Compare commits
No commits in common. "d7b9be72289d3b0b7d4719cd1409ee416ac500fc" and "2f56a911432efa6b443f5736c887f350d054e9ae" have entirely different histories.
d7b9be7228
...
2f56a91143
250
expenses_manager/Jenkinsfile
vendored
250
expenses_manager/Jenkinsfile
vendored
@ -1,42 +1,19 @@
|
|||||||
pipeline{
|
pipeline{
|
||||||
// agent none at the top so the approval stage can wait without holding an
|
agent any
|
||||||
// executor. Stages that need a workspace declare their own agent.
|
|
||||||
agent none
|
|
||||||
|
|
||||||
environment {
|
environment {
|
||||||
DEBUG = 'True'
|
DEBUG = 'True'
|
||||||
SECRET_KEY = 'ci-only-value-never-used-in-production'
|
DJANGO_SECRET_KEY = 'test-secret-key-for-ci'
|
||||||
DJANGO_SETTINGS_MODULE = 'expenses_manager.settings'
|
DJANGO_SETTINGS_MODULE = "expenses_manager.settings"
|
||||||
PYTHONUNBUFFERED = '1'
|
PYTHONUNBUFFERED = "1"
|
||||||
|
|
||||||
// Jenkins has no Docker daemon, so everything Docker-related happens on
|
|
||||||
// the NAS over SSH. Absolute paths are required: the remote
|
|
||||||
// non-interactive PATH does not include /usr/local/bin.
|
|
||||||
NAS_HOST = '192.168.1.140'
|
|
||||||
NAS_USER = 'jenkins-ci'
|
|
||||||
NAS_DOCKER = '/usr/local/bin/docker'
|
|
||||||
NAS_COMPOSE = '/usr/local/bin/docker-compose'
|
|
||||||
NAS_BACKUP = '/volume1/scripts/backup_finanzas_db.sh'
|
|
||||||
NAS_NETWORK = 'finanzas_default'
|
|
||||||
CI_DIR = '/volume1/docker/ci/expenses_manager'
|
|
||||||
COMPOSE_DIR = '/volume1/docker/finanzas'
|
|
||||||
APP_ENV = '/volume1/docker/finanzas/app/expenses_manager/.env'
|
|
||||||
SSH_OPTS = '-o StrictHostKeyChecking=accept-new'
|
|
||||||
IMAGE = 'expenses-manager'
|
|
||||||
}
|
|
||||||
|
|
||||||
options {
|
|
||||||
buildDiscarder(logRotator(numToKeepStr: '30'))
|
|
||||||
}
|
}
|
||||||
|
|
||||||
stages {
|
stages {
|
||||||
|
stage('Checkout') {
|
||||||
// Nested stages share one agent allocation, so the venv built in the
|
steps {
|
||||||
// first stage is still there for the ones that follow.
|
checkout scm
|
||||||
stage('CI') {
|
}
|
||||||
agent any
|
}
|
||||||
options { timeout(time: 30, unit: 'MINUTES') }
|
|
||||||
stages {
|
|
||||||
|
|
||||||
stage('Setup Python') {
|
stage('Setup Python') {
|
||||||
steps {
|
steps {
|
||||||
@ -44,18 +21,9 @@ pipeline {
|
|||||||
cd expenses_manager
|
cd expenses_manager
|
||||||
python --version
|
python --version
|
||||||
python -m venv venv
|
python -m venv venv
|
||||||
venv/bin/pip install --upgrade pip
|
. venv/bin/activate
|
||||||
venv/bin/pip install -r requirements.txt
|
pip install --upgrade pip
|
||||||
'''
|
pip install -r requirements.txt
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
// Catches models changed without generating the migration.
|
|
||||||
stage('Check migrations') {
|
|
||||||
steps {
|
|
||||||
sh '''
|
|
||||||
cd expenses_manager
|
|
||||||
venv/bin/python manage.py makemigrations --check --dry-run
|
|
||||||
'''
|
'''
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
@ -64,201 +32,19 @@ pipeline {
|
|||||||
steps {
|
steps {
|
||||||
sh '''
|
sh '''
|
||||||
cd expenses_manager
|
cd expenses_manager
|
||||||
venv/bin/pytest --cov --junitxml=junit.xml
|
. venv/bin/activate
|
||||||
|
venv/bin/pytest --cov
|
||||||
'''
|
'''
|
||||||
}
|
}
|
||||||
post {
|
|
||||||
always {
|
|
||||||
// allowEmptyResults: false is deliberate. A build where
|
|
||||||
// pytest died before collecting anything produces no XML,
|
|
||||||
// and that must fail rather than pass quietly.
