Jenkins 面试题

// 1. 使用 Declarative Pipeline，结构化清晰
pipeline {
    agent none

    // 2. options 统一设置超时、重试、构建保留
    options {
        timeout(time: 30, unit: 'MINUTES')
        retry(1)
        buildDiscarder(logRotator(numToKeepStr: '10'))
        disableConcurrentBuilds()
    }

    // 3. environment 集中管理环境变量
    environment {
        REGISTRY = 'registry.example.com'
    }

    stages {
        stage('Checkout') {
            steps {
                checkout scm
            }
        }
        stage('Build') {
            steps {
                sh 'make build'
            }
        }
        stage('Test') {
            steps {
                sh 'make test'
            }
            // 4. post 块在 stage 级别做精细化处理
            post {
                always { junit '**/target/surefire-reports/*.xml' }
            }
        }
    }

    // 5. post 块在 pipeline 级别处理全局通知
    post {
        failure { slackSend(color: '#ff0000', message: "Build failed") }
        success { slackSend(color: '#00ff00', message: "Build succeeded") }
    }
}

vars/
  dockerBuild.groovy    # 全局变量（可当作 Pipeline step 调用）
  slackNotify.groovy
src/
  org/example/
    PipelineUtils.groovy  # Groovy 类
resources/
  template.xml           # 静态资源文件

def call(Map config) {
    stage("Docker Build") {
        sh """
            docker build -t ${config.registry}/${config.image}:${config.tag} .
            docker push ${config.registry}/${config.image}:${config.tag}
        """
    }
}

@Library('my-shared-library@v1.2.3') _

pipeline {
    agent any
    stages {
        stage('Build') {
            steps {
                dockerBuild(
                    registry: 'registry.example.com',
                    image: 'my-app',
                    tag: "${env.BUILD_NUMBER}"
                )
            }
        }
    }
}

withCredentials([string(credentialsId: 'docker-hub-token', variable: 'DOCKER_TOKEN')]) {
    sh 'docker login -u myuser -p $DOCKER_TOKEN'
}

// Jenkinsfile 中配置分支触发策略
triggers {
    // 定期扫描仓库分支变更
    pollSCM('H/5 * * * *')
    // 仅特定分支触发自动构建
    branch('main')
    branch('feature/*')
}

# GitHub/GitLab 推送事件触发
triggers {
    eventTrigger()
}

pipeline {
    agent {
        kubernetes {
            label 'k8s-build-agent'
            yamlFile 'jenkins-agent-pod.yaml'
            defaultContainer 'jnlp'
        }
    }
    stages {
        stage('Build') {
            steps {
                container('maven') {
                    sh 'mvn clean package'
                }
            }
        }
    }
}

apiVersion: v1
kind: Pod
spec:
  containers:
  - name: jnlp
    image: jenkins/inbound-agent:latest
    args: ['$(JENKINS_SECRET)', '$(JENKINS_NAME)']
  - name: maven
    image: maven:3.8-openjdk-11
    command: ['cat']
    tty: true
  - name: docker
    image: docker:20.10
    command: ['cat']
    tty: true
    volumeMounts:
    - mountPath: /var/run/docker.sock
      name: docker-sock
  volumes:
  - name: docker-sock
    hostPath:
      path: /var/run/docker.sock

pipeline {
    agent none
    parameters {
        choice(name: 'ENV', choices: ['dev', 'staging', 'prod'])
        string(name: 'VERSION', defaultValue: '', description: 'Docker image tag')
    }
    stages {
        stage('Build & Push') {
            agent { label 'builder' }
            steps {
                sh "docker build -t app:${params.VERSION} ."
                sh "docker push registry/app:${params.VERSION}"
            }
        }
        stage('Deploy to Dev') {
            agent { label 'deploy' }
            when { branch 'develop' }
            steps {
                sh "kubectl set image deploy/app app=registry/app:${params.VERSION} -n dev"
            }
        }
        stage('Deploy to Staging') {
            agent { label 'deploy' }
            when { branch 'main' }
            steps {
                sh "kubectl set image deploy/app app=registry/app:${params.VERSION} -n staging"
            }
            input {
                message "Deploy to staging?"
                ok "Yes"
            }
        }
        stage('Deploy to Production') {
            agent { label 'deploy' }
            when {
                branch 'main'
                expression { currentBuild.result == 'SUCCESS' }
            }
            input {
                message "Deploy to production?"
                ok "Yes"
                parameters {
                    string(defaultValue: 'ops-lead', description: 'Approver name', name: 'APPROVER')
                }
            }
            steps {
                sh "kubectl set image deploy/app app=registry/app:${params.VERSION} -n prod"
            }
        }
    }
}

stage('Build') {
    steps {
        sh '''
            # 启用增量编译
            mvn compile -o -Dmaven.compiler.useIncrementalCompilation=true
            mvn test-compile -o
            mvn package -DskipTests
        '''
    }
}

stage('Docker Build with Cache') {
    steps {
        sh '''
            # 使用 BuildKit 加速
            export DOCKER_BUILDKIT=1
            docker build \
                --cache-from registry/app:latest \
                --tag registry/app:${BUILD_NUMBER} \
                --tag registry/app:latest \
                .
        '''
    }
}

