Contrarian View: Why You Should Still Use Jenkins 2.460 Over GitHub Actions 3.0 for Complex CI/CD

// Jenkins 2.460 Declarative Pipeline for multi-module monorepo with conditional parallel builds
// Requires Jenkins 2.460+, Pipeline plugin 2.6+, Docker plugin 1.3+
pipeline {
    agent none // Use per-stage agents for isolation
    options {
        timeout(time: 120, unit: 'MINUTES') // Global pipeline timeout
        retry(2) // Retry entire pipeline on non-fatal failure
        disableConcurrentBuilds() // Prevent conflicting builds for same branch
        buildDiscarder(logRotator(numToKeepStr: '50')) // Retain last 50 builds for audit
    }
    parameters {
        choice(name: 'DEPLOY_ENV', choices: ['dev', 'staging', 'prod'], description: 'Target deployment environment')
        booleanParam(name: 'RUN_INTEGRATION_TESTS', defaultValue: true, description: 'Toggle integration test suite')
        string(name: 'HOTFIX_BRANCH', defaultValue: '', description: 'Optional hotfix branch to cherry-pick')
    }
    environment {
        DOCKER_REGISTRY = 'gcr.io/my-org/ci-cd-demo'
        NODE_VERSION = '20.18.0'
        JAVA_HOME = tool name: 'JDK-17', type: 'jdk' // Use Jenkins-configured JDK tool
    }
    stages {
        stage('Pre-flight Checks') {
            agent { label 'linux-base' } // Use pre-configured base agent
            steps {
                script {
                    // Validate parameters
                    if (params.DEPLOY_ENV == 'prod' && env.BRANCH_NAME != 'main') {
                        error('Production deployments only allowed from main branch')
                    }
                    // Cherry-pick hotfix if provided
                    if (params.HOTFIX_BRANCH) {
                        sh "git cherry-pick origin/${params.HOTFIX_BRANCH} || error('Hotfix cherry-pick failed')"
                    }
                    // Check disk space to prevent build failures
                    sh 'df -h . | grep -v Filesystem | awk \'{print $5}\' | sed \'s/%//\' | while read usage; do if [ $usage -gt 85 ]; then error("Disk usage ${usage}% exceeds 85% limit"); fi; done'
                }
            }
            post {
                failure {
                    slackSend(color: 'danger', message: "Pre-flight checks failed for ${env.JOB_NAME} ${env.BUILD_NUMBER}: ${currentBuild.description}")
                }
            }
        }
        stage('Parallel Build & Test') {
            failFast: true // Fail entire stage if any parallel task fails
            parallel {
                stage('Backend Build (Java)') {
                    agent { label 'java-17' }
                    steps {
                        retry(3) {
                            sh 'mvn clean package -DskipTests -T 4' // Parallel maven build
                        }
                        stash name: 'backend-jar', includes: 'target/*.jar' // Stash artifacts for later stages
                    }
                    post {
                        failure {
                            archiveArtifacts artifacts: 'target/surefire-reports/**', fingerprint: true
                        }
                    }
                }
                stage('Frontend Build (Node)') {
                    agent { label 'node-20' }
                    steps {
                        retry(2) {
                            sh 'npm ci --cache .npm'
                            sh 'npm run build'
                        }
                        stash name: 'frontend-dist', includes: 'dist/**'
                    }
                }
                stage('Lint & Static Analysis') {
                    agent { label 'linux-base' }
                    steps {
                        sh 'npm run lint'
                        sh 'mvn checkstyle:check'
                        sh 'docker run --rm -v $(pwd):/app ghcr.io/sonarsource/sonar-scanner-cli:5.0 -Dsonar.projectKey=my-org-ci-cd-demo'
                    }
                }
            }
        }
        stage('Integration Tests') {
            when {
                allOf {
                    expression { params.RUN_INTEGRATION_TESTS }
                    not { branch 'hotfix/*' } // Skip integration tests for hotfixes
                }
            }
            agent { label 'integration-env' }
            steps {
                unstash 'backend-jar'
                unstash 'frontend-dist'
                sh 'docker-compose -f docker-compose.test.yml up -d'
                retry(2) {
                    sh 'mvn verify -Dit.test=*IT -T 2'
                }
                sh 'docker-compose -f docker-compose.test.yml down -v' // Clean up test env
            }
            post {
                always {
                    junit testResults: 'target/failsafe-reports/**/*.xml'
                }
            }
        }
        stage('Build & Push Docker Images') {
            agent { label 'docker' }
            steps {
                unstash 'backend-jar'
                unstash 'frontend-dist'
                script {
                    def backendImage = docker.build("${env.DOCKER_REGISTRY}/backend:${env.BUILD_ID}", "-f Dockerfile.backend .")
                    def frontendImage = docker.build("${env.DOCKER_REGISTRY}/frontend:${env.BUILD_ID}", "-f Dockerfile.frontend .")
                    docker.withRegistry('https://gcr.io', 'gcr-credentials') {
                        backendImage.push()
                        frontendImage.push()
                        if (params.DEPLOY_ENV == 'prod') {
                            backendImage.push('latest')
                            frontendImage.push('latest')
                        }
                    }
                }
            }
        }
        stage('Deploy to Target Env') {
            agent { label 'deploy' }
            when {
                anyOf {
                    branch 'main'
                    branch 'hotfix/*'
                }
            }
            steps {
                script {
                    sh "kubectl config use-context ${params.DEPLOY_ENV}-cluster"
                    sh "helm upgrade --install my-app ./helm-chart --set image.backend.tag=${env.BUILD_ID} --set image.frontend.tag=${env.BUILD_ID} --namespace ${params.DEPLOY_ENV}"
                }
            }
            post {
                success {
                    slackSend(color: 'good', message: "Deployed ${env.BUILD_ID} to ${params.DEPLOY_ENV} successfully")
                }
                failure {
                    slackSend(color: 'danger', message: "Deployment to ${params.DEPLOY_ENV} failed for ${env.BUILD_ID}")
                    sh "helm rollback my-app 0 --namespace ${params.DEPLOY_ENV}" // Rollback on failure
                }
            }
        }
    }
    post {
        always {
            cleanWs() // Clean workspace to prevent disk bloat
        }
    }
}

