We Ditched Jenkins 2.450 for GitHub Actions 3.0: Why Self-Hosted CI Is Dead

// Jenkins Declarative Pipeline for Order Service (Jenkins 2.450)
// Requires: Jenkins 2.450+, JDK 17, Docker 24.0+, kubectl 1.28+
pipeline {
    agent {
        label 'self-hosted-jdk17' // Our self-hosted agent with JDK 17
    }
    options {
        timeout(time: 30, unit: 'MINUTES') // Fail if pipeline runs longer than 30m
        disableConcurrentBuilds() // Prevent concurrent builds for same branch
        buildDiscarder(logRotator(numToKeepStr: '10')) // Keep last 10 builds
    }
    environment {
        DOCKER_REGISTRY = 'ghcr.io/our-org'
        IMAGE_NAME = 'order-service'
        JDK_VERSION = '17'
        MAVEN_OPTS = '-Xmx2g -XX:MaxMetaspaceSize=512m'
        SLACK_CHANNEL = '#ci-alerts'
    }
    stages {
        stage('Checkout') {
            steps {
                checkout scm
                // Verify JDK version on agent
                sh 'java -version'
            }
            post {
                failure {
                    slackSend(color: 'danger', message: "Checkout failed for ${env.JOB_NAME} ${env.BUILD_NUMBER}")
                }
            }
        }
        stage('Unit Test') {
            steps {
                sh 'mvn -B clean test -Dmaven.test.failure.ignore=false'
            }
            post {
                always {
                    junit allowEmptyResults: true, testResults: 'target/surefire-reports/*.xml'
                }
                failure {
                    slackSend(color: 'danger', message: "Unit tests failed for ${env.JOB_NAME} ${env.BUILD_NUMBER}")
                }
            }
        }
        stage('Build & Push Docker Image') {
            when {
                branch 'main'
            }
            steps {
                script {
                    def imageTag = "${env.BUILD_NUMBER}-${env.GIT_COMMIT.take(7)}"
                    sh "docker build -t ${env.DOCKER_REGISTRY}/${env.IMAGE_NAME}:${imageTag} ."
                    withCredentials([usernamePassword(credentialsId: 'ghcr-creds', usernameVariable: 'DOCKER_USER', passwordVariable: 'DOCKER_PASS')]) {
                        sh "echo ${DOCKER_PASS} | docker login ${env.DOCKER_REGISTRY} -u ${DOCKER_USER} --password-stdin"
                        sh "docker push ${env.DOCKER_REGISTRY}/${env.IMAGE_NAME}:${imageTag}"
                    }
                }
            }
            post {
                failure {
                    slackSend(color: 'danger', message: "Docker build/push failed for ${env.JOB_NAME} ${env.BUILD_NUMBER}")
                }
            }
        }
        stage('Deploy to Staging') {
            when {
                branch 'main'
            }
            steps {
                script {
                    def imageTag = "${env.BUILD_NUMBER}-${env.GIT_COMMIT.take(7)}"
                    sh "kubectl set image deployment/order-service order-service=${env.DOCKER_REGISTRY}/${env.IMAGE_NAME}:${imageTag} -n staging"
                    sh "kubectl rollout status deployment/order-service -n staging --timeout=5m"
                }
            }
            post {
                failure {
                    slackSend(color: 'danger', message: "Staging deploy failed for ${env.JOB_NAME} ${env.BUILD_NUMBER}")
                    sh "kubectl rollout undo deployment/order-service -n staging"
                }
            }
        }
    }
    post {
        always {
            cleanWs() // Clean workspace to prevent disk space issues on self-hosted agents
        }
        failure {
            slackSend(color: 'danger', message: "Pipeline failed for ${env.JOB_NAME} ${env.BUILD_NUMBER}: ${env.BUILD_URL}")
        }
        success {
            slackSend(color: 'good', message: "Pipeline succeeded for ${env.JOB_NAME} ${env.BUILD_NUMBER}: ${env.BUILD_URL}")
        }
    }
}

// GitHub Actions 3.0 Workflow for Order Service
// Requires: GitHub Actions 3.0+, JDK 17, Docker 24.0+, kubectl 1.28+
name: Order Service CI/CD

on:
  push:
    branches: [ main ]
  pull_request:
    branches: [ main ]

env:
  DOCKER_REGISTRY: ghcr.io/our-org
  IMAGE_NAME: order-service
  JDK_VERSION: '17'
  MAVEN_OPTS: '-Xmx2g -XX:MaxMetaspaceSize=512m'
  SLACK_CHANNEL: '#ci-alerts'

jobs:
  test:
    runs-on: ubuntu-latest // Managed GitHub Actions runner, no self-hosted
    steps:
      - name: Checkout code
        uses: actions/checkout@v4
        with:
          fetch-depth: 0 // Fetch full git history for commit info