# pod-template.yaml
spec:
  volumes:
  - name: maven-cache
    persistentVolumeClaim:
      claimName: maven-cache-pvc
  containers:
  - name: maven
    volumeMounts:
    - mountPath: /root/.m2
      name: maven-cache

# 角色层级设计
Global Roles:
  - admin: 系统管理权限
  - viewer: 只读查看所有 Job
  - operator: 触发构建和查看日志

Project Roles:
  - team-a-developer: team-a/* 项目的读写权限
  - team-a-admin: team-a/* 项目的管理权限
  - team-b-developer: team-b/* 项目的读写权限
  - team-b-admin: team-b/* 项目的管理权限

Slave Roles:
  - node-operator: 管理 Agent 节点

#!/bin/bash
# Jenkins 全量备份
BACKUP_DIR="/backup/jenkins/$(date +%Y%m%d_%H%M%S)"
JENKINS_HOME="/var/jenkins_home"

mkdir -p "$BACKUP_DIR"

# 全量备份（排除缓存的 workspace）
rsync -avz \
    --exclude='workspace/' \
    --exclude='builds/' \
    --exclude='logs/' \
    --exclude='caches/' \
    "$JENKINS_HOME/" "$BACKUP_DIR/"

# 分卷压缩
tar czf "${BACKUP_DIR}.tar.gz" -C "$BACKUP_DIR" .

# 保留最近 30 天备份，删除更早的
find /backup/jenkins/ -name "*.tar.gz" -mtime +30 -delete

// Jenkinsfile GitLab 集成示例
pipeline {
    agent any
    post {
        success {
            updateGitlabCommitStatus name: 'build', state: 'success'
        }
        failure {
            updateGitlabCommitStatus name: 'build', state: 'failed'
        }
    }
}

// Jenkinsfile GitHub 集成示例
pipeline {
    agent any
    post {
        success {
            step([$class: 'SetGitHubCommitStatusBuilder',
                  statusResult: 'Success',
                  statusMessage: 'Build passed'])
        }
        failure {
            step([$class: 'GitHubCommitStatusSetter',
                  statusResult: 'Failure',
                  statusMessage: 'Build failed'])
        }
    }
}

JAVA_OPTS="-Xms8g -Xmx8g -XX:MaxMetaspaceSize=512m \
  -XX:+UseG1GC -XX:MaxGCPauseMillis=200 \
  -XX:+HeapDumpOnOutOfMemoryError \
  -Djenkins.model.Jenkins.slaveAgentPort=50000 \
  -Djenkins.model.Jenkins.slaveAgentPortEnforce=true"

# values.yaml
master:
  resources:
    requests:
      cpu: "2"
      memory: "4Gi"
    limits:
      cpu: "4"
      memory: "8Gi"
  javaOpts: "-Xms4g -Xmx4g -XX:+UseG1GC"
  serviceType: ClusterIP
  ingress:
    enabled: true
    hostName: jenkins.example.com
    tls:
      - secretName: jenkins-tls
        hosts: [jenkins.example.com]
  persistence:
    enabled: true
    size: 50Gi
    storageClass: ssd

agent:
  enabled: true
  resources:
    requests:
      cpu: "1"
      memory: "2Gi"
    limits:
      cpu: "2"
      memory: "4Gi"
  volumes:
  - type: HostPath
    hostPath: /var/run/docker.sock
    mountPath: /var/run/docker.sock
  workingDir: "/home/jenkins/agent"

rbac:
  create: true
  serviceAccountName: jenkins

// Jenkinsfile 中使用 Kubernetes Agent
podTemplate(
    label: 'k8s-agent',
    namespace: 'jenkins',
    containers: [
        containerTemplate(name: 'jnlp', image: 'jenkins/inbound-agent:latest', args: '${computer.jnlpmac} ${computer.name}'),
        containerTemplate(name: 'kaniko', image: 'gcr.io/kaniko-project/executor:latest', command: '/busybox/cat', tty: true),
        containerTemplate(name: 'helm', image: 'alpine/helm:latest', command: '/bin/cat', tty: true)
    ],
    volumes: [
        persistentVolumeClaim(mountPath: '/cache', claimName: 'build-cache')
    ],
    serviceAccount: 'jenkins-builder'
) {
    node(POD_LABEL) {
        stage('Build') {
            container('kaniko') {
                sh 'kaniko --context=dir://. --destination=registry/app:latest'
            }
        }
        stage('Deploy') {
            container('helm') {
                sh 'helm upgrade app ./chart --namespace production'
            }
        }
    }
}

