# devops-platform — Jenkins Shared Library

Kisi bhi module ke liye ek hi pipeline. Module ki `Jenkinsfile` sirf itni:

```groovy
@Library('devops-platform') _
devopsPipeline(module: 'demo-app')
```

## Kya-kya milta hai (sab default ON)

| Stage | Tool | Fail hoga jab |
|---|---|---|
| Secret scan | gitleaks | poori git history me koi secret mila |
| Test | module ka test image | test fail |
| SAST | SonarQube | quality gate (Sonar side) |
| IaC/Dockerfile scan | trivy config | HIGH/CRITICAL misconfig |
| CVE gate | trivy image | HIGH/CRITICAL fixable CVE |
| SBOM | syft | — (artifact archive hota hai) |
| Smoke test | container | `/version` galat |
| Push | docker | — |
| Sign | cosign | — |
| Verify signature | cosign | signature nahi mili |
| Deploy + Verify | ansible | playbook fail ya version mismatch |

## Options

| Key | Default | Kaam |
|---|---|---|
| `module` | **zaroori** | module ka naam |
| `imageName` | `swim/<module>` | registry me image ka naam |
| `vaultMount` | `swim` | Vault KV mount jahan `registry` secret hai |
| `testImage` | `python:3.12-slim` | test kis image me chalein |
| `testCommand` | pytest | test command |
| `trivySeverity` | `HIGH,CRITICAL` | CVE gate ki severity |
| `appPort` / `healthPath` | `8000` / `/version` | verify endpoint |
| `sonarKey` | `swim-<module>` | SonarQube project key |
| `inventory` / `playbook` | `deploy/inventory.ini` / `deploy/deploy.yml` | Ansible |
| `runSonar` / `runDeploy` / `approval` | `true` | stage on/off |

## Branch ka niyam
- `main`/`master` → poora raasta (staging → approval → production)
- `PR-*` aur baaki branches → **sirf CI gates**, koi deploy nahi

## Rollback
`ROLLBACK_TAG=7` do → build/test/scan skip, seedha us image par deploy.

## Kahan chalta hai
- **CI** → `builder-vm-01` (label `builder`). Yahan deploy key **nahi** hai.
- **CD + signing** → Jenkins controller (label `built-in`). Yahan docker.sock **nahi** hai.