build(confidence-engine): add manual Jenkins deployment

2026-09-09 12:44:55 +01:00
parent bb62a65174
commit 2c535080d2
5 changed files with 338 additions and 0 deletions
@@ -0,0 +1,111 @@
+// Confidence Engine — Manual Jenkins Deployment Pipeline
+//
+// Trigger: manually, via "Build with Parameters"
+// Parameter: GIT_REF (string) — the Git ref to deploy
+//
+// Pre-requisites in Jenkins:
+//   1. SSH credential of type "SSH Username with private key"
+//      named 'confidence-engine-deploy-ssh' that can reach
+//      CT 112 (confidence-engine / 192.168.68.73).
+//      The username from the credential is used for SSH login.
+//   2. The Gitea repository configured in the job SCM section.
+
+pipeline {
+    agent none
+
+    parameters {
+        string(
+            name: 'GIT_REF',
+            defaultValue: '',
+            description: 'Git ref to deploy (branch name, tag, or full commit SHA). Leave blank to fail.'
+        )
+    }
+
+    environment {
+        TARGET_HOST      = 'confidence-engine'
+        DEPLOY_DIR       = '/opt/confidence-engine'
+        HEALTH_URL       = 'http://127.0.0.1:3000/api/health'
+    }
+
+    stages {
+
+        stage('Resolve') {
+            steps {
+                script {
+                    def ref = params.GIT_REF.trim()
+                    if (!ref || ref.isEmpty()) {
+                        error 'GIT_REF parameter is blank or empty. Provide a Git ref to deploy.'
+                    }
+
+                    echo "Requested ref: ${ref}"
+
+                    // Resolve the ref to an exact SHA via Gitea remote.
+                    // If ref is already a 40-char hex SHA, use it directly.
+                    def shaPattern = ~/^[0-9a-fA-F]{40}$/
+                    def resolvedSha
+                    if (ref ==~ shaPattern) {
+                        resolvedSha = ref
+                        echo "Provided ref is a full commit SHA: ${resolvedSha}"
+                    } else {
+                        // For branches/tags, look up on origin
+                        resolvedSha = sh(
+                            script: "git ls-remote origin refs/heads/${ref} refs/tags/${ref} 2>/dev/null | awk '/^[0-9a-f]/{print \$1; exit}'",
+                            returnStdout: true
+                        ).trim()
+
+                        if (!resolvedSha || resolvedSha.length() != 40) {
+                            // Broader fallback — might match partial SHA or ref prefix
+                            resolvedSha = sh(
+                                script: "git ls-remote origin ${ref} 2>/dev/null | awk '/^[0-9a-f]/{print \$1; exit}'",
+                                returnStdout: true
+                            ).trim()
+
+                            if (!resolvedSha || resolvedSha.length() != 40) {
+                                error "Cannot resolve '${ref}' to a commit SHA on origin. Check the ref and repository configuration."
+                            }
+                        }
+                    }
+
+                    echo "Resolved SHA: ${resolvedSha}"
+                    env.DEPLOY_SHA = resolvedSha
+                }
+            }
+        }
+
+        stage('Deploy') {
+            steps {
+                script {
+                    // Run the deployment script on CT 112 via SSH
+                    withCredentials([sshUserPrivateKey(credentialsId: 'confidence-engine-deploy-ssh')]) {
+                        sh """
+                            ssh -o StrictHostKeyChecking=no \\
+                                root@${TARGET_HOST} \\
+                                "bash -s" \\
+                                < ${WORKSPACE}/scripts/deploy-production.sh \\
+                                    "${DEPLOY_SHA}" \\
+                                    "${DEPLOY_DIR}" \\
+                                    "${HEALTH_URL}"
+                        """
+                    }
+                }
+            }
+        }
+
+        stage('Verify/result') {
+            steps {
+                script {
+                    echo "Deployment stages completed. Check the Deploy stage output above for success/failure."
+                }
+            }
+        }
+    }
+
+    post {
+        failure {
+            echo 'DEPLOYMENT FAILED — check the Deploy stage logs for details.'
+        }
+        success {
+            echo "DEPLOYMENT SUCCEEDED — deployed SHA: ${env.DEPLOY_SHA}"
+        }
+    }
+}