// Jenkinsfile 中配置 SCM 触发
pipeline {
    triggers {
        // GitHub webhook
        githubPush()
        // GitLab webhook
        gitlab(triggerOnPush: true, triggerOnMergeRequest: true)
        // 定时触发，凌晨 2 点执行每日构建
        cron('H 2 * * *')
        // SCM 轮询兜底，5 分钟间隔
        pollSCM('H/5 * * * *')
    }
}

stage('Trigger Downstream') {
    steps {
        build job: 'deploy-to-staging',
              parameters: [
                  string(name: 'BUILD_VERSION', value: "${env.BUILD_NUMBER}"),
                  booleanParam(name: 'RUN_TESTS', value: true)
              ],
              wait: true,
              propagate: true
    }
}

pipeline {
    agent any

    // 全局超时保护
    options {
        timeout(time: 30, unit: 'MINUTES')
        // 构建失败时保留完整工作空间
        preserveStashes()
    }

    stages {
        stage('Test') {
            steps {
                retry(3) {
                    sh 'make test'
                }
            }
            post {
                // 无论成功失败都归档测试报告
                always { junit '**/reports/*.xml' }
                // 仅失败时执行
                failure { sh 'make test-debug' }
                // 环境不稳定时标记为不稳定
                unstable { sh 'make check-flaky' }
            }
        }
    }

    post {
        always {
            // 清理工作空间
            cleanWs()
        }
        success {
            // 成功通知
            slackSend(
                color: '#36a64f',
                message: "Build succeeded: ${env.JOB_NAME} #${env.BUILD_NUMBER}"
            )
            emailext(
                subject: "Build Succeeded: ${env.JOB_NAME}",
                body: "View build at ${env.BUILD_URL}",
                to: 'team@example.com'
            )
        }
        failure {
            // 失败通知 + 详细上下文
            slackSend(
                color: '#ff0000',
                message: "Build failed: ${env.JOB_NAME} #${env.BUILD_NUMBER}\n${env.BUILD_URL}"
            )
            emailext(
                subject: "URGENT: Build Failed - ${env.JOB_NAME}",
                body: """
                    Build: ${env.BUILD_NUMBER}
                    Duration: ${currentBuild.durationString}
                    Changes: ${currentBuild.changeSets}
                    URL: ${env.BUILD_URL}
                """,
                to: 'team@example.com, oncall@example.com'
            )
        }
        unstable {
            // 不稳定通知（测试覆盖率下降等）
            slackSend(
                color: '#ffff00',
                message: "Build unstable: ${env.JOB_NAME} #${env.BUILD_NUMBER}"
            )
        }
        changed {
            // 状态变更通知（成功变失败或反之）
            emailext(
                subject: "Build Status Changed: ${env.JOB_NAME}",
                body: "Previous build was ${currentBuild.previousBuild?.result}",
                to: 'team@example.com'
            )
        }
    }
}

// vars/notify.groovy
def call(Map config) {
    def color = config.status == 'SUCCESS' ? '#36a64f' : '#ff0000'
    def message = """
        *${config.jobName}* #${config.buildNumber}
        Status: ${config.status}
        Duration: ${config.duration}
        <${config.buildUrl}|View Build>
    """
    slackSend(color: color, message: message)
}

pipeline {
    // 顶级 agent，所有 Stage 继承
    agent {
        // 1. 任意可用节点
        any
        // 2. 不指定 agent，Stage 级单独配置
        // none
        // 3. 指定标签节点
        // label 'linux'
        // 4. Docker 容器内执行
        // docker { image 'maven:3.8-openjdk-11' }
        // 5. Dockerfile 构建镜像后执行
        // dockerfile { filename 'Dockerfile.build' }
        // 6. Kubernetes Pod 内执行
        // kubernetes { yamlFile 'pod-template.yaml' }
    }
}

pipeline {
    agent none
    stages {
        stage('Compile') {
            agent { docker 'maven:3.8-openjdk-11' }
            steps {
                sh 'mvn compile'
            }
        }
        stage('Docker Build') {
            agent { label 'docker-builder' }
            steps {
                sh 'docker build -t app .'
            }
        }
        stage('Integration Test') {
            agent {
                kubernetes {
                    yaml """
apiVersion: v1
kind: Pod
spec:
  containers:
  - name: test
    image: node:18
    command: ['cat']
    tty: true
  - name: db
    image: postgres:14
"""
                }
            }
            steps {
                container('test') {
                    sh 'npm test'
                }
            }
        }
        stage('Deploy') {
            agent { label 'prod-deployer' }
            when { branch 'main' }
            steps {
                sh 'kubectl apply -f deploy.yaml'
            }
        }
    }
}

// 正确的设计：颗粒度适中
stages {
    stage('Compile') {
        steps {
            sh 'mvn compile'
        }
    }
    stage('Unit Test') {
        steps {
            sh 'mvn test'
        }
    }
    stage('Package') {
        steps {
            sh 'mvn package -DskipTests'
        }
    }
}

