jenkins_config.yml.j2

---
# Configuration-as-code plugin https://plugins.jenkins.io/configuration-as-code/

# Use https://ci.sandbox.datagov.us/configuration-as-code/ to export the
# existing configuration for copy/pasting snippets. The plugin does not
# recommend copying the entire configuration as not all options are compatible
# with the configuration-as-code plugin.
#
# TODO resolve whitespace, can we set trim_blocks in Ansible?
# Currently this file is plain text, not YAML. Be careful with Jinja tags
# because whitespace is not trimmed by default.

jenkins:
  systemMessage: "{{ jenkins_system_message }}"
  globalNodeProperties:
    - envVars:
        env:
        - key: "DATAGOV_WORKFLOW"
          value: "{{ jenkins_workflow }}"
  authorizationStrategy:
    roleBased:
      roles:
        global:
          - name: admin
            pattern: .*
            assignments: [admin, {{ jenkins_admins | join(', ') }}]
            permissions: [{{ jenkins_admins_permissions | join(', ') }}]
          - name: build-manager
            pattern: .*
            assignments:
              - ci
            permissions:
              - Job/Build
              - Job/Read
              - Overall/Read
        items: []

  securityRealm:
    saml:
      advancedConfiguration:
        forceAuthn: false
        spEntityId: "{{ jenkins_saml_sp_entity_id }}"
      binding: "urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect"
      displayNameAttributeName: "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name"
      emailAttributeName: "email"
      encryptionData:
        forceSignRedirectBindingAuthnRequest: false
        keystorePassword: "{{ jenkins_saml_keystore_password }}"
        keystorePath: "/data/jenkins/saml-key.jks"
        privateKeyAlias: "saml-key"
        privateKeyPassword: "{{ jenkins_saml_private_key_password }}"
      groupsAttributeName: "http://schemas.xmlsoap.org/claims/Group"
      idpMetadataConfiguration:
        period: 1440
        url: "{{ jenkins_saml_idp_metadata_url }}"
      logoutUrl: "{{ jenkins_saml_idp_logout_url }}"
      maximumAuthenticationLifetime: 86400
      usernameAttributeName: "email"
      usernameCaseConversion: "lowercase"


unclassified:
  gitHubPluginConfig:
    configs:
      - credentialsId: "github-datagov-bot"
        manageHooks: false
        name: "GitHub"
    hookUrl: "https://{{ jenkins_url }}/github-webhook/"
  location:
    adminAddress: "{{ datagov_team_email }}"
    url: "https://{{ jenkins_url }}/"
  timestamper:
    allPipelines: true

# https://plugins.jenkins.io/job-dsl/
# https://ci.sandbox.datagov.us/plugin/job-dsl/api-viewer/index.html
jobs:
{% for job in jenkins_jobs %}
  - script: |
      multibranchPipelineJob('{{ job.name }}-mb') {
        branchSources {
          branchSource {
            source {
              git {
                remote('{{ job.git_url }}')
                credentialsId('datagov-bot-gh')
                traits {
                  gitBranchDiscovery()
                  wipeWorkspaceTrait()
                }
              }
            }
          }
        }
        orphanedItemStrategy {
          discardOldItems {
            daysToKeep(90)
          }
        }
        triggers {
          periodicFolderTrigger {
            interval('5')
          }
        }
      }
{% endfor %}