      - name: Set up JDK ${{ env.JDK_VERSION }}
        uses: actions/setup-java@v4
        with:
          java-version: ${{ env.JDK_VERSION }}
          distribution: 'temurin'
          cache: maven // Cache Maven dependencies to speed up builds

      - name: Run unit tests
        run: mvn -B clean test -Dmaven.test.failure.ignore=false
        continue-on-error: false // Fail workflow if tests fail

      - name: Upload test results
        if: always() // Always upload even if tests fail
        uses: actions/upload-artifact@v4
        with:
          name: test-results
          path: target/surefire-reports/*.xml
          retention-days: 7

      - name: Notify Slack on test failure
        if: failure()
        uses: 8398a7/action-slack@v3
        with:
          status: failure
          text: "Unit tests failed for ${{ github.repository }} ${{ github.run_id }}"
          channel: ${{ env.SLACK_CHANNEL }}
        env:
          SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK_URL }}

  build-and-push:
    needs: test // Only run if test job succeeds
    if: github.ref == 'refs/heads/main' // Only run on main branch
    runs-on: ubuntu-latest
    steps:
      - name: Checkout code
        uses: actions/checkout@v4

      - name: Log in to GitHub Container Registry
        uses: docker/login-action@v3
        with:
          registry: ${{ env.DOCKER_REGISTRY }}
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }} // No need for separate creds, use GitHub token

      - name: Build and push Docker image
        uses: docker/build-push-action@v5
        with:
          context: .
          push: true
          tags: ${{ env.DOCKER_REGISTRY }}/${{ env.IMAGE_NAME }}:${{ github.run_number }}-${{ github.sha }}
          labels: |
            org.opencontainers.image.source=${{ github.repository }}
            org.opencontainers.image.revision=${{ github.sha }}

  deploy-staging:
    needs: build-and-push
    if: github.ref == 'refs/heads/main'
    runs-on: ubuntu-latest
    environment: staging // Requires manual approval for staging deploy
    steps:
      - name: Checkout code
        uses: actions/checkout@v4

      - name: Set up kubectl
        uses: azure/setup-kubectl@v3
        with:
          version: '1.28.0'

      - name: Configure kubeconfig
        uses: azure/k8s-set-context@v4
        with:
          method: kubeconfig
          kubeconfig: ${{ secrets.KUBE_CONFIG_STAGING }}

      - name: Deploy to staging
        run: |
          kubectl set image deployment/order-service order-service=${{ env.DOCKER_REGISTRY }}/${{ env.IMAGE_NAME }}:${{ github.run_number }}-${{ github.sha }} -n staging
          kubectl rollout status deployment/order-service -n staging --timeout=5m

      - name: Rollback on deploy failure
        if: failure()
        run: kubectl rollout undo deployment/order-service -n staging

      - name: Notify Slack on success
        if: success()
        uses: 8398a7/action-slack@v3
        with:
          status: success
          text: "Staging deploy succeeded for ${{ github.repository }} ${{ github.run_id }}"
          channel: ${{ env.SLACK_CHANNEL }}
        env:
          SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK_URL }}

#!/usr/bin/env python3
"""Jenkins Shared Library to GitHub Actions Reusable Workflow Migrator
Version: 1.2.0
Requires: Python 3.10+, PyYAML 6.0+, Jinja2 3.1+"""

import os
import re
import yaml
import argparse
from pathlib import Path
from jinja2 import Environment, FileSystemLoader
from typing import Dict, List, Optional

# Template for GitHub Actions reusable workflow
REUSABLE_WORKFLOW_TEMPLATE = """
name: {{ workflow_name }}
description: {{ workflow_description }}

on:
  workflow_call:
    inputs:
      java-version:
        required: true
        type: string
        default: '17'
      run-unit-tests:
        required: false
        type: boolean
        default: true
    secrets:
      slack-webhook-url:
        required: true

jobs:
  run-workflow:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout code
        uses: actions/checkout@v4