// 错误的粒度设计
stage('All In One') {
    steps {
        sh 'mvn clean compile test verify package deploy'  // 一个 stage 做了所有事
    }
}

stage('Empty Checkout') {
    steps {
        // 空 stage，无实际工作
        echo 'Starting...'
    }
}

stage('Build & Test') {
    parallel {
        stage('Build Backend') {
            steps { sh 'mvn -pl backend compile' }
        }
        stage('Build Frontend') {
            steps { sh 'npm run build' }
        }
        stage('Unit Tests') {
            steps { sh 'mvn -pl backend test' }
        }
    }
}

pipeline {
    agent any
    environment {
        // 字面量变量
        REGISTRY = 'registry.example.com'
        APP_NAME = 'my-service'
        BUILD_TAG = "${APP_NAME}-${BUILD_NUMBER}"

        // 凭证引用
        DOCKER_CREDENTIALS = credentials('docker-hub-creds')
        GIT_TOKEN = credentials('github-token')

        // 从文件加载
        VERSION = readFile('VERSION').trim()
    }
    stages {
        stage('Build Docker Image') {
            environment {
                // Stage 级环境变量，覆盖全局值
                IMAGE_TAG = "${BUILD_TAG}-${BRANCH_NAME}"
            }
            steps {
                sh 'docker build -t ${REGISTRY}/${APP_NAME}:${IMAGE_TAG} .'
            }
        }
        stage('Deploy') {
            environment {
                // 凭据展开为用户名密码
                USERNAME = "${DOCKER_CREDENTIALS_USR}"
                PASSWORD = "${DOCKER_CREDENTIALS_PSW}"
            }
            steps {
                sh 'docker login -u $USERNAME -p $PASSWORD $REGISTRY'
            }
        }
    }
}

pipeline {
    agent any
    stages {
        stage('Test') {
            steps { sh 'make test' }
            post {
                // always: 无论结果如何都执行
                always {
                    junit 'target/surefire-reports/*.xml'
                }
                // success: 构建成功时执行
                success {
                    archiveArtifacts artifacts: 'target/*.jar'
                }
                // failure: 构建失败时执行
                failure {
                    slackSend(color: '#ff0000', message: "Tests failed")
                }
                // unstable: 构建不稳定时执行（测试失败但构建成功）
                unstable {
                    echo 'Some tests failed, but build completed'
                }
                // aborted: 用户手动中止时执行
                aborted {
                    echo 'Build was manually aborted'
                }
                // changed: 结果与上次构建不同时执行
                changed {
                    emailext(
                        subject: "Build status changed for ${env.JOB_NAME}",
                        body: "Previous: ${currentBuild.previousBuild?.result}, Current: ${currentBuild.result}"
                    )
                }
                // regression: 从成功变为失败时执行
                regression {
                    echo 'This is a regression'
                }
                // fixed: 从失败变为成功时执行
                fixed {
                    echo 'Build was fixed'
                }
            }
        }
    }
    post {
        // Pipeline 级 post，全局收尾
        always {
            cleanWs()
        }
        failure {
            emailext(
                subject: "Pipeline Failed: ${env.JOB_NAME} - ${env.BUILD_NUMBER}",
                to: 'dev-team@example.com'
            )
        }
        cleanup {
            // 清理资源，在 always 之后执行
            sh 'docker system prune -f'
        }
    }
}

pipeline {
    triggers {
        // 分支发现策略：排除特定分支
        eventTrigger {
            eventHandlers {
                pushEvents {
                    excludes {
                        names {
                            includes("release/*")
                        }
                    }
                }
            }
        }
        // 忽略 WIP PR
        pullRequest {
            ignoreWhenCodeAnalysisSkipped()
        }
    }
    options {
        // 孤儿分支清理策略
        buildDiscarder(logRotator(daysToKeepStr: '30'))
    }
}

pipeline {
    agent any
    stages {
        stage('Build') {
            steps { sh 'make build' }
        }
        stage('Deploy to Staging') {
            when {
                // 分支条件
                branch 'develop'
                // 环境变量条件
                environment name: 'ENV', value: 'staging'
            }
            steps { sh 'deploy-staging.sh' }
        }
        stage('Deploy to Production') {
            when {
                // 多个条件 AND 组合
                allOf {
                    branch 'main'
                    expression { currentBuild.result == 'SUCCESS' }
                    tag "v*"
                }
            }
            steps { sh 'deploy-prod.sh' }
        }
        stage('Run E2E Tests') {
            when {
                // OR 组合
                anyOf {
                    branch 'main'
                    branch 'develop'
                    changeRequest()
                }
            }
            steps { sh 'run-e2e.sh' }
        }
        stage('Notify') {
            when {
                // 非条件
                not { branch 'main' }
                // 构建原因
                triggeredBy 'TimerTrigger'
            }
            steps { echo 'Scheduled notification' }
        }
        stage('SonarQube Analysis') {
            when {
                // 变更集特定路径
                changeset "src/**"
                // 仅在指定构建参数下执行
                beforeAgent true  // 在分配 Agent 前评估条件
            }
            steps { sh 'sonar-scanner' }
        }
    }
}

stage('Rolling Update') {
    when { branch 'main' }
    steps {
        sh """
            kubectl set image deployment/app \
                app=${REGISTRY}/${APP_NAME}:${BUILD_NUMBER} \
                --record
            kubectl rollout status deployment/app
        """
    }
}

stage('Blue/Green Deploy') {
    agent { label 'deploy' }
    steps {
        sh '''
            # 部署 Green 环境
            kubectl apply -f k8s/deployment-green.yaml
            kubectl set image deployment/app-green \
                app=registry/app:${BUILD_NUMBER}

