Jenkinsfile Example: Full CI/CD Pipeline

pipeline {
    agent any
    environment {
        SONARQUBE_URL = 'https://sonar.example.com'
        DOCKER_REGISTRY = 'registry.example.com'
    }
    stages {
        stage('Build') {
            steps {
                sh 'npm ci'
                sh 'npm run build'
            }
        }
        stage('Unit Tests') {
            steps {
                sh 'npm test -- --coverage'
                junit 'reports/junit.xml'
                publishHTML(target: [
                    reportDir: 'coverage/lcov-report',
                    reportFiles: 'index.html',
                    reportName: 'Coverage Report'
                ])
            }
        }
        stage('SonarQube Analysis') {
            steps {
                withSonarQubeEnv('SonarQube') {
                    sh '''
                        sonar-scanner \
                          -Dsonar.projectKey=my-app \
                          -Dsonar.sources=src \
                          -Dsonar.tests=tests \
                          -Dsonar.javascript.lcov.reportPaths=coverage/lcov.info
                    '''
                }
                timeout(time: 5, unit: 'MINUTES') {
                    waitForQualityGate abortPipeline: true
                }
            }
        }
        stage('OWASP Dependency Check') {
            steps {
                dependencyCheck(
                    additionalArguments: '--scan ./ --format HTML --format JSON',
                    odcInstallation: 'OWASP-DC'
                )
                dependencyCheckPublisher(pattern: 'dependency-check-report.json')
            }
        }
        stage('OWASP ZAP Security Scan') {
            steps {
                sh '''
                    docker run --rm -v $(pwd):/zap/wrk \
                      owasp/zap2docker-stable zap-api-scan.py \
                      -t https://staging.example.com/api/v1 \
                      -f openapi -r zap-report.html
                '''
                publishHTML(target: [
                    reportDir: '.', reportFiles: 'zap-report.html',
                    reportName: 'OWASP ZAP Report'
                ])
            }
        }
        stage('Docker Build & Scan') {
            steps {
                sh 'docker build -t $DOCKER_REGISTRY/my-app:$BUILD_NUMBER .'
                sh 'trivy image --severity HIGH,CRITICAL $DOCKER_REGISTRY/my-app:$BUILD_NUMBER'
                sh 'docker push $DOCKER_REGISTRY/my-app:$BUILD_NUMBER'
            }
        }
        stage('Deploy to Production') {
            when { branch 'main' }
            steps {
                sh '''
                    kubectl set image deployment/my-app \
                      my-app=$DOCKER_REGISTRY/my-app:$BUILD_NUMBER \
                      --record
                    kubectl rollout status deployment/my-app --timeout=300s
                '''
            }
        }
    }
    post {
        failure {
            slackSend(channel: '#deployments', color: 'danger',
                message: "Pipeline FAILED: ${env.JOB_NAME} #${env.BUILD_NUMBER}")
        }
        success {
            slackSend(channel: '#deployments', color: 'good',
                message: "Deployed: ${env.JOB_NAME} #${env.BUILD_NUMBER}")
        }
    }
}