[WIP] Adding an example of a Jenkins CI enviornment using OIDC and optional Harbor pull-through mirror

jenkins/.env.example

@@ -0,0 +1,46 @@
+# Chainguard org under cgr.dev/ to pull images from. docker-compose passes
+# it to the controller's image build and runtime env; pipelines reference
+# it via env.CHAINGUARD_ORG; per-app Dockerfiles use it as a build ARG;
+# setup.sh uses it when creating the Chainguard assumed identity via
+# Terraform.
+#
+# Leave commented out (or set to empty) and setup.sh will prompt for it
+# on first run, then persist your answer here. Re-runs reuse the persisted
+# value without prompting.
+#
+# Examples:
+#   CHAINGUARD_ORG=chainguard               # the public Chainguard catalog
+#   CHAINGUARD_ORG=your-org.example.com
+#
+# CHAINGUARD_ORG=
+
+# The remaining variables in this file are written by setup.sh based on
+# the answers you give to its three prompts. You normally don't edit them
+# directly — re-run setup.sh to switch modes.
+
+# Where pipelines pull Chainguard images from. Either:
+#   cgr.dev/<org>                          (Mode A — direct cgr.dev)
+#   localhost/cgr-proxy/<org>              (Modes B/C — Harbor proxy cache)
+# PULL_REGISTRY=
+
+# Where the Python/Node OCI-image pipelines push their built images. Either:
+#   ttl.sh/<prefix>                        (Modes A/B default — anonymous, 24h TTL)
+#   localhost/library                      (Mode C — Harbor)
+# PUSH_REGISTRY=
+
+# Whether Harbor is the active pull-through cache. cgLogin reads this and
+# skips the OIDC chainctl exchange when true (Harbor pulls are anonymous).
+# HARBOR_ENABLED=false
+
+# Harbor admin password. Default is the chart's own default ("Harbor12345")
+# so the demo works out of the box. setup.sh writes this when Harbor is
+# enabled; the value drives:
+#   - the Helm chart's harborAdminPassword
+#   - the Terraform harbor provider (used for the cgr-proxy project)
+#   - cgLogin's Mode C push-auth (cgr-proxy admin docker config)
+# Override before running setup.sh to use a different password.
+# HARBOR_ADMIN_PASSWORD=Harbor12345
+
+# Note: the Chainguard assumed identity UIDP (Mode A) is NOT stored here.
+# setup.sh writes it to shared-libraries/cg-images/IDENTITY (filesystem-SCM
+# live-loaded; cgLogin reads it at build time).

jenkins/.gitignore

@@ -0,0 +1,16 @@
+# Local environment overrides (e.g. CHAINGUARD_ORG). Bootstrapped from .env.example.
+.env
+
+# Identity UIDP file — generated by setup.sh, ephemeral, must not be committed.
+shared-libraries/cg-images/IDENTITY
+
+# Maven build outputs — produced when running pipelines locally for verification.
+apps/*/target/
+
+# Gradle build outputs and local caches — produced when running pipelines locally.
+apps/*/build/
+apps/*/.gradle/
+
+# Node module dirs — produced when running npm/pnpm install locally.
+apps/*/node_modules/
+apps/*/.pnpm-store/

jenkins/Dockerfile.jenkins

@@ -0,0 +1,37 @@
+# Multi-stage build:
+#   1. docker-cli stage: source for the docker client binary
+#   2. plugins stage: use the -dev jenkins variant (has shell) to run jenkins-plugin-cli
+#   3. final stage: ship on the standard jenkins image with plugins baked in
+
+# Required build-arg, supplied by docker-compose from .env. No default —
+# CHAINGUARD_ORG must be set explicitly so that we don't accidentally build
+# against the wrong catalog. setup.sh prompts for this on first run.
+ARG CHAINGUARD_ORG
+FROM cgr.dev/${CHAINGUARD_ORG}/docker-cli:29 AS docker
+
+# chainctl binary, used by pipelines (via the cgLogin shared-library var) to
+# exchange Jenkins-issued OIDC tokens for short-lived Chainguard sessions.
+ARG CHAINGUARD_ORG
+FROM cgr.dev/${CHAINGUARD_ORG}/chainctl:latest-dev AS chainctl
+
+ARG CHAINGUARD_ORG
+FROM cgr.dev/${CHAINGUARD_ORG}/jenkins:2-lts-jdk21-dev AS plugins
+USER 0
+COPY jenkins/plugins.txt /tmp/plugins.txt
+RUN jenkins-plugin-cli --plugin-file /tmp/plugins.txt --verbose
+
+ARG CHAINGUARD_ORG
+FROM cgr.dev/${CHAINGUARD_ORG}/jenkins:2-lts-jdk21-dev
+USER 0
+COPY --from=docker /usr/bin/docker /usr/local/bin/docker
+COPY --from=chainctl /usr/bin/chainctl /usr/local/bin/chainctl
+COPY --from=plugins --chown=1000:1000 /usr/share/jenkins/ref/plugins/ /usr/share/jenkins/ref/plugins/
+# `chainctl auth configure-docker` adds a credential helper for cgr.dev to
+# the user's docker config.json — but the helper itself is a symlink in PATH
+# called `docker-credential-cgr` that points back at chainctl. We pre-create
+# it here as root so per-build chainctl runs (uid 1000) don't need write
+# access to /usr/local/bin.
+RUN ln -s /usr/local/bin/chainctl /usr/local/bin/docker-credential-cgr
+USER 1000
+ENV JAVA_OPTS="-Djenkins.install.runSetupWizard=false"
+ENV CASC_JENKINS_CONFIG=/var/jenkins_home/casc