Как организовать CI/CD для Java-микросервисов в банковской среде?

@Library('bank-shared-library') _

pipeline {
    agent { label 'java17-maven-docker' }

    environment {
        APP_NAME    = 'payment-service'
        VERSION     = "${env.BUILD_NUMBER}"
        NEXUS_URL   = 'https://nexus.bank.internal'
        SONAR_URL   = 'https://sonar.bank.internal'
        DOCKER_REG  = 'nexus.bank.internal:8083'
    }

    options {
        timeout(time: 30, unit: 'MINUTES')
        timestamps()
        disableConcurrentBuilds()
        buildDiscarder(logRotator(numToKeepStr: '20'))
    }

    stages {
        stage('Checkout') {
            steps { checkout scm }
        }

        stage('Build') {
            steps {
                configFileProvider([configFile(fileId: 'maven-settings', variable: 'MVN_SETTINGS')]) {
                    sh "mvn clean compile -s \$MVN_SETTINGS"
                }
            }
        }

        stage('Tests') {
            parallel {
                stage('Unit Tests') {
                    steps { sh 'mvn test' }
                    post {
                        always {
                            junit '**/surefire-reports/*.xml'
                            jacoco(execPattern: '**/target/jacoco.exec')
                        }
                    }
                }
                stage('Security Check') {
                    steps { sh 'mvn dependency-check:check' }
                }
            }
        }

        stage('SonarQube Analysis') {
            steps {
                withSonarQubeEnv('SonarQube') {
                    sh "mvn sonar:sonar -Dsonar.host.url=${SONAR_URL}"
                }
            }
        }

        stage('Quality Gate') {
            steps {
                timeout(time: 5, unit: 'MINUTES') {
                    waitForQualityGate abortPipeline: true
                }
            }
        }

        stage('Package & Publish JAR') {
            when { anyOf { branch 'main'; branch 'develop' } }
            steps {
                configFileProvider([configFile(fileId: 'maven-settings', variable: 'MVN_SETTINGS')]) {
                    sh "mvn deploy -DskipTests -s \$MVN_SETTINGS -Drevision=${VERSION}"
                }
            }
        }

        stage('Build & Push Docker') {
            when { anyOf { branch 'main'; branch 'develop' } }
            steps {
                script {
                    def img = docker.build("${DOCKER_REG}/${APP_NAME}:${VERSION}")
                    docker.withRegistry("https://${DOCKER_REG}", 'nexus-docker-creds') {
                        img.push()
                        img.push('latest')
                    }
                }
            }
        }

        stage('Deploy to Dev') {
            when { branch 'develop' }
            steps { sh "./deploy.sh dev ${VERSION}" }
        }

        stage('Deploy to Staging') {
            when { branch 'main' }
            steps { sh "./deploy.sh staging ${VERSION}" }
        }

        stage('Deploy to Production') {
            when { branch 'main' }
            steps {
                input message: "Deploy ${APP_NAME}:${VERSION} to production?",
                      submitter: 'release-managers'
                sh "./deploy.sh production ${VERSION}"
            }
        }
    }

    post {
        success { notifyTeam(status: 'SUCCESS') }
        failure { notifyTeam(status: 'FAILURE') }
        cleanup { cleanWs() }
    }
}