            # 等待 Green 就绪
            kubectl rollout status deployment/app-green

            # 切换流量至 Green
            kubectl patch service app -p \
                '{"spec":{"selector":{"version":"green"}}}'

            # 销毁 Blue 环境
            kubectl delete deployment app-blue
        '''
    }
}

stage('Canary Deploy') {
    steps {
        sh '''
            # 部署 Canary 实例（10% 流量）
            kubectl scale deployment/app-canary --replicas=1
            kubectl set image deployment/app-canary \
                app=registry/app:${BUILD_NUMBER}

            # 等待 Canary 健康检查通过
            sleep 60

            # 逐步增加 Canary 实例数
            kubectl scale deployment/app-canary --replicas=3
            sleep 120

            # 全量切换
            kubectl set image deployment/app \
                app=registry/app:${BUILD_NUMBER}
            kubectl scale deployment/app-canary --replicas=0
        '''
    }
}

stage('Auto Rollback on Failure') {
    steps {
        script {
            try {
                sh 'kubectl rollout status deployment/app --timeout=300s'
            } catch (Exception e) {
                sh 'kubectl rollout undo deployment/app'
                currentBuild.result = 'FAILURE'
                error("Deployment failed, rolled back to previous version")
            }
        }
    }
}

pipeline {
    agent none
    stages {
        stage('Test') {
            failFast true  // 一个失败立即终止所有
            parallel {
                stage('Unit Tests') {
                    agent { docker 'openjdk:11' }
                    steps { sh 'mvn test' }
                }
                stage('Lint') {
                    agent { docker 'node:18' }
                    steps { sh 'npm run lint' }
                }
                stage('Security Scan') {
                    agent { docker 'sonarsource/sonar-scanner-cli' }
                    steps { sh 'sonar-scanner' }
                }
            }
        }
        stage('Integration Tests') {
            parallel {
                stage('API Tests') {
                    steps { sh 'newman run api-tests.json' }
                }
                stage('E2E Tests') {
                    steps {
                        timeout(time: 10, unit: 'MINUTES') {
                            sh 'npm run test:e2e'
                        }
                    }
                }
            }
        }
    }
}

pipeline {
    agent none
    stages {
        stage('Build Matrix') {
            matrix {
                // 定义矩阵轴
                axes {
                    axis {
                        name 'OS'
                        values 'linux', 'macos', 'windows'
                    }
                    axis {
                        name 'JDK'
                        values '11', '17', '21'
                    }
                    axis {
                        name 'BROWSER'
                        values 'chrome', 'firefox'
                    }
                }
                // 排除不需要的组合
                exclude {
                    axis {
                        name 'OS'
                        values 'macos'
                    }
                    axis {
                        name 'JDK'
                        values '11'
                    }
                }
                // 执行组合
                stages {
                    stage('Build') {
                        agent { label "${OS}-${JDK}" }
                        steps {
                            sh "echo Building on ${OS} with JDK ${JDK}"
                        }
                    }
                    stage('Browser Test') {
                        agent { docker "${OS}-tester" }
                        when {
                            expression { BROWSER != 'firefox' || OS == 'linux' }
                        }
                        steps {
                            sh "echo Testing ${BROWSER} on ${OS}"
                        }
                    }
                }
            }
        }
    }
}

pipeline {
    agent any
    stages {
        stage('Build & Test') {
            steps {
                sh 'mvn clean package'
            }
        }
        stage('Approval Gate') {
            input {
                message "批准部署到生产环境？"
                ok "确认部署"
                submitter "ops-lead,release-manager"
                submitterParameter "APPROVER"
                parameters {
                    string name: 'DEPLOY_VERSION', defaultValue: "${env.BUILD_NUMBER}"
                    text name: 'RELEASE_NOTES', defaultValue: 'Feature changes:'
                }
            }
            steps {
                echo "Approved by: ${APPROVER}"
                echo "Version: ${DEPLOY_VERSION}"
            }
        }
        stage('Deploy') {
            steps {
                sh "kubectl apply -f deploy.yaml"
            }
        }
    }
}

stage('Deploy with Timeout') {
    options {
        timeout(time: 1, unit: 'HOURS')
    }
    input {
        message "批准部署？"
        ok "Deploy"
    }
    steps {
        echo "Deploying..."
    }
}

stage('Auto Deploy with Approval') {
    options {
        timeout(time: 4, unit: 'HOURS')
    }
    input {
        message "批准发布？超时将自动回滚"
        ok "批准"
    }
    steps {
        script {
            try {
                input message: 'Approve?', ok: 'Yes'
                sh 'deploy-prod.sh'
            } catch (Exception e) {
                sh 'rollback.sh'
                currentBuild.result = 'ABORTED'
            }
        }
    }
}

pipeline {
    agent any
    stages {
        stage('Build App') {
            steps {
                sh 'mvn package'
            }
        }
        stage('Trigger Downstream') {
            steps {
                // 1. 基本触发：不等待结果
                build job: 'deploy-to-dev'

