<!-- Maven settings.xml -->
<mirrors>
    <mirror>
        <id>nexus</id>
        <url>http://nexus.internal/repository/maven-public/</url>
        <mirrorOf>*</mirrorOf>
    </mirror>
</mirrors>

# Maven：指定本地倉庫位置
mvn install -Dmaven.repo.local=/cache/.m2

# Gradle：啟用構建快取
gradle build --build-cache

# npm：使用快取
npm ci --cache /cache/.npm

# Maven：只構建有變化的模組
mvn install -pl :changed-module -am

# Gradle：預設支援增量構建
gradle build  # 自動跳過未變化的任務

# Maven：並行構建
mvn install -T 4  # 使用 4 個線程
mvn install -T 1C  # 每個 CPU 核心一個線程

# Gradle：並行構建
gradle build --parallel

# 利用分層快取的 Dockerfile
FROM openjdk:11-jre-slim

# 先複製依賴（不常變化）
COPY pom.xml /app/
RUN mvn dependency:go-offline

# 再複製原始碼（經常變化）
COPY src /app/src
RUN mvn package -DskipTests

<plugin>
    <groupId>org.apache.maven.plugins</groupId>
    <artifactId>maven-enforcer-plugin</artifactId>
    <version>3.0.0</version>
    <executions>
        <execution>
            <id>enforce</id>
            <goals>
                <goal>enforce</goal>
            </goals>
            <configuration>
                <rules>
                    <!-- 依賴收斂：確保沒有依賴衝突 -->
                    <dependencyConvergence/>

                    <!-- 禁止特定依賴 -->
                    <bannedDependencies>
                        <excludes>
                            <exclude>commons-logging:*</exclude>
                            <exclude>log4j:log4j</exclude>
                        </excludes>
                    </bannedDependencies>

                    <!-- 要求最低 Java 版本 -->
                    <requireJavaVersion>
                        <version>[11,)</version>
                    </requireJavaVersion>

                    <!-- 要求最低 Maven 版本 -->
                    <requireMavenVersion>
                        <version>[3.6,)</version>
                    </requireMavenVersion>

                    <!-- 禁止 SNAPSHOT 依賴（發布時）-->
                    <requireReleaseDeps>
                        <onlyWhenRelease>true</onlyWhenRelease>
                    </requireReleaseDeps>
                </rules>
            </configuration>
        </execution>
    </executions>
</plugin>

stages:
  - build # 編譯打包
  - test # 測試
  - analyze # 靜態分析
  - package # 製品打包
  - deploy # 部署

pipeline {
    agent any

    environment {
        MAVEN_OPTS = '-Dmaven.repo.local=/cache/.m2'
    }

    stages {
        stage('Checkout') {
            steps {
                checkout scm
            }
        }

        stage('Build') {
            steps {
                sh 'mvn clean compile -T 1C'
            }
        }

        stage('Test') {
            parallel {
                stage('Unit Tests') {
                    steps {
                        sh 'mvn test'
                    }
                }
                stage('Static Analysis') {
                    steps {
                        sh 'mvn sonar:sonar'
                    }
                }
            }
        }

        stage('Package') {
            steps {
                sh 'mvn package -DskipTests'
            }
        }

        stage('Deploy to Staging') {
            when {
                branch 'main'
            }
            steps {
                sh './deploy.sh staging'
            }
        }
    }

    post {
        always {
            junit '**/target/surefire-reports/*.xml'
            archiveArtifacts artifacts: 'target/*.jar'
        }
        failure {
            slackSend channel: '#ci-alerts',
                      message: "Build Failed: ${env.JOB_NAME}"
        }
    }
}

# Jenkins Kubernetes Plugin 組態
apiVersion: v1
kind: Pod
metadata:
  labels:
    jenkins: slave
spec:
  containers:
    - name: jnlp
      image: jenkins/jnlp-slave:latest
      resources:
        requests:
          cpu: "1"
          memory: "2Gi"
        limits:
          cpu: "2"
          memory: "4Gi"
    - name: maven
      image: maven:3.8-openjdk-11
      command: ["cat"]
      tty: true

# 推薦：使用官方精簡映像
FROM openjdk:11-jre-slim

# 避免：使用完整 OS 映像
# FROM ubuntu:20.04

# 構建階段
FROM maven:3.8-openjdk-11 AS builder
WORKDIR /build
COPY pom.xml .
RUN mvn dependency:go-offline
COPY src ./src
RUN mvn package -DskipTests

# 運行階段
FROM openjdk:11-jre-slim
WORKDIR /app
COPY --from=builder /build/target/*.jar app.jar
EXPOSE 8080
CMD ["java", "-jar", "app.jar"]

# 不經常變化的層放前面
COPY pom.xml .
RUN mvn dependency:go-offline

# 經常變化的層放後面
COPY src ./src
RUN mvn package

# 合併 RUN 指令
RUN apt-get update && \
    apt-get install -y curl vim && \
    apt-get clean && \
    rm -rf /var/lib/apt/lists/*

# 掃描映像漏洞
clair-scanner --ip $(hostname -i) \
    -r report.json \
    myapp:latest

# 使用有意義的標籤
myapp:1.2.3                    # 語義版本
myapp:1.2.3-abc1234            # 版本 + Git Commit
myapp:20231215-abc1234         # 日期 + Git Commit

# 避免
myapp:latest                   # 難以追蹤版本