# GitHub Actions 3.0 workflow for same multi-module monorepo
# Note: This workflow hits multiple hard limits of Actions 3.0 (concurrency, matrix dimensions, artifact size)
name: CI/CD Pipeline
on:
  push:
    branches: [ main, staging, dev, 'hotfix/*' ]
  pull_request:
    branches: [ main ]

env:
  DOCKER_REGISTRY: gcr.io/my-org/ci-cd-demo
  NODE_VERSION: '20.18.0'
  JAVA_VERSION: '17'

jobs:
  pre-flight-checks:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout code
        uses: actions/checkout@v4
        with:
          fetch-depth: 0 # Required for cherry-pick

      - name: Validate parameters
        run: |
          if [ "${{ github.ref }}" != "refs/heads/main" ] && [ "${{ inputs.DEPLOY_ENV }}" == "prod" ]; then
            echo "::error::Production deployments only allowed from main branch"
            exit 1
          fi
        # Note: GitHub Actions has no native parameter input for push events, requires manual workflow dispatch for inputs

      - name: Cherry-pick hotfix (manual dispatch only)
        if: inputs.HOTFIX_BRANCH != ''
        run: |
          git cherry-pick origin/${{ inputs.HOTFIX_BRANCH }} || (echo "::error::Hotfix cherry-pick failed" && exit 1)

      - name: Check disk space
        run: |
          usage=$(df -h . | grep -v Filesystem | awk '{print $5}' | sed 's/%//')
          if [ $usage -gt 85 ]; then
            echo "::error::Disk usage ${usage}% exceeds 85% limit"
            exit 1
          fi

  parallel-build-test:
    needs: pre-flight-checks
    runs-on: ubuntu-latest
    strategy:
      fail-fast: true
      matrix:
        module: [backend, frontend, lint] # Max 3 matrix dimensions in Actions 3.0
    steps:
      - name: Checkout code
        uses: actions/checkout@v4