|
|
||||||
junit allowEmptyResults: false,
|
|
||||||
testResults: 'expenses_manager/junit.xml'
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
stage('Build image') {
|
|
||||||
steps {
|
|
||||||
sshagent(credentials: ['nas-ssh']) {
|
|
||||||
sh '''
|
|
||||||
SHA=$(echo "${GIT_COMMIT}" | cut -c1-7)
|
|
||||||
TAG=$(echo "${BRANCH_NAME}" | tr '/' '-')
|
|
||||||
|
|
||||||
# Ship the workspace that was just tested rather than
|
|
||||||
# cloning again: what gets built is then provably the
|
|
||||||
# same code the tests ran against.
|
|
||||||
ssh ${SSH_OPTS} ${NAS_USER}@${NAS_HOST} \
|
|
||||||
"rm -rf ${CI_DIR} && mkdir -p ${CI_DIR}"
|
|
||||||
|
|
||||||
tar -czf - --exclude=./expenses_manager/venv \
|
|
||||||
--exclude=./.git . \
|
|
||||||
| ssh ${SSH_OPTS} ${NAS_USER}@${NAS_HOST} \
|
|
||||||
"tar -xzf - -C ${CI_DIR}"
|
|
||||||
|
|
||||||
ssh ${SSH_OPTS} ${NAS_USER}@${NAS_HOST} \
|
|
||||||
"cd ${CI_DIR} && sudo ${NAS_DOCKER} build \
|
|
||||||
-t ${IMAGE}:${SHA} -t ${IMAGE}:${TAG} ."
|
|
||||||
'''
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
// A successful build only proves the Dockerfile is syntactically
|
|
||||||
// sound. Django's own checks prove the image can actually start.
|
|
||||||
stage('Smoke test image') {
|
|
||||||
steps {
|
|
||||||
sshagent(credentials: ['nas-ssh']) {
|
|
||||||
sh '''
|
|
||||||
SHA=$(echo "${GIT_COMMIT}" | cut -c1-7)
|
|
||||||
ssh ${SSH_OPTS} ${NAS_USER}@${NAS_HOST} \
|
|
||||||
"sudo ${NAS_DOCKER} run --rm \
|
|
||||||
-e SECRET_KEY=smoke-test-only \
|
|
||||||
-e DEBUG=False \
|
|
||||||
-e ALLOWED_HOSTS=localhost \
|
|
||||||
-e DB_ENGINE=sqlite3 \
|
|
||||||
${IMAGE}:${SHA} python manage.py check"
|
|
||||||
'''
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
// Read-only: nothing is changed on the NAS by this stage.
|
|
||||||
stage('Detect migrations') {
|
|
||||||
agent any
|
|
||||||
when { branch 'main' }
|
|
||||||
steps {
|
|
||||||
sshagent(credentials: ['nas-ssh']) {
|
|
||||||
script {
|
|
||||||
// migrate --check exits non-zero when migrations are unapplied.
|
|
||||||
def rc = sh(returnStatus: true, script: '''
|
|
||||||
SHA=$(echo "${GIT_COMMIT}" | cut -c1-7)
|
|
||||||
ssh ${SSH_OPTS} ${NAS_USER}@${NAS_HOST} \
|
|
||||||
"sudo ${NAS_DOCKER} run --rm \
|
|
||||||
--network ${NAS_NETWORK} \
|
|
||||||
--env-file ${APP_ENV} \
|
|
||||||
${IMAGE}:${SHA} python manage.py migrate --check"
|
|
||||||
''')
|
|
||||||
env.MIGRATIONS_PENDING = (rc == 0) ? 'false' : 'true'
|
|
||||||
echo "Migraciones pendientes: ${env.MIGRATIONS_PENDING}"
|
|
||||||
|
|
||||||
if (rc != 0) {
|
|
||||||
// Printing the plan also proves the database is reachable.
|
|
||||||
// If the non-zero status above was a connection failure
|
|
||||||
// rather than pending migrations, this fails loudly
|
|
||||||
// instead of asking for approval on a false premise.
|
|
||||||
sh '''
|
|
||||||
SHA=$(echo "${GIT_COMMIT}" | cut -c1-7)
|
|
||||||
ssh ${SSH_OPTS} ${NAS_USER}@${NAS_HOST} \
|
|
||||||
"sudo ${NAS_DOCKER} run --rm \
|
|
||||||
--network ${NAS_NETWORK} \
|
|
||||||
--env-file ${APP_ENV} \
|
|
||||||
${IMAGE}:${SHA} python manage.py migrate --plan"
|
|
||||||
'''
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
// No agent: this waits without occupying an executor.
