pipeline {
  agent {
    kubernetes {
      label 'ananke-quality'
      defaultContainer 'go-tester'
      yaml """
apiVersion: v1
kind: Pod
spec:
  nodeSelector:
    kubernetes.io/arch: arm64
    node-role.kubernetes.io/worker: "true"
  containers:
    - name: go-tester
      image: registry.bstein.dev/bstein/golang:1.25-bookworm
      command: ["cat"]
      tty: true
      volumeMounts:
        - name: workspace-volume
          mountPath: /home/jenkins/agent
    - name: publisher
      image: registry.bstein.dev/bstein/python:3.12-slim
      command: ["cat"]
      tty: true
      volumeMounts:
        - name: workspace-volume
          mountPath: /home/jenkins/agent
  volumes:
    - name: workspace-volume
      emptyDir: {}
"""
    }
  }

  environment {
    SUITE_NAME = 'ananke'
    PUSHGATEWAY_URL = 'http://platform-quality-gateway.monitoring.svc.cluster.local:9091'
    SONARQUBE_HOST_URL = 'http://sonarqube.quality.svc.cluster.local:9000'
    SONARQUBE_PROJECT_KEY = 'ananke'
    QUALITY_GATE_SONARQUBE_ENFORCE = '0'
    QUALITY_GATE_SONARQUBE_REPORT = 'build/sonarqube-quality-gate.json'
    QUALITY_GATE_IRONBANK_ENFORCE = '0'
    QUALITY_GATE_IRONBANK_REQUIRED = '0'
    QUALITY_GATE_IRONBANK_REPORT = 'build/ironbank-compliance.json'
  }

  options {
    disableConcurrentBuilds()
    buildDiscarder(logRotator(daysToKeepStr: '30', numToKeepStr: '200', artifactDaysToKeepStr: '30', artifactNumToKeepStr: '120'))
  }

  triggers {
    pollSCM('H/5 * * * *')
  }

  stages {
    stage('Checkout') {
      steps {
        checkout scm
      }
    }

    stage('Collect SonarQube evidence') {
      steps {
        container('publisher') {
          sh '''
            set -eu
            mkdir -p build
            python3 - <<'PY'
import base64
import json
import os
import urllib.parse
import urllib.request

host = os.getenv('SONARQUBE_HOST_URL', '').strip().rstrip('/')
project_key = os.getenv('SONARQUBE_PROJECT_KEY', '').strip()
token = os.getenv('SONARQUBE_TOKEN', '').strip()
report_path = os.getenv('QUALITY_GATE_SONARQUBE_REPORT', 'build/sonarqube-quality-gate.json')
payload = {"status": "ERROR", "note": "missing SONARQUBE_HOST_URL and/or SONARQUBE_PROJECT_KEY"}
if host and project_key:
    query = urllib.parse.urlencode({"projectKey": project_key})
    request = urllib.request.Request(f"{host}/api/qualitygates/project_status?{query}", method="GET")
    if token:
        encoded = base64.b64encode(f"{token}:".encode("utf-8")).decode("utf-8")
        request.add_header("Authorization", f"Basic {encoded}")
    try:
        with urllib.request.urlopen(request, timeout=12) as response:
            payload = json.loads(response.read().decode("utf-8"))
    except Exception as exc:  # noqa: BLE001
        payload = {"status": "ERROR", "error": str(exc)}
with open(report_path, "w", encoding="utf-8") as handle:
    json.dump(payload, handle, indent=2, sort_keys=True)
    handle.write("\\n")
PY
          '''
        }
      }
    }

    stage('Collect Supply Chain evidence') {
      steps {
        container('publisher') {
          sh '''
            set -eu
            mkdir -p build
            python3 - <<'PY'
import json
import os
from pathlib import Path

report_path = Path(os.getenv('QUALITY_GATE_IRONBANK_REPORT', 'build/ironbank-compliance.json'))
if report_path.exists():
    raise SystemExit(0)
status = os.getenv('IRONBANK_COMPLIANCE_STATUS', '').strip()
compliant = os.getenv('IRONBANK_COMPLIANT', '').strip().lower()
payload = {"status": status or "unknown", "compliant": compliant in {"1", "true", "yes", "on"} if compliant else None}
payload = {k: v for k, v in payload.items() if v is not None}
if "status" not in payload:
    payload["status"] = "unknown"
payload["note"] = "Set IRONBANK_COMPLIANCE_STATUS/IRONBANK_COMPLIANT or write build/ironbank-compliance.json in image-building repos."
report_path.parent.mkdir(parents=True, exist_ok=True)
report_path.write_text(json.dumps(payload, indent=2, sort_keys=True) + "\\n", encoding="utf-8")
PY
          '''
        }
      }
    }

