image tag me git SHA: multibranch build-number reset se tag reuse ki problem khatam

vars/devopsPipeline.groovy

@@ -1,20 +1,19 @@
-// Ek hi pipeline, har module ke liye. Module ki Jenkinsfile sirf itni hoti hai:
+// Ek hi pipeline, har module ke liye. Module ki Jenkinsfile sirf itni:
 //
 //   @Library('devops-platform') _
 //   devopsPipeline(module: 'demo-app')
 //
-// Poora raasta: secret scan -> test -> SAST -> build -> IaC scan -> CVE gate ->
+// Raasta: secret scan -> test -> SAST -> IaC scan -> build -> CVE gate -> SBOM
-// SBOM -> smoke -> push -> sign -> verify -> staging -> approval -> production.
+//         -> smoke -> push -> sign -> verify -> GitOps promote -> VM deploy.
 //
 // CI builder VM par chalta hai (wahan deploy key nahi hai),
-// CD controller par (wahan docker.sock nahi hai). Dono taraf blast radius chhota.
+// CD + signing controller par (wahan docker.sock nahi hai).
 
 def call(Map cfg = [:]) {
 
     def P = platformConfig()
     if (!cfg.module) { error "devopsPipeline: 'module' dena zaroori hai" }
 
-    // ---- defaults: module kuch na de to sensible value ----
     cfg.imageName     = cfg.imageName     ?: "swim/${cfg.module}"
     cfg.vaultMount    = cfg.vaultMount    ?: 'swim'
     cfg.testImage     = cfg.testImage     ?: 'python:3.12-slim'
@@ -28,18 +27,16 @@ def call(Map cfg = [:]) {
     cfg.runSonar      = cfg.containsKey('runSonar')  ? cfg.runSonar  : true
     cfg.runDeploy     = cfg.containsKey('runDeploy') ? cfg.runDeploy : true
     cfg.approval      = cfg.containsKey('approval')  ? cfg.approval  : true
-    // GitOps lane: k8s cluster me deploy ArgoCD karta hai, Jenkins sirf tag commit karta hai.
     cfg.gitops        = cfg.containsKey('gitops')    ? cfg.gitops    : false
+    cfg.deployVM      = cfg.containsKey('deployVM')  ? cfg.deployVM  : true
     cfg.gitopsRepo    = cfg.gitopsRepo    ?: 'https://ns31240276.ip-51-195-4.eu/devops/gitops.git'
     cfg.gitopsPath    = cfg.gitopsPath    ?: "manifests/${cfg.module}"
     cfg.k8sVerifyUrl  = cfg.k8sVerifyUrl  ?: ''
-    // VM lane: ansible se app-vm/staging-vm par deploy.
-    cfg.deployVM      = cfg.containsKey('deployVM')   ? cfg.deployVM   : true
 
     properties([
         parameters([
             string(name: 'ROLLBACK_TAG', defaultValue: '',
-                   description: 'Khaali = normal build. Purana tag (jaise 7) = bina rebuild seedha us image par rollback.')
+                   description: 'Khaali = normal build. Purana image tag = bina rebuild seedha us image par rollback.')
         ]),
         buildDiscarder(logRotator(numToKeepStr: '30')),
         disableConcurrentBuilds()
@@ -48,64 +45,51 @@ def call(Map cfg = [:]) {
     def branch      = env.BRANCH_NAME ?: 'main'
     def isPR        = branch.startsWith('PR-')
     def isMain      = (branch == 'main' || branch == 'master')
-    // PR par sirf CI. Production sirf main/master se jaata hai.
+    // PR aur feature branch par sirf CI gates. Production sirf main/master se.
     def deployable  = cfg.runDeploy && !isPR && isMain
-
+    def safeBranch  = branch.replaceAll('[^A-Za-z0-9._-]', '-').toLowerCase()
     def rollbackTag = (env.ROLLBACK_TAG ?: '').trim()
     def isRollback  = rollbackTag != ''
-    // Multibranch me HAR branch ka build number 1 se shuru hota hai. Agar tag me
-    // sirf build number rakha to main#1 aur feature#1 ek hi image tag bana ke
-    // ek doosre ko overwrite kar denge. Isliye non-main branch ka naam tag me.
-    def safeBranch  = branch.replaceAll('[^A-Za-z0-9._-]', '-').toLowerCase()
-    def imageTag    = isRollback ? rollbackTag
-                                 : (isMain ? "${env.BUILD_NUMBER}"
-                                           : "${safeBranch}-${env.BUILD_NUMBER}")
-    def fullImage   = "${P.registry}/${cfg.imageName}:${imageTag}"
 
