Part 4 — The Jenkinsfile

Flow

Checkout → Compile → Test → Trivy FS scan → SonarQube analysis →
Quality Gate → Maven package → Publish to Nexus → Docker build →
Trivy image scan → Docker push → kubectl apply → Email

The complete Jenkinsfile

Save this at the root of the app repo as Jenkinsfile:

pipeline {
  agent any
  environment {
    SCANNER_HOME = tool 'sonar-scanner'
  }
  tools {
    jdk 'jdk17'
    maven 'maven3'
  }
  stages {
    stage('Git Checkout') {
      steps {
        git branch: 'main', credentialsId: 'git-cred',
            url: 'https://github.com/Shubham-Stunner/BoardGame.git'
      }
    }

    stage('Compile') {
      steps { sh 'mvn compile' }
    }

    stage('Test') {
      steps { sh 'mvn test' }
    }

    stage('Trivy FS Scan') {
      steps { sh 'trivy fs --format table -o trivy-fs-report.html .' }
    }

    stage('SonarQube Analysis') {
      steps {
        script {
          withSonarQubeEnv('sonar') {
            sh '''$SCANNER_HOME/bin/sonar-scanner \
              -Dsonar.projectName=BoardGame \
              -Dsonar.projectKey=BoardGame \
              -Dsonar.java.binaries=.'''
          }
        }
      }
    }

    stage('Quality Gate') {
      steps {
        script {
          waitForQualityGate abortPipeline: false, credentialsId: 'sonar-token'
        }
      }
    }

    stage('Build (Maven package)') {
      steps { sh 'mvn package' }
    }

    stage('Publish Artifact to Nexus') {
      steps {
        withMaven(globalMavenSettingsConfig: 'global-settings',
                  jdk: 'jdk17', maven: 'maven3') {
          sh 'mvn deploy'
        }
      }
    }

    stage('Build & Tag Docker Image') {
      steps {
        script {
          withDockerRegistry(credentialsId: 'docker-cred') {
            sh 'docker build -t stunnershubham/boardgame:latest .'
          }
        }
      }
    }

    stage('Trivy Image Scan') {
      steps {
        sh 'trivy image --format table -o trivy-image-report.html stunnershubham/boardgame:latest'
      }
    }

    stage('Push Docker Image') {
      steps {
        script {
          withDockerRegistry(credentialsId: 'docker-cred') {
            sh 'docker push stunnershubham/boardgame:latest'
          }
        }
      }
    }

    stage('Deploy to Kubernetes') {
      steps {
        withKubeConfig(credentialsId: 'k8-cred',
                       namespace: 'webapps',
                       serverUrl: 'https://172.31.8.22:6443') {
          sh 'kubectl apply -f deployment-service.yaml'
          sh 'kubectl get pods -n webapps'
        }
      }
    }
  }

  post {
    always {
      script {
        def color = currentBuild.result == 'SUCCESS' ? 'green' : 'red'
        emailext(
          subject: "[${env.JOB_NAME}] Build ${env.BUILD_NUMBER} - ${currentBuild.result ?: 'UNKNOWN'}",
          body: '<div style="border:4px solid ' + color + ';padding:10px">' +
                '<h3>' + (currentBuild.result ?: 'UNKNOWN') + '</h3>' +
                '<p>See <a href="' + BUILD_URL + 'console">console</a></p>' +
                '</div>',
          to: 'you@example.com',
          mimeType: 'text/html',
          attachmentsPattern: 'trivy-image-report.html'
        )
      }
    }
  }
}

The deployment-service.yaml in the repo

apiVersion: apps/v1
kind: Deployment
metadata: { name: boardgame, namespace: webapps }
spec:
  replicas: 2
  selector: { matchLabels: { app: boardgame } }
  template:
    metadata: { labels: { app: boardgame } }
    spec:
      containers:
        - name: web
          image: stunnershubham/boardgame:latest
          ports: [{ containerPort: 8080 }]
---
apiVersion: v1
kind: Service
metadata: { name: boardgame, namespace: webapps }
spec:
  type: NodePort
  selector: { app: boardgame }
  ports: [{ port: 8080, targetPort: 8080, nodePort: 30080 }]

Wire it in Jenkins

New Item → Pipeline:

• Pipeline definition: Pipeline script from SCM.
• SCM: Git → paste the repo URL, credentials = git-cred.
• Branch: main.
• Script path: Jenkinsfile.
• Save → Build Now.

What each stage prevents

Stage	Prevents
Test	Merging broken code
Trivy FS	Committing vulnerable dependencies
SonarQube	Merging low-quality code
Quality Gate	Deploying failing checks
Publish Artifact	Losing the built JAR
Trivy Image	Shipping vulnerable images
kubectl apply	Manual click-ops in production

Congratulations — you've automated the entire path from git push to a running pod in Kubernetes.