                // 2. 传递参数并等待结果
                def depResult = build job: 'integration-tests',
                    parameters: [
                        string(name: 'APP_VERSION', value: "${env.BUILD_NUMBER}"),
                        booleanParam(name: 'COVERAGE_CHECK', value: true)
                    ],
                    wait: true,
                    propagate: true
                echo "Downstream build result: ${depResult.result}"

                // 3. 触发后不传播失败状态
                build job: 'notify-slack', propagate: false

                // 4. 指定队列优先级
                build job: 'urgent-deploy', queueItemPriority: 10
            }
        }
    }
}

// 构建链与条件传递
stage('Deploy Chain') {
    steps {
        script {
            def buildResults = [:]

            // 并行触发多个下游
            def jobs = ['deploy-a', 'deploy-b', 'deploy-c']
            jobs.each { job ->
                buildResults[job] = build(
                    job: job,
                    propagate: true,
                    wait: true
                )
            }

            // 检查所有下游结果
            def allSuccess = buildResults.every { k, v -> v.result == 'SUCCESS' }
            if (!allSuccess) {
                error("Not all downstream builds succeeded")
            }
        }
    }
}

graph TD
    A[Build App - 上游] --> B[Unit Tests]
    A --> C[Integration Tests]
    A --> D[Deploy - 下游]
    B --> B1[Code Coverage]
    C --> C1[API Tests]
    C --> C2[DB Tests]
    D --> D1[Dev Deploy]
    D --> D2[Staging Deploy - 需审批]
    D --> D3[Prod Deploy - 需审批]

pipeline {
    agent any
    stages {
        stage('Checkout') {
            steps {
                // 1. 标准 checkout，使用 Jenkinsfile 中定义的 SCM 配置
                checkout scm

                // 2. 自定义 checkout，指定拉取策略
                checkout([
                    $class: 'GitSCM',
                    branches: [[name: '*/main']],
                    doGenerateSubmoduleConfigurations: false,
                    extensions: [
                        // 浅克隆，仅拉取最近 1 个 commit
                        [$class: 'CloneOption', depth: 1, noTags: true, reference: ''],

                        // 清理工作空间
                        [$class: 'WipeWorkspace'],

                        // 拉取子模块
                        [$class: 'SubmoduleOption',
                         disableSubmodules: false,
                         parentCredentials: true],

                        // 稀疏 checkout，仅拉取指定路径
                        [$class: 'SparseCheckoutPaths',
                         sparseCheckoutPaths: [[path: 'src/']]],

                        // 自定义工作空间目录
                        [$class: 'RelativeTargetDirectory',
                         relativeTargetDir: 'my-app'],

                        // 浅提交信息（按时间）
                        [$class: 'CloneOption',
                         shallow: true,
                         depth: 0,
                         timeout: 10]
                    ],
                    userRemoteConfigs: [[
                        url: 'https://github.com/org/repo.git',
                        credentialsId: 'github-token'
                    ]]
                ])
            }
        }
    }
}

stage('Optimize Checkout') {
    steps {
        // 多仓库源场景：并发拉取
        parallel(
            checkoutBackend: {
                checkout([$class: 'GitSCM',
                    userRemoteConfigs: [[url: 'git@github.com:org/backend.git']],
                    extensions: [[$class: 'CloneOption', depth: 1]]])
            },
            checkoutFrontend: {
                checkout([$class: 'GitSCM',
                    userRemoteConfigs: [[url: 'git@github.com:org/frontend.git']],
                    extensions: [[$class: 'CloneOption', depth: 1]]])
            }
        )
    }
}

pipeline {
    agent any
    tools {
        // 自动安装 Maven 3.9 并设置 MAVEN_HOME 和 PATH
        maven 'Maven-3.9'

        // 自动安装 JDK 17 并设置 JAVA_HOME
        jdk 'JDK-17'

        // 自动安装 Gradle 8.5
        gradle 'Gradle-8.5'

        // 自动安装 Node.js 18
        nodejs 'Node-18'
    }
    stages {
        stage('Build') {
            steps {
                sh 'mvn --version'
                sh 'java -version'
                sh 'gradle --version'
                sh 'node --version'
            }
        }
    }
}

Manage Jenkins > Global Tool Configuration

Maven:
  Name: Maven-3.9
  Version: 3.9.6
  Install automatically: true
  Install from Apache: latest