-    def commonEnv = [
+    def imageTag, fullImage, commonEnv
-        "MODULE=${cfg.module}",
-        "REGISTRY=${P.registry}",
-        "IMAGE_NAME=${cfg.imageName}",
-        "IMAGE_TAG=${imageTag}",
-        "FULL_IMAGE=${fullImage}",
-        "VAULT_ADDR=${P.vaultAddr}",
-        "VAULT_MOUNT=${cfg.vaultMount}",
-        "SONAR_URL=${P.sonarUrl}",
-        "SONAR_KEY=${cfg.sonarKey}",
-        "BRIDGE_IP=${P.bridgeIp}",
-        "TRIVY_SEVERITY=${cfg.trivySeverity}",
-        "APP_PORT=${cfg.appPort}",
-        "HEALTH_PATH=${cfg.healthPath}",
-        "INVENTORY=${cfg.inventory}",
-        "PLAYBOOK=${cfg.playbook}",
-        "IMG_GITLEAKS=${P.gitleaks}",
-        "IMG_TRIVY=${P.trivy}",
-        "IMG_SYFT=${P.syft}",
-        "IMG_SCANNER=${P.sonarScanner}",
-        "TEST_IMAGE=${cfg.testImage}"
-    ]
 
     timestamps {
       timeout(time: 60, unit: 'MINUTES') {
-        try {
 
         // ===================== CI: builder VM =====================
         node(P.builderLabel) {
-              withEnv(commonEnv) {
           try {
-                    stage('Init') {
+            stage('Checkout') {
+                checkout scm
+                def sha = sh(script: 'git rev-parse --short=7 HEAD', returnStdout: true).trim()
+                // Tag me commit SHA isliye: multibranch me har branch ka build
+                // number 1 se shuru hota hai, to sirf build number rakhne par
+                // tag dobara use ho jaata hai aur purani image overwrite hoti hai.
+                // SHA ke saath har tag hamesha unique aur traceable rehta hai.
+                imageTag  = isRollback ? rollbackTag
+                          : (isMain ? "${env.BUILD_NUMBER}-${sha}"
+                                    : "${safeBranch}-${env.BUILD_NUMBER}-${sha}")
+                fullImage = "${P.registry}/${cfg.imageName}:${imageTag}"
+                commonEnv = [
+                    "MODULE=${cfg.module}", "REGISTRY=${P.registry}",
+                    "IMAGE_NAME=${cfg.imageName}", "IMAGE_TAG=${imageTag}",
+                    "FULL_IMAGE=${fullImage}", "VAULT_ADDR=${P.vaultAddr}",
+                    "VAULT_MOUNT=${cfg.vaultMount}", "SONAR_URL=${P.sonarUrl}",
+                    "SONAR_KEY=${cfg.sonarKey}", "BRIDGE_IP=${P.bridgeIp}",
+                    "TRIVY_SEVERITY=${cfg.trivySeverity}", "APP_PORT=${cfg.appPort}",
+                    "HEALTH_PATH=${cfg.healthPath}", "INVENTORY=${cfg.inventory}",
+                    "PLAYBOOK=${cfg.playbook}", "IMG_GITLEAKS=${P.gitleaks}",
+                    "IMG_TRIVY=${P.trivy}", "IMG_SYFT=${P.syft}",
+                    "IMG_SCANNER=${P.sonarScanner}", "TEST_IMAGE=${cfg.testImage}"
+                ]
+                currentBuild.displayName = "#${env.BUILD_NUMBER} ${imageTag}"
                 echo "module=${cfg.module} node=${env.NODE_NAME} branch=${branch} " +
                      "mode=${isRollback ? 'ROLLBACK' : 'BUILD'} tag=${imageTag} deploy=${deployable}"
             }
 
