Jenkins Pipelines: o CI/CD da era enterprise

// Jenkinsfile — declarativo, 100 linhas cobrem um pipeline real
pipeline {
  agent none                              // cada stage escolhe seu agent

  options {
    timeout(time: 30, unit: 'MINUTES')
    timestamps()
    disableConcurrentBuilds()
    buildDiscarder(logRotator(numToKeepStr: '20'))
  }

  environment {
    IMAGE = "ghcr.io/me/api"
    SHA   = "${GIT_COMMIT.take(7)}"
  }

  stages {
    stage('Checkout') {
      agent { label 'linux' }
      steps { checkout scm }
    }

    stage('Quality') {
      parallel {
        stage('Lint') {
          agent { docker 'node:20-alpine' }
          steps { sh 'npm ci && npm run lint' }
        }
        stage('Test') {
          agent { docker 'node:20-alpine' }
          steps { sh 'npm ci && npm test -- --ci' }
          post { always { junit 'junit.xml' } }
        }
      }
    }

    stage('Build & push image') {
      agent { label 'linux' }
      when { branch 'main' }
      steps {
        withCredentials([usernamePassword(
          credentialsId: 'ghcr',
          usernameVariable: 'USER', passwordVariable: 'TOKEN')]) {
          sh '''
            echo "$TOKEN" | docker login ghcr.io -u "$USER" --password-stdin
            docker buildx build --push --platform linux/amd64,linux/arm64 \
              -t $IMAGE:$SHA -t $IMAGE:latest .
          '''
        }
      }
    }

    stage('Deploy staging') {
      agent { label 'kubectl' }
      when { branch 'main' }
      steps {
        sh '''
          kubectl set image deploy/api api=$IMAGE:$SHA -n staging
          kubectl rollout status deploy/api -n staging --timeout=5m
        '''
      }
    }

    stage('Deploy prod') {
      agent { label 'kubectl' }
      when { branch 'main' }
      input {
        message 'Promote to production?'
        ok 'Deploy'
        submitter 'sre,tech-lead'
      }
      steps {
        sh '''
          kubectl set image deploy/api api=$IMAGE:$SHA -n prod
          kubectl rollout status deploy/api -n prod --timeout=5m
        '''
      }
    }
  }

  post {
    success { slackSend channel: '#deploys', color: 'good',   message: "✅ ${env.JOB_NAME} ${env.BUILD_NUMBER} deployed" }
    failure { slackSend channel: '#deploys', color: 'danger', message: "❌ ${env.JOB_NAME} ${env.BUILD_NUMBER} failed" }
    always  { cleanWs() }
  }
}

pipeline {
  agent {
    kubernetes {
      yaml '''
apiVersion: v1
kind: Pod
spec:
  containers:
    - name: node
      image: node:20-alpine
      command: [cat]
      tty: true
    - name: docker
      image: docker:26-dind
      securityContext: { privileged: true }
    - name: kubectl
      image: bitnami/kubectl:1.30
      command: [cat]
      tty: true
      '''
      defaultContainer 'node'
    }
  }
  stages {
    stage('Install') { steps { sh 'npm ci' } }
    stage('Test')    { steps { sh 'npm test' } }
    stage('Build')   {
      steps {
        container('docker') {
          sh 'docker build -t me/api:$GIT_COMMIT .'
        }
      }
    }
    stage('Deploy') {
      steps {
        container('kubectl') {
          sh 'kubectl apply -f k8s/'
        }
      }
    }
  }
}

stage('Deploy to AWS') {
  steps {
    withCredentials([[
      $class: 'AmazonWebServicesCredentialsBinding',
      credentialsId: 'aws-prod',
      accessKeyVariable: 'AWS_ACCESS_KEY_ID',
      secretKeyVariable: 'AWS_SECRET_ACCESS_KEY'
    ]]) {
      sh 'aws s3 sync ./dist s3://meu-bucket --delete'
    }
  }
}

jenkins-shared-lib/
├── vars/
│   ├── buildDockerImage.groovy     # usado como: buildDockerImage(name: 'api', tag: env.GIT_COMMIT)
│   └── deployToK8s.groovy
├── src/
│   └── com/minhaorg/jenkins/
│       └── K8sClient.groovy        # classes Groovy reutilizáveis
└── resources/
    └── k8s/
        └── deployment.yaml.tpl

// vars/buildDockerImage.groovy
def call(Map config) {
  def image = "${config.registry}/${config.name}:${config.tag}"
  sh """
    docker build -t ${image} .
    docker push ${image}
  """
  return image
}

// Jenkinsfile consome assim
@Library('jenkins-shared-lib@v2') _

pipeline {
  agent { label 'linux' }
  stages {
    stage('Build') {
      steps {
        script {
          def img = buildDockerImage(
            registry: 'ghcr.io/minha-org',
            name: 'api',
            tag: env.GIT_COMMIT.take(7)
          )
          echo "Built ${img}"
        }
      }
    }
  }
}