ci: Jenkins pipeline for Gogs push/PR to main

Replace jenkins-infra buildPlugin with a local Docker pipeline that
runs mvn verify, packages the HPI, and archives it. Fix BackupCodeUtil
consume test which used an immutable list.

Jenkinsfile

@@ -1,11 +1,83 @@
-/*
- * See the documentation for more options:
- * https://github.com/jenkins-infra/pipeline-library/
- */
-buildPlugin(
-  forkCount: '1C', // run this number of tests in parallel for faster feedback.  If the number terminates with a 'C', the value will be multiplied by the number of available CPU cores
-  useContainerAgent: true, // Set to `false` if you need to use Docker for containerized tests
-  configurations: [
-    [platform: 'linux', jdk: 21],
-    [platform: 'windows', jdk: 21],
-])
+// CI/CD for Gogs: push and pull requests targeting main.
+// Builds, tests and packaging run inside Docker (DinD), not on the Jenkins host.
+// Triggers are configured on the Jenkins job (Generic Webhook) + Gogs webhooks.
+
+pipeline {
+  agent {
+    docker {
+      image 'ura-ci-maven:21'
+      label 'built-in'
+      alwaysPull false
+      args '-u root -v jenkins-m2-cache:/root/.m2 -e MAVEN_OPTS=-Xmx1024m'
+    }
+  }
+
+  options {
+    timestamps()
+    disableConcurrentBuilds()
+    timeout(time: 45, unit: 'MINUTES')
+    buildDiscarder(logRotator(numToKeepStr: '20', artifactNumToKeepStr: '10'))
+  }
+
+  stages {
+    stage('Checkout') {
+      steps {
+        script {
+          def sha = env.pr_head_sha ?: env.after ?: 'main'
+          if (!sha?.trim() || sha == 'null' || sha == '0000000000000000000000000000000000000000') {
+            sha = 'main'
+          }
+          echo "Gogs event ref=${env.ref} action=${env.action} pr=#${env.pr_number} sha=${sha}"
+          checkout([
+            $class: 'GitSCM',
+            branches: [[name: sha]],
+            extensions: [[$class: 'CloneOption', shallow: false, noTags: false]],
+            userRemoteConfigs: [[url: 'https://git.barcelos.dev/allan/jenkins-mfa-auth-plugin.git']]
+          ])
+        }
+      }
+    }
+
+    stage('Test') {
+      steps {
+        sh 'mvn -B -ntp verify'
+      }
+      post {
+        always {
+          junit allowEmptyResults: true, testResults: 'target/surefire-reports/*.xml'
+        }
+      }
+    }
+
+    stage('Package') {
+      steps {
+        sh 'mvn -B -ntp -DskipTests -Dset.changelist package'
+        sh 'ls -la target/*.hpi target/*.jar'
+        archiveArtifacts artifacts: 'target/*.hpi,target/*-SNAPSHOT.jar', fingerprint: true
+      }
+    }
+
+    stage('Release') {
+      when {
+        allOf {
+          expression { env.ref == 'refs/heads/main' }
+          expression { !env.pr_number?.trim() || env.pr_number == 'null' }
+        }
+      }
+      steps {
+        echo 'Release artifact is the archived HPI from this build (lastSuccessfulBuild).'
+        sh '''
+          set -e
+          HPI=$(ls -1 target/*.hpi | head -1)
+          echo "HPI=${HPI} size=$(wc -c < "$HPI") sha256=$(sha256sum "$HPI" | awk '{print $1}')"
+        '''
+      }
+    }
+  }
+
+  post {
+    always {
+      sh 'chmod -R a+rwX "$WORKSPACE" || true'
+    }
+  }
+}

README.md

@@ -101,6 +101,18 @@ mvn clean verify       # Run full build with tests
 mvn hpi:run            # Launch test Jenkins instance
 ```
 
+### CI/CD (Gogs + Jenkins)
+
+Pipeline is `Jenkinsfile` (contract also in `ci.yaml`).
+
+On **push** to `main` and on **pull requests targeting `main`**, Jenkins:
+
+1. Runs `mvn verify` (unit + plugin tests) inside Docker
+2. Packages the `.hpi`
+3. Archives the plugin as a build artifact
+
+Successful main builds: [last HPI](https://jenkins.barcelos.dev/job/jenkins-mfa-auth-plugin/lastSuccessfulBuild/artifact/).
+
 ### Contribution Guidelines
 1. Fork the repository
 2. Create feature branches (`feature/your-feature`)

ci.yaml

@@ -0,0 +1,34 @@
+# Gogs + Jenkins CI contract (GitHub Actions-style).
+# Jenkins executes Jenkinsfile; this file documents the same pipeline.
+# Triggers: Gogs webhook (push, pull_request) → Jenkins Generic Webhook Trigger
+#           (only refs/heads/main, or PRs whose base branch is main).
+
+name: ci
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+
+jobs:
+  verify-and-package:
+    runs-on: jenkins-dind
+    container: ura-ci-maven:21
+    steps:
+      - name: Checkout
+        uses: git
+        with:
+          repository: https://git.barcelos.dev/allan/jenkins-mfa-auth-plugin.git
+          ref: ${{ github.sha }}
+      - name: Test
+        run: mvn -B -ntp verify
+      - name: Package plugin
+        run: mvn -B -ntp -DskipTests -Dset.changelist package
+      - name: Archive HPI
+        uses: archiveArtifacts
+        with:
+          path: target/*.hpi
+      - name: Release
+        if: github.event_name == 'push' && github.ref == 'refs/heads/main'
+        run: echo "HPI published as Jenkins lastSuccessfulBuild artifact"

src/test/java/io/jenkins/plugins/BackupCodeUtilTest.java

@@ -51,14 +51,14 @@ class BackupCodeUtilTest {
     void consume_validCode_returnsTrue() {
         String[] codes = BackupCodeUtil.generateCodes();
         String[] hashes = BackupCodeUtil.hashCodes(codes);
-        List<String> hashList = Arrays.asList(hashes);
+        List<String> hashList = new java.util.ArrayList<>(Arrays.asList(hashes));
         assertTrue(BackupCodeUtil.consume(codes[0], hashList));
     }
 
     @Test
     void consume_invalidCode_returnsFalse() {
         String[] hashes = BackupCodeUtil.hashCodes(BackupCodeUtil.generateCodes());
-        List<String> hashList = Arrays.asList(hashes);
+        List<String> hashList = new java.util.ArrayList<>(Arrays.asList(hashes));
         assertFalse(BackupCodeUtil.consume("ZZZZZZZZ", hashList));
     }