JDK:
  Name: JDK-17
  Version: 17.0.9
  Install automatically: true
  Install from adoptium.net

NodeJS:
  Name: Node-18
  Version: 18.20.0
  Install automatically: true
  Global npm packages to install: yarn

pipeline {
    agent any
    options {
        // Pipeline 级别超时：整个构建最多运行 60 分钟
        timeout(time: 60, unit: 'MINUTES')
    }
    stages {
        stage('Build') {
            steps {
                sh 'make build'
            }
        }
        stage('Flaky Test') {
            options {
                // Stage 级别超时：该 Stage 最多 10 分钟
                timeout(time: 10, unit: 'MINUTES')
            }
            steps {
                // 重试策略：失败后重试最多 3 次
                retry(3) {
                    sh 'make flaky-test'
                }
            }
            post {
                // 重试耗尽后的处理
                failure {
                    echo 'Flaky test failed after 3 retries'
                }
            }
        }
        stage('API Test') {
            steps {
                script {
                    // 超时 + 重试组合
                    timeout(time: 5, unit: 'MINUTES') {
                        retry(2) {
                            sh 'curl -sS http://api.example.com/health'
                        }
                    }
                }
            }
        }
    }
}

pipeline {
    agent any
    stages {
        stage('Quick Lint') {
            options {
                timeout(time: 1, unit: 'MINUTES')
                retry(1)
            }
            steps { sh 'npm run lint' }
        }
        stage('Full Test Suite') {
            options {
                timeout(time: 30, unit: 'MINUTES')
                retry(2)
                // 失败后保留工作空间
                preserveStashes()
            }
            steps { sh 'mvn verify' }
        }
        stage('Long Running') {
            options {
                timeout(time: 2, unit: 'HOURS')
            }
            steps { sh 'run-long-task.sh' }
        }
    }
    post {
        failure {
            // 超时或重试耗尽后的通知
            emailext(
                subject: "Build Timeout/Retry Exhausted: ${env.JOB_NAME}",
                body: "The build exceeded limits. Check ${env.BUILD_URL}",
                to: 'devops-team@example.com'
            )
        }
    }
}

// vars/dockerBuild.groovy
def call(Map config) {
    stage("Docker Build") {
        sh "docker build -t ${config.registry}/${config.image}:${config.tag} ."
    }
}

// test/vars/DockerBuildSpec.groovy
import com.lesfurets.jenkins.unit.*
import static org.junit.Assert.*

class DockerBuildSpec extends BasePipelineTest {

    def testDockerBuild() throws Exception {
        def script = loadScript("vars/dockerBuild.groovy")

        // 模拟执行
        script.call([
            registry: 'reg.example.com',
            image: 'my-app',
            tag: '1.0.0'
        ])

        // 验证 mock 调用
        printCallStack()
        assertTrue(helper.callStack.contains(
            "sh(docker build -t reg.example.com/my-app:1.0.0 .)"
        ))
    }
}

graph TD
    A[shared-library/] --> B[vars/]
    A --> C[src/]
    A --> D[test/]
    A --> E[Jenkinsfile]
    A --> F[pom.xml]
    B --> B1[dockerBuild.groovy]
    B --> B2[slackNotify.groovy]
    C --> C1[org/example/]
    C1 --> C2[Utils.groovy]
    D --> D1[vars/]
    D --> D2[src/]
    D1 --> D1a[DockerBuildSpec.groovy]
    D1 --> D1b[SlackNotifySpec.groovy]
    D2 --> D2a[org/example/]
    D2a --> D2b[UtilsSpec.groovy]

# 运行测试
mvn test

pipeline {
    agent any
    environment {
        REGISTRY = 'registry.example.com'
        IMAGE_NAME = 'my-app'
        IMAGE_TAG = "${BUILD_NUMBER}-${BRANCH_NAME}"
    }
    stages {
        stage('Build Binary') {
            steps {
                sh 'mvn clean package -DskipTests'
            }
        }
        stage('Docker Build') {
            steps {
                script {
                    docker.build(
                        "${REGISTRY}/${IMAGE_NAME}:${IMAGE_TAG}",
                        "--build-arg VERSION=${BUILD_NUMBER} ."
                    )
                }
            }
        }
        stage('Docker Push') {
            steps {
                script {
                    docker.withRegistry("https://${REGISTRY}", 'docker-registry-cred') {
                        docker.image("${REGISTRY}/${IMAGE_NAME}:${IMAGE_TAG}").push()
                        // 同时推送 latest 标签
                        docker.image("${REGISTRY}/${IMAGE_NAME}:${IMAGE_TAG}").push('latest')
                    }
                }
            }
        }
        stage('Docker Scan') {
            steps {
                sh "trivy image ${REGISTRY}/${IMAGE_NAME}:${IMAGE_TAG} --severity HIGH,CRITICAL"
            }
        }
    }
}

# Dockerfile
FROM maven:3.8-openjdk-11 AS builder
WORKDIR /app
COPY pom.xml .
RUN mvn dependency:go-offline
COPY src/ ./src/
RUN mvn package -DskipTests

