rd-team', variable: 'email')]) {
                mail to: email,
                subject: "${currentBuild.fullDisplayName} is unstable",
                body: "See ${env.BUILD_URL}"
            }
        }
    }
}