      - name: Setup Java
        if: matrix.module == 'backend'
        uses: actions/setup-java@v4
        with:
          java-version: ${{ env.JAVA_VERSION }}
          distribution: 'temurin'

      - name: Setup Node
        if: matrix.module == 'frontend' || matrix.module == 'lint'
        uses: actions/setup-node@v4
        with:
          node-version: ${{ env.NODE_VERSION }}
          cache: 'npm'

      - name: Build Backend
        if: matrix.module == 'backend'
        run: |
          mvn clean package -DskipTests -T 4
        continue-on-error: false
        # Note: No native retry for steps, requires 3rd party action or custom loop
        # Retry logic example (adds 10+ lines per step):
        # - name: Retry Backend Build
        #   run: |
        #     for i in {1..3}; do mvn clean package -DskipTests -T 4 && break || echo "Attempt $i failed"; done

      - name: Build Frontend
        if: matrix.module == 'frontend'
        run: |
          npm ci --cache .npm
          npm run build

      - name: Lint & Static Analysis
        if: matrix.module == 'lint'
        run: |
          npm run lint
          mvn checkstyle:check
          docker run --rm -v $(pwd):/app ghcr.io/sonarsource/sonar-scanner-cli:5.0 -Dsonar.projectKey=my-org-ci-cd-demo
        # Note: Docker in Actions requires privileged runner, which is not available on free/team tiers

  integration-tests:
    needs: parallel-build-test
    runs-on: ubuntu-latest
    if: inputs.RUN_INTEGRATION_TESTS == true && !startsWith(github.ref, 'refs/heads/hotfix/')
    steps:
      - name: Checkout code
        uses: actions/checkout@v4

      - name: Setup Java
        uses: actions/setup-java@v4
        with:
          java-version: ${{ env.JAVA_VERSION }}
          distribution: 'temurin'

      - name: Run Integration Tests
        run: |
          docker-compose -f docker-compose.test.yml up -d
          mvn verify -Dit.test=*IT -T 2
          docker-compose -f docker-compose.test.yml down -v
        # Note: Integration test concurrency is limited by account-level concurrency limits (20 for Enterprise)

  build-push-docker:
    needs: integration-tests
    runs-on: ubuntu-latest
    steps:
      - name: Checkout code
        uses: actions/checkout@v4

      - name: Login to GCR
        uses: docker/login-action@v3
        with:
          registry: gcr.io
          username: _json_key
          password: ${{ secrets.GCR_CREDENTIALS }}

      - name: Build and push backend image
        uses: docker/build-push-action@v5
        with:
          context: .
          file: Dockerfile.backend
          push: true
          tags: ${{ env.DOCKER_REGISTRY }}/backend:${{ github.run_id }}

      - name: Build and push frontend image
        uses: docker/build-push-action@v5
        with:
          context: .
          file: Dockerfile.frontend
          push: true
          tags: ${{ env.DOCKER_REGISTRY }}/frontend:${{ github.run_id }}

  deploy:
    needs: build-push-docker
    runs-on: ubuntu-latest
    if: github.ref == 'refs/heads/main' || startsWith(github.ref, 'refs/heads/hotfix/')
    environment: ${{ inputs.DEPLOY_ENV }} # Requires GitHub Environments for approvals, which have their own concurrency limits
    steps:
      - name: Checkout code
        uses: actions/checkout@v4

      - name: Setup kubectl
        uses: azure/setup-kubectl@v3
        with:
          version: 'latest'

      - name: Deploy to cluster
        run: |
          kubectl config use-context ${{ inputs.DEPLOY_ENV }}-cluster
          helm upgrade --install my-app ./helm-chart --set image.backend.tag=${{ github.run_id }} --set image.frontend.tag=${{ github.run_id }} --namespace ${{ inputs.DEPLOY_ENV }}
        continue-on-error: false