    stage('Run quality gate') {
      steps {
        container('go-tester') {
          sh '''
            set -eu
            mkdir -p build
            set +e
            export GOFLAGS='-buildvcs=false'
            ANANKE_QUALITY_METRICS_ENABLED=0 \
            ANANKE_QUALITY_PUSHGATEWAY_ENABLED=0 \
            ANANKE_QUALITY_STATE_FILE="$PWD/build/quality-gate.state" \
            ./scripts/quality_gate.sh > build/quality-gate.out 2>&1
            gate_rc=$?
            set -e
            cat build/quality-gate.out
            printf '%s\\n' "${gate_rc}" > build/quality-gate.rc
          '''
        }
      }
    }

    stage('Publish test metrics') {
      steps {
        container('publisher') {
          sh '''
            set -eu
            ok_runs="$(awk -F= '$1=="ok"{print $2}' build/quality-gate.state 2>/dev/null | tail -n1)"
            failed_runs="$(awk -F= '$1=="failed"{print $2}' build/quality-gate.state 2>/dev/null | tail -n1)"
            [ -n "${ok_runs}" ] || ok_runs=0
            [ -n "${failed_runs}" ] || failed_runs=0
            coverage_percent="$(python3 - <<'PY'
import re
from pathlib import Path

log_path = Path("build/quality-gate.out")
text = log_path.read_text(encoding="utf-8", errors="ignore") if log_path.exists() else ""
values = [float(match.group(1)) for match in re.finditer(r"([0-9]+(?:\\.[0-9]+)?)%", text)]
print(values[-1] if values else 0.0)
PY
)"
            printf '%s\n' "${coverage_percent}" > build/coverage-percent.txt
            python3 scripts/publish_quality_metrics.py \
              --pushgateway-url "${PUSHGATEWAY_URL}" \
              --job-name platform-quality-ci \
              --suite "${SUITE_NAME}" \
              --trigger jenkins \
              --local-ok "${ok_runs}" \
              --local-failed "${failed_runs}" \
              --coverage-percent-file build/coverage-percent.txt
          '''
        }
      }
    }

    stage('Enforce quality gate') {
      steps {
        container('publisher') {
          sh '''
            set -eu
            gate_rc="$(cat build/quality-gate.rc 2>/dev/null || echo 1)"
            fail=0
            if [ "${gate_rc}" -ne 0 ]; then
              echo "quality gate failed with rc=${gate_rc}" >&2
              fail=1
            fi

            enabled() {
              case "$(printf '%s' "${1:-}" | tr '[:upper:]' '[:lower:]')" in
                1|true|yes|on) return 0 ;;
                *) return 1 ;;
              esac
            }

            if enabled "${QUALITY_GATE_SONARQUBE_ENFORCE:-1}"; then
              sonar_status="$(python3 - <<'PY'
import json
from pathlib import Path

path = Path("build/sonarqube-quality-gate.json")
if not path.exists():
    print("missing")
    raise SystemExit(0)
try:
    payload = json.loads(path.read_text(encoding="utf-8"))
except Exception:  # noqa: BLE001
    print("error")
    raise SystemExit(0)
status = (payload.get("status") or payload.get("projectStatus", {}).get("status") or payload.get("qualityGate", {}).get("status") or "").strip().lower()
print(status or "missing")
PY
)"
              case "${sonar_status}" in
                ok|pass|passed|success) ;;
                *)
                  echo "sonarqube gate failed: ${sonar_status}" >&2
                  fail=1
                  ;;
              esac
            fi

            ironbank_required="${QUALITY_GATE_IRONBANK_REQUIRED:-0}"
            if [ "${PUBLISH_IMAGES:-false}" = "true" ]; then
              ironbank_required=1
            fi
            if enabled "${QUALITY_GATE_IRONBANK_ENFORCE:-1}"; then
              supply_status="$(python3 - <<'PY'
import json
from pathlib import Path

path = Path("build/ironbank-compliance.json")
if not path.exists():
    print("missing")
    raise SystemExit(0)
try:
    payload = json.loads(path.read_text(encoding="utf-8"))
except Exception:  # noqa: BLE001
    print("error")
    raise SystemExit(0)
compliant = payload.get("compliant")
if compliant is True:
    print("ok")
elif compliant is False:
    print("failed")
else:
    status = str(payload.get("status") or payload.get("result") or payload.get("compliance") or "").strip().lower()
    print(status or "missing")
PY
)"
              case "${supply_status}" in
                ok|pass|passed|success|compliant) ;;
                not_applicable|na|n/a)
                  if enabled "${ironbank_required}"; then
                    echo "supply chain gate required but status=${supply_status}" >&2
                    fail=1
                  fi
                  ;;
                *)
                  if enabled "${ironbank_required}"; then
                    echo "supply chain gate failed: ${supply_status}" >&2
                    fail=1
                  else
                    echo "supply chain gate not passing (${supply_status}) but not required for this run" >&2
                  fi
                  ;;
              esac
            fi

            exit "${fail}"
          '''
        }
      }
    }
  }

  post {
    always {
      archiveArtifacts artifacts: 'build/**', allowEmptyArchive: true, fingerprint: true
    }
  }
}