      - name: Set up JDK ${{ inputs.java-version }}
        if: inputs.run-unit-tests
        uses: actions/setup-java@v4
        with:
          java-version: ${{ inputs.java-version }}
          distribution: 'temurin'
          cache: maven

      - name: Run unit tests
        if: inputs.run-unit-tests
        run: mvn -B clean test -Dmaven.test.failure.ignore=false

      - name: Notify Slack
        if: always()
        uses: 8398a7/action-slack@v3
        with:
          status: ${{ job.status }}
          text: "Workflow {{ workflow_name }} completed with status ${{ job.status }}"
          channel: '#ci-alerts'
        env:
          SLACK_WEBHOOK_URL: ${{ secrets.slack-webhook-url }}
"""

def parse_jenkins_shared_lib(lib_path: Path) -> Optional[Dict]:
    """Parse a Jenkins shared library .groovy file to extract metadata."""
    try:
        if not lib_path.exists():
            print(f"Error: Shared library file {lib_path} does not exist")
            return None

        with open(lib_path, 'r') as f:
            content = f.read()

        # Extract workflow name from file name
        workflow_name = lib_path.stem.replace('_', '-')

        # Extract description from Groovy doc comment
        desc_match = re.search(r'/\*\*\s*(.*?)\s*\*/', content, re.DOTALL)
        description = desc_match.group(1).strip() if desc_match else f"Migrated from Jenkins shared lib {lib_path.name}"

        return {
            'workflow_name': workflow_name,
            'workflow_description': description,
            'original_content': content
        }
    except Exception as e:
        print(f"Error parsing {lib_path}: {str(e)}")
        return None

def generate_reusable_workflow(metadata: Dict, output_dir: Path) -> bool:
    """Generate a GitHub Actions reusable workflow from Jenkins shared lib metadata."""
    try:
        output_dir.mkdir(parents=True, exist_ok=True)
        workflow_path = output_dir / f"{metadata['workflow_name']}.yml"

        env = Environment(loader=FileSystemLoader('.'), trim_blocks=True, lstrip_blocks=True)
        template = env.from_string(REUSABLE_WORKFLOW_TEMPLATE)

        rendered = template.render(
            workflow_name=metadata['workflow_name'],
            workflow_description=metadata['workflow_description']
        )

        with open(workflow_path, 'w') as f:
            f.write(rendered)

        print(f"Generated reusable workflow: {workflow_path}")
        return True
    except Exception as e:
        print(f"Error generating workflow: {str(e)}")
        return False

def main():
    parser = argparse.ArgumentParser(description='Migrate Jenkins shared libraries to GitHub Actions reusable workflows')
    parser.add_argument('--lib-dir', type=Path, required=True, help='Directory containing Jenkins shared libraries')
    parser.add_argument('--output-dir', type=Path, required=True, help='Output directory for GitHub Actions workflows')
    args = parser.parse_args()

    if not args.lib_dir.exists():
        print(f"Error: Library directory {args.lib_dir} does not exist")
        return

    # Process all .groovy files in the shared lib directory
    groovy_files = list(args.lib_dir.glob('**/*.groovy'))
    print(f"Found {len(groovy_files)} Jenkins shared libraries to migrate")

    success_count = 0
    for groovy_file in groovy_files:
        metadata = parse_jenkins_shared_lib(groovy_file)
        if metadata and generate_reusable_workflow(metadata, args.output_dir):
            success_count += 1

    print(f"Migration complete: {success_count}/{len(groovy_files)} workflows generated successfully")

if __name__ == '__main__':
    main()

jobs:
  call-reusable-test:
    uses: our-org/ci-templates/.github/workflows/java-test.yml@v1.2.0
    with:
      java-version: '17'
      run-unit-tests: true
    secrets:
      slack-webhook-url: ${{ secrets.SLACK_WEBHOOK_URL }}

jobs:
  build-with-custom-maven:
    runs-on: ubuntu-latest
    container:
      image: maven:3.8-jdk17
      env:
        MAVEN_OPTS: '-Xmx2g'
    steps:
      - uses: actions/checkout@v4
      - run: mvn -B clean package

jobs:
  deploy-to-aws:
    runs-on: ubuntu-latest
    permissions:
      id-token: write # Required for OIDC
      contents: read
    steps:
      - uses: actions/checkout@v4
      - uses: aws-actions/configure-aws-credentials@v4
        with:
          role-to-assume: arn:aws:iam::123456789012:role/github-actions-role
          aws-region: us-east-1