Standardize CI/CD onto Harness: templated pipeline + team migration guide

[devin-ai-integration]

Summary

Converges this service's Jenkins DevSecOps pipeline onto Harness, delivered as reusable templates so other teams can onboard by supplying a few variables instead of copying a Jenkinsfile. Purely additive — the existing Jenkinsfile, GitOps/Jenkinsfile, and vars/*.groovy shared library are untouched. No app code, dependencies, or security policies changed; no real secrets are embedded (connectors/secrets are referenced as placeholders like account.Github, <+secrets.getValue("sonar_token")>).

All new files live under a new .harness/ directory. Every YAML parses cleanly (validated with yaml.safe_load_all).

What's added

.harness/
  pipeline.yaml                              # concrete CI+CD pipeline for bankapp (built from the templates)
  templates/
    stepgroup-security-scans.yaml            # StepGroup Template: Trivy fs + OWASP + Sonar + quality gate
    stage-ci-build-scan.yaml                 # CI Stage Template: Build&Test(Maven) -> scans -> Docker build/push
    stage-cd-gitops-deploy.yaml              # CD Stage Template: verify tag -> bump manifest -> git push (ArgoCD)
    pipeline-template.yaml                    # Pipeline Template: wires CI + CD stage templates end-to-end
  JENKINS_INVENTORY.md                       # stage-by-stage Jenkins inventory + Harness equivalents
  README.md                                  # migration guide (onboarding, connectors, secrets, validation)

Reusable template hierarchy

Pipeline Template  (java_service_cicd)
  ├── CI Stage Template  (build_scan_and_push_maven)
  │      └── Step Group Template (devsecops_security_scans)  # Trivy / OWASP / Sonar
  └── CD Stage Template  (gitops_deploy)

This mirrors the Jenkins shared library (vars/*.groovy) idea of reusable steps, but as versioned (versionLabel: v1), parameterized (<+input>) Harness Templates shareable across projects/account.

Jenkins -> Harness stage mapping

Jenkins (shared-lib call)	Harness	Location
code_checkout(url,"DevOps")	cloneCodebase: true + Git connector	pipeline properties.ci.codebase
trivy_scan() -> trivy fs .	Run (aquasec/trivy)	step group
owasp_dependency()	Run (owasp/dependency-check)	step group
sonarqube_analysis(...)	Run (maven sonar:sonar)	step group
sonarqube_code_quality()	Run (poll Sonar quality-gate API)	step group
docker_build() + docker_push()	BuildAndPushDockerRegistry	CI stage
CD sed manifest bump + git push	Run (sed + push; ArgoCD reconciles)	CD stage
post{ emailext }	notificationRules (Email)	pipeline

Note: the Jenkins CI job never ran mvn test (the Maven build happens inside the Dockerfile with -DskipTests=true). The Harness CI stage adds an explicit Build & Test step (./mvnw clean test) up front to fail fast — the intended converged behavior. Deploy facts (namespace bankapp-namespace, image trainwithshubham/bankapp-eks, GitOps/ArgoCD) come straight from kubernetes/ + helm/.

How another team onboards

1. Import the 4 templates/*.yaml into Harness (or promote to account-level), adjusting orgIdentifier/projectIdentifier.
2. Create connectors/secrets (Git, Docker, K8s, Sonar token, GitOps token) — the Harness equivalent of Jenkins Manage Credentials + shared library config.
3. Create a pipeline from pipeline-template.yaml and supply runtime inputs (service_name, image_repo, docker_tag, sonar_host_url, sonar_project_key, codebase connector/repo, gitops_repo).
4. Run it — CI builds/tests/scans/pushes, CD bumps the manifest tag and pushes so ArgoCD deploys (same two-job flow as Jenkins, now one pipeline).

Full details, variable tables, and the connector/secret placeholder map are in .harness/README.md; the exhaustive stage inventory is in .harness/JENKINS_INVENTORY.md.

Link to Devin session: https://app.devin.ai/sessions/326929740c1b44428a6b50196a03734b
Requested by: @achalc

---

Devin Review

Status	Commit
⚪ Not started	—

Run Devin Review

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment, CI, and merge conflict monitoring