FROM openjdk:11-jre-slim
WORKDIR /app
COPY --from=builder /app/target/*.jar app.jar
EXPOSE 8080
ENTRYPOINT ["java", "-jar", "app.jar"]

stage('Security Scan') {
    steps {
        sh """
            trivy image ${REGISTRY}/${IMAGE_NAME}:${IMAGE_TAG} \
                --severity HIGH,CRITICAL \
                --exit-code 1 \
                --ignore-unfixed
        """
    }
}

pipeline {
    agent any
    environment {
        REGISTRY = 'registry.example.com'
        APP = 'my-service'
        NAMESPACE = 'production'
        K8S_CONFIG = credentials('kubeconfig')
    }
    stages {
        stage('Build Image') {
            steps {
                sh "docker build -t ${REGISTRY}/${APP}:${BUILD_NUMBER} ."
                sh "docker push ${REGISTRY}/${APP}:${BUILD_NUMBER}"
            }
        }
        stage('Update Manifests') {
            steps {
                sh """
                    sed -i 's|image:.*|image: ${REGISTRY}/${APP}:${BUILD_NUMBER}|' \
                        k8s/deployment.yaml
                """
            }
        }
        stage('Deploy to K8s') {
            steps {
                withKubeConfig([credentialsId: 'k8s-prod-credentials']) {
                    sh """
                        kubectl apply -f k8s/ -n ${NAMESPACE}
                        kubectl rollout status deployment/${APP} -n ${NAMESPACE} \
                            --timeout=300s
                    """
                }
            }
        }
        stage('Verify Deployment') {
            steps {
                sh """
                    kubectl get pods -n ${NAMESPACE} -l app=${APP}
                    kubectl get svc -n ${NAMESPACE} -l app=${APP}
                    curl -sS http://${APP}.${NAMESPACE}.svc.cluster.local/health
                """
            }
        }
    }
}

stage('Helm Deploy') {
    steps {
        script {
            sh """
                helm upgrade --install ${APP} ./chart \
                    --namespace ${NAMESPACE} \
                    --set image.repository=${REGISTRY}/${APP} \
                    --set image.tag=${BUILD_NUMBER} \
                    --set replicaCount=3 \
                    --wait \
                    --timeout 10m
            """
        }
    }
}

# k8s/deployment.yaml
apiVersion: apps/v1
kind: Deployment
metadata:
  name: my-service
spec:
  replicas: 3
  strategy:
    type: RollingUpdate
    rollingUpdate:
      maxSurge: 1
      maxUnavailable: 0
  template:
    spec:
      containers:
      - name: app
        image: registry.example.com/my-service:latest
        livenessProbe:
          httpGet: { path: /health, port: 8080 }
          initialDelaySeconds: 30
        readinessProbe:
          httpGet: { path: /ready, port: 8080 }
          initialDelaySeconds: 10

# 基础健康检查
GET /health-check
Response: {"healthy": true, "score": 95}

# 详细健康检查（需认证）
GET /health-check/api
Response:
{
  "disk": {"healthy": true, "freeSpace": 10737418240},
  "memory": {"healthy": true, "totalMemory": 8589934592},
  "plugins": {"healthy": true, "failedPlugins": []},
  "temporarySpace": {"healthy": true, "freeSpace": 2147483648}
}

# Prometheus 指标端点
GET /prometheus

# PrometheusRule
groups:
- name: jenkins
  rules:
  - alert: JenkinsHealthScoreLow
    expr: jenkins_health_check_score < 50
    for: 5m
    labels: { severity: critical }
    annotations:
      summary: "Jenkins health score below 50"

  - alert: JenkinsQueueTooLong
    expr: jenkins_queue_size > 50
    for: 10m
    labels: { severity: warning }
    annotations:
      summary: "Jenkins queue has XQOPEN $value XQCLOSE pending jobs"

  - alert: JenkinsAgentsOffline
    expr: jenkins_node_online_count < 2
    for: 5m
    labels: { severity: critical }
    annotations:
      summary: "Less than 2 agents online"

  - alert: JenkinsJVMHighMemory
    expr: jvm_memory_used_bytes / jvm_memory_max_bytes > 0.9
    for: 15m
    labels: { severity: warning }
    annotations:
      summary: "JVM heap usage above 90%"

  - alert: JenkinsDiskFull
    expr: (jenkins_disk_space_total - jenkins_disk_space_available) / jenkins_disk_space_total > 0.9
    for: 5m
    labels: { severity: critical }
    annotations:
      summary: "Jenkins disk usage above 90%"

# Earthfile
source:
  - /var/jenkins_home/logs/jenkins.log
  - /var/jenkins_home/logs/access.log

# 关键日志模式
"SEVERE" | "ERROR" | "FATAL"
"Plugin.*failed to load"
"OutOfMemoryError"
"Unable to connect to agent"
"Queue.*stuck"