-                    stage('Checkout') {
+            withEnv(commonEnv) {
-                        checkout scm
-                        sh 'echo "commit: $(git rev-parse --short HEAD)"'
-                    }
-
                 stage('Secret scan') {
-                        // Poori git history scan hoti hai, sirf latest commit nahi -
+                    // Poori git history scan hoti hai, sirf latest commit nahi.
-                        // purana leak bhi pakda jaata hai. Findings = build fail.
                     sh '''
                         docker run --rm -v "$PWD":/repo "$IMG_GITLEAKS" \
                           detect --source=/repo --redact --no-banner -v
@@ -137,8 +121,6 @@ def call(Map cfg = [:]) {
                     }
 
                     stage('IaC / Dockerfile scan') {
-                            // Dockerfile, compose, k8s manifests ki misconfig pakadta hai
-                            // (root user, missing healthcheck, privileged, etc.)
                         sh '''
                             docker run --rm -v "$PWD":/work "$IMG_TRIVY" config /work \
                               --severity "$TRIVY_SEVERITY" --exit-code 1
@@ -166,7 +148,6 @@ def call(Map cfg = [:]) {
                     }
 
                     stage('SBOM') {
-                            // Audit ka pehla sawaal: "is image me kya-kya hai?"
                         sh '''
                             docker run --rm -v /var/run/docker.sock:/var/run/docker.sock \
                               "$IMG_SYFT" "docker:$FULL_IMAGE" -o spdx-json      > sbom.spdx.json
@@ -208,35 +189,36 @@ assert r['version'] == '${IMAGE_TAG}', 'version mismatch'
                         }
                     }
                 }
+            }
           } finally {
             sh 'docker image prune -f --filter "until=24h" >/dev/null 2>&1 || true'
             cleanWs()
           }
         }
-            }
 
         // ============ Sign: controller par (key builder ko nahi milti) ============
         if (!isRollback) {
             node(P.deployLabel) {
-                  withEnv(commonEnv) {
+              withEnv(commonEnv) { stage('Sign image') { cosignSign() } }
-                    stage('Sign image') { cosignSign() }
-                  }
             }
         }
 
         if (!deployable) {
-                echo isPR ? "PR build - deploy nahi hoga, sirf CI gates." : "Branch '${branch}' deployable nahi hai."
+            echo isPR ? "PR build - deploy nahi hoga, sirf CI gates."
+                      : "Branch '${branch}' deployable nahi hai - sirf CI gates chale."
             return
         }
 
-            // ===================== CD: controller =====================
+        // ===================== CD =====================
         node(P.deployLabel) {
           withEnv(commonEnv) {
             stage('Verify signature') { cosignVerify() }
             if (cfg.gitops) {
                 stage('Promote to GitOps') { gitopsPromote(cfg) }
                 if (cfg.k8sVerifyUrl) {
-                        stage('Verify k8s (ArgoCD)') { waitForRollout(cfg.k8sVerifyUrl, imageTag) }
+                    // ArgoCD ko Gitea webhook turant jagata hai, phir bhi image
+                    // pull + rollout me waqt lagta hai - 10 min ka window.
+                    stage('Verify k8s (ArgoCD)') { waitForRollout(cfg.k8sVerifyUrl, imageTag, 60) }
                 }
             }
             if (cfg.deployVM) {
@@ -248,7 +230,7 @@ assert r['version'] == '${IMAGE_TAG}', 'version mismatch'
 
         if (cfg.approval && cfg.deployVM) {
             stage('Production approval') {
-                    // Node ke bahar hai - intezaar me koi executor block nahi hota.
+                // Node ke bahar - intezaar me koi executor block nahi hota.
                 timeout(time: 30, unit: 'MINUTES') {
                     input message: "${cfg.module}:${imageTag} staging par verified hai. PRODUCTION par bhejein?",
                           ok: 'Deploy to Production'
@@ -264,13 +246,6 @@ assert r['version'] == '${IMAGE_TAG}', 'version mismatch'
               }
             }
         }
-
-            currentBuild.description = "${cfg.module}:${imageTag}${isRollback ? ' (rollback)' : ''}"
-
-        } catch (e) {
-            currentBuild.result = 'FAILURE'
-            throw e
-        }
       }
     }
 }