      - name: Rollback on failure
        if: failure()
        run: |
          helm rollback my-app 0 --namespace ${{ inputs.DEPLOY_ENV }}
          echo "::error::Deployment failed, rolled back to previous version"

// Jenkins 2.460 Shared Library: src/org/myorg/ci/PipelineUtils.groovy
// Reusable shared logic for all pipelines in the org, supports complex error handling and audit logging
package org.myorg.ci

import jenkins.model.Jenkins
import hudson.model.Result
import groovy.json.JsonOutput

class PipelineUtils implements Serializable {
    // Static configuration loaded from Jenkins global config
    static final String SLACK_CHANNEL = Jenkins.instance.getGlobalNodeProperties().get(0).getEnvVars()['SLACK_CHANNEL']
    static final String AUDIT_LOG_PATH = '/var/log/jenkins/audit/pipeline-events.log'
    static final Integer MAX_RETRY_COUNT = 3

    /**
     * Send standardized Slack notification with audit trail ID
     * @param build Current Jenkins build object
     * @param status Build status (SUCCESS, FAILURE, ABORTED)
     * @param message Additional context message
     */
    static void sendSlackNotification(def build, String status, String message) {
        try {
            def color = status == 'SUCCESS' ? 'good' : status == 'FAILURE' ? 'danger' : 'warning'
            def auditId = UUID.randomUUID().toString()
            def slackMessage = """
                {
                    "channel": "${SLACK_CHANNEL}",
                    "color": "${color}",
                    "text": "Pipeline ${build.projectName} #${build.number} ${status}",
                    "attachments": [
                        {
                            "fields": [
                                { "title": "Branch", "value": "${build.env.BRANCH_NAME}", "short": true },
                                { "title": "Commit", "value": "${build.env.GIT_COMMIT.take(7)}", "short": true },
                                { "title": "Audit ID", "value": "${auditId}", "short": false },
                                { "title": "Message", "value": "${message}", "short": false }
                            ]
                        }
                    ]
                }
            """
            // Use Jenkins Slack plugin to send message
            Jenkins.instance.getExtensionList(org.jenkinsci.plugins.slack.SlackNotifier).first().publish(
                slackMessage,
                null,
                null
            )
            // Log audit event to file for compliance
            logAuditEvent(build, auditId, "SLACK_NOTIFICATION_SENT", status)
        } catch (Exception e) {
            println "Failed to send Slack notification: ${e.getMessage()}"
            logAuditEvent(build, null, "SLACK_NOTIFICATION_FAILED", e.getMessage())
        }
    }

    /**
     * Retry a closure with exponential backoff, up to MAX_RETRY_COUNT
     * @param closure Closure to execute
     * @param retryCount Current retry attempt (starts at 0)
     * @return Result of closure execution
     */
    static def retryWithBackoff(Closure closure, Integer retryCount = 0) {
        try {
            return closure.call()
        } catch (Exception e) {
            if (retryCount >= MAX_RETRY_COUNT) {
                throw new RuntimeException("Max retries (${MAX_RETRY_COUNT}) exceeded: ${e.getMessage()}", e)
            }
            def backoffSeconds = Math.pow(2, retryCount) * 5 // 5, 10, 20 seconds backoff
            println "Attempt ${retryCount + 1} failed: ${e.getMessage()}. Retrying in ${backoffSeconds} seconds..."
            sleep(backoffSeconds * 1000)
            return retryWithBackoff(closure, retryCount + 1)
        }
    }