|
|
||||||
stage('Aprobar migraciones') {
|
|
||||||
when {
|
|
||||||
allOf {
|
|
||||||
branch 'main'
|
|
||||||
expression { env.MIGRATIONS_PENDING == 'true' }
|
|
||||||
}
|
|
||||||
}
|
|
||||||
steps {
|
|
||||||
timeout(time: 2, unit: 'HOURS') {
|
|
||||||
input message: 'Hay migraciones pendientes. Revisa el plan en el log del stage anterior.',
|
|
||||||
ok: 'Migrar y desplegar'
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
stage('Deploy') {
|
|
||||||
agent any
|
|
||||||
when { branch 'main' }
|
|
||||||
options { timeout(time: 15, unit: 'MINUTES') }
|
|
||||||
steps {
|
|
||||||
sshagent(credentials: ['nas-ssh']) {
|
|
||||||
sh '''
|
|
||||||
SHA=$(echo "${GIT_COMMIT}" | cut -c1-7)
|
|
||||||
|
|
||||||
# Always back up, even with no migrations pending: this is
|
|
||||||
# the restore point for this particular deployment.
|
|
||||||
ssh ${SSH_OPTS} ${NAS_USER}@${NAS_HOST} "sudo ${NAS_BACKUP}"
|
|
||||||
|
|
||||||
# Migrate with the new image before the running container is
|
|
||||||
# replaced, so the app never serves new code against the old
|
|
||||||
# schema. A no-op when nothing is pending.
|
|
||||||
ssh ${SSH_OPTS} ${NAS_USER}@${NAS_HOST} \
|
|
||||||
"sudo ${NAS_DOCKER} run --rm \
|
|
||||||
--network ${NAS_NETWORK} \
|
|
||||||
--env-file ${APP_ENV} \
|
|
||||||
${IMAGE}:${SHA} python manage.py migrate --noinput"
|
|
||||||
|
|
||||||
# Point compose at the image that was just tested, then swap
|
|
||||||
# the container. Writing the tag to .env leaves a readable
|
|
||||||
# record of what is deployed, and makes rollback a one-line
|
|
||||||
# edit plus "docker-compose up -d web".
|
|
||||||
ssh ${SSH_OPTS} ${NAS_USER}@${NAS_HOST} \
|
|
||||||
"echo WEB_IMAGE=${IMAGE}:${SHA} > ${COMPOSE_DIR}/.env \
|
|
||||||
&& cd ${COMPOSE_DIR} \
|
|
||||||
&& sudo ${NAS_COMPOSE} up -d web"
|
|
||||||
'''
|
|
||||||
|
|
||||||
script {
|
|
||||||
// Confirm the application actually answers. A container that
|
|
||||||
// starts and immediately crashes would otherwise pass as a
|
|
||||||
// successful deployment.
|
|
||||||
def code = sh(returnStdout: true, script: '''
|
|
||||||
ssh ${SSH_OPTS} ${NAS_USER}@${NAS_HOST} \
|
|
||||||
"sleep 10 && curl -s -o /dev/null -w '%{http_code}' \
|
|
||||||
http://127.0.0.1:8001/"
|
|
||||||
''').trim()
|
|
||||||
|
|
||||||
echo "Respuesta HTTP: ${code}"
|
|
||||||
if (!(code in ['200', '302'])) {
|
|
||||||
error("La aplicacion no responde correctamente (HTTP ${code})")
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}
|
|
||||||
post {
|
|
||||||
success {
|
|
||||||
notifyTelegram("🚀 Desplegado")
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
|
||||||
post {
|
post {
|
||||||
failure { notifyTelegram("❌ FALLO") }
|
always {
|
||||||
fixed { notifyTelegram("✅ Recuperado") }
|
echo 'Pipeline finished.'
|
||||||
aborted { notifyTelegram("⚠️ Abortado") }
|
|
||||||
}
|
}
|
||||||
}
|
failure {
|
||||||
|
echo 'Tests failed.'
|
||||||
// Sends a one-line build summary to Telegram. The node block is required because
|
|
||||||
// the pipeline declares "agent none", so post actions have no workspace of their
|
|
||||||
// own. Credentials come from the Jenkins store, never from the repository.
|
|
||||||
void notifyTelegram(String status) {
|
|
||||||
node {
|
|
||||||
withCredentials([
|
|
||||||
string(credentialsId: 'telegram-bot-token', variable: 'TG_TOKEN'),
|
|
||||||
string(credentialsId: 'telegram-chat-id', variable: 'TG_CHAT')
|
|
||||||
]) {
|
|
||||||
sh """
|
|
||||||
curl -s -X POST "https://api.telegram.org/bot\${TG_TOKEN}/sendMessage" \
|
|
||||||
--data-urlencode "chat_id=\${TG_CHAT}" \
|
|
||||||
--data-urlencode "text=${status} ${env.JOB_NAME} #${env.BUILD_NUMBER}
|
|
||||||
Rama: ${env.BRANCH_NAME ?: 'main'}
|
|
||||||
${env.BUILD_URL}" > /dev/null
|
|
||||||
"""
|
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
Loading…
Reference in New Issue
Block a user