    /**
     * Log audit event to file for compliance (HIPAA, PCI-DSS)
     * @param build Current Jenkins build
     * @param auditId Unique audit ID for the event
     * @param eventType Type of event (e.g., DEPLOY, BUILD, FAILURE)
     * @param details Additional event details
     */
    static void logAuditEvent(def build, String auditId, String eventType, String details) {
        try {
            def event = [
                timestamp: new Date().format("yyyy-MM-dd'T'HH:mm:ss'Z'"),
                auditId: auditId,
                jobName: build.projectName,
                buildNumber: build.number,
                userId: build.getCause(org.jenkinsci.plugins.workflow.cps.replay.ReplayCause)?.getUser()?.getId() ?: build.getCause(hudson.model.Cause.UserIdCause)?.getUserId() ?: 'system',
                eventType: eventType,
                details: details,
                branch: build.env.BRANCH_NAME,
                commitHash: build.env.GIT_COMMIT
            ]
            def eventJson = JsonOutput.toJson(event)
            new File(AUDIT_LOG_PATH).withWriterAppend { writer ->
                writer.writeLine(eventJson)
            }
        } catch (Exception e) {
            println "Failed to log audit event: ${e.getMessage()}"
        }
    }

    /**
     * Validate deployment prerequisites for regulated environments
     * @param deployEnv Target deployment environment
     * @param allowedBranches List of branches allowed to deploy to env
     * @return True if prerequisites are met, throws error otherwise
     */
    static boolean validateDeploymentPrereqs(String deployEnv, List allowedBranches) {
        def currentBranch = Jenkins.instance.getJob(Build.currentBuild.projectName).getBuild(Build.currentBuild.number).env.BRANCH_NAME
        if (!allowedBranches.contains(currentBranch)) {
            throw new IllegalArgumentException("Branch ${currentBranch} not allowed to deploy to ${deployEnv}. Allowed: ${allowedBranches}")
        }
        if (deployEnv == 'prod' && Jenkins.instance.getJob(Build.currentBuild.projectName).getBuild(Build.currentBuild.number).env.CHANGE_ID) {
            throw new IllegalArgumentException("Production deployments from PR branches are not allowed")
        }
        return true
    }
}

// Example usage of Shared Library in Jenkinsfile
@Library('my-org-ci-lib@v2.3.1') _ // Pin to specific version
import org.myorg.ci.PipelineUtils

pipeline {
    agent any
    stages {
        stage('Deploy') {
            steps {
                script {
                    // Validate deployment prereqs using shared lib
                    PipelineUtils.validateDeploymentPrereqs(params.DEPLOY_ENV, ['main', 'staging'])
                    // Retry deployment with backoff
                    PipelineUtils.retryWithBackoff({
                        sh "helm upgrade --install my-app ./helm-chart --namespace ${params.DEPLOY_ENV}"
                    })
                }
            }
        }
    }
    post {
        success {
            PipelineUtils.sendSlackNotification(currentBuild, 'SUCCESS', 'Deployment completed')
        }
        failure {
            PipelineUtils.sendSlackNotification(currentBuild, 'FAILURE', currentBuild.description)
        }
    }
}

// Jenkins Kubernetes Pod Template for dynamic agent provisioning
podTemplate(
    label: 'k8s-java-17',
    containers: [
        containerTemplate(name: 'jnlp', image: 'jenkins/inbound-agent:3107.v665000b_51092', args: '${computer.jnlpmac} ${computer.name}'),
        containerTemplate(name: 'java', image: 'eclipse-temurin:17-jdk', command: 'cat', ttyEnabled: true),
        containerTemplate(name: 'docker', image: 'docker:24.0.6-dind', privileged: true)
    ],
    volumes: [hostPathVolume(hostPath: '/var/run/docker.sock', mountPath: '/var/run/docker.sock')]
) {
    node('k8s-java-17') {
        stage('Build') {
            container('java') {
                sh 'mvn clean package'
            }
        }
    }
}

// Jenkinsfile compatible with Blue Ocean visual editor
pipeline {
    agent any
    stages {
        stage('Build') {
            steps {
                sh 'mvn clean package'
            }
        }
        stage('Test') {
            parallel {
                stage('Unit Tests') {
                    steps { sh 'mvn test' }
                }
                stage('Integration Tests') {
                    steps { sh 'mvn verify' }
                }
            }
        }
        stage('Deploy') {
            steps { sh 'helm upgrade --install my-app ./helm-chart' }
        }
    }
}