pipeline {
  agent {
    kubernetes {
      label 'bstein-dev-home'
      defaultContainer 'builder'
      yaml """
apiVersion: v1
kind: Pod
metadata:
  labels:
    app: bstein-dev-home
spec:
  nodeSelector:
    kubernetes.io/arch: arm64
    node-role.kubernetes.io/worker: "true"
  containers:
    - name: dind
      image: docker:27-dind
      securityContext:
        privileged: true
      env:
        - name: DOCKER_TLS_CERTDIR
          value: ""
      args:
        - --mtu=1400
        - --host=unix:///var/run/docker.sock
        - --host=tcp://0.0.0.0:2375
      volumeMounts:
        - name: dind-storage
          mountPath: /var/lib/docker
    - name: builder
      image: docker:27
      command: ["cat"]
      tty: true
      env:
        - name: DOCKER_HOST
          value: tcp://localhost:2375
        - name: DOCKER_TLS_CERTDIR
          value: ""
      volumeMounts:
        - name: workspace-volume
          mountPath: /home/jenkins/agent
        - name: docker-config-writable
          mountPath: /root/.docker
        - name: harbor-config
          mountPath: /docker-config
    - name: tester
      image: python:3.12-slim
      command: ["cat"]
      tty: true
      volumeMounts:
        - name: workspace-volume
          mountPath: /home/jenkins/agent
    - name: frontend
      image: mcr.microsoft.com/playwright:v1.59.1-jammy
      command: ["cat"]
      tty: true
      volumeMounts:
        - name: workspace-volume
          mountPath: /home/jenkins/agent
  volumes:
    - name: workspace-volume
      emptyDir: {}
    - name: docker-config-writable
      emptyDir: {}
    - name: dind-storage
      emptyDir: {}
    - name: harbor-config
      secret:
        secretName: harbor-bstein-robot
        items:
          - key: .dockerconfigjson
            path: config.json
"""
    }
  }
  environment {
    REGISTRY = 'registry.bstein.dev/bstein'
    FRONT_IMAGE = "${REGISTRY}/bstein-dev-home-frontend"
    BACK_IMAGE  = "${REGISTRY}/bstein-dev-home-backend"
    VERSION_TAG = 'dev'
    SEMVER = 'dev'
    SUITE_NAME = 'bstein_home'
    PUSHGATEWAY_URL = 'http://platform-quality-gateway.monitoring.svc.cluster.local:9091'
    QUALITY_GATE_SONARQUBE_REPORT = 'build/sonarqube-quality-gate.json'
    QUALITY_GATE_IRONBANK_REPORT = 'build/ironbank-compliance.json'
  }
  options {
    disableConcurrentBuilds()
  }
  triggers {
    // Poll every 2 minutes; notifyCommit can also trigger, but polling keeps it moving without webhook tokens.
    pollSCM('H/2 * * * *')
  }
  stages {
    stage('Checkout') {
      steps {
        checkout scm
      }
    }

    stage('Collect SonarQube evidence') {
      steps {
        container('tester') {
          sh '''
            set -euo pipefail
            mkdir -p build
            python3 - <<'PY'
import base64
import json
import os
import urllib.parse
import urllib.request

host = os.getenv('SONARQUBE_HOST_URL', '').strip().rstrip('/')
project_key = os.getenv('SONARQUBE_PROJECT_KEY', '').strip()
token = os.getenv('SONARQUBE_TOKEN', '').strip()
report_path = os.getenv('QUALITY_GATE_SONARQUBE_REPORT', 'build/sonarqube-quality-gate.json')
payload = {"status": "ERROR", "note": "missing SONARQUBE_HOST_URL and/or SONARQUBE_PROJECT_KEY"}
if host and project_key:
    query = urllib.parse.urlencode({"projectKey": project_key})
    request = urllib.request.Request(f"{host}/api/qualitygates/project_status?{query}", method="GET")
    if token:
        encoded = base64.b64encode(f"{token}:".encode("utf-8")).decode("utf-8")
        request.add_header("Authorization", f"Basic {encoded}")
    try:
        with urllib.request.urlopen(request, timeout=12) as response:
            payload = json.loads(response.read().decode("utf-8"))
    except Exception as exc:  # noqa: BLE001
        payload = {"status": "ERROR", "error": str(exc)}
with open(report_path, "w", encoding="utf-8") as handle:
    json.dump(payload, handle, indent=2, sort_keys=True)
    handle.write("\\n")
PY
          '''
        }
      }
    }

    stage('Collect Supply Chain evidence') {
      steps {
        container('tester') {
          sh '''
            set -euo pipefail
            mkdir -p build
            python3 - <<'PY'
import json
import os
from pathlib import Path

report_path = Path(os.getenv('QUALITY_GATE_IRONBANK_REPORT', 'build/ironbank-compliance.json'))
if report_path.exists():
    raise SystemExit(0)
status = os.getenv('IRONBANK_COMPLIANCE_STATUS', '').strip()
compliant = os.getenv('IRONBANK_COMPLIANT', '').strip().lower()
payload = {"status": status or "unknown", "compliant": compliant in {"1", "true", "yes", "on"} if compliant else None}
payload = {k: v for k, v in payload.items() if v is not None}
if "status" not in payload:
    payload["status"] = "unknown"
payload["note"] = "Set IRONBANK_COMPLIANCE_STATUS/IRONBANK_COMPLIANT or write build/ironbank-compliance.json in image-building repos."
report_path.parent.mkdir(parents=True, exist_ok=True)
report_path.write_text(json.dumps(payload, indent=2, sort_keys=True) + "\\n", encoding="utf-8")
PY
          '''
        }
      }
    }

    stage('Prep toolchain') {
      steps {
        container('builder') {
          withCredentials([usernamePassword(credentialsId: 'harbor-robot', usernameVariable: 'HARBOR_USERNAME', passwordVariable: 'HARBOR_PASSWORD')]) {
            sh '''
              set -euo pipefail
              for attempt in 1 2 3 4 5; do
                if apk add --no-cache bash git jq curl; then
                  break
                fi
                if [ "$attempt" -eq 5 ]; then
                  echo "apk add failed after ${attempt} attempts" >&2
                  exit 1
                fi
                sleep $((attempt * 2))
              done
              mkdir -p /root/.docker
              printf '%s' "${HARBOR_PASSWORD}" | docker login registry.bstein.dev -u "${HARBOR_USERNAME}" --password-stdin
            '''
          }
        }
      }
    }

    stage('Compute version') {
      steps {
        container('builder') {
          script {
            sh '''
              set -euo pipefail
              if git describe --tags --exact-match >/dev/null 2>&1; then
                SEMVER="$(git describe --tags --exact-match)"
              else
                BASE="$(jq -r '.version' frontend/package.json || echo '0.1.0')"
                SEMVER="${BASE}-${BUILD_NUMBER}"
              fi
              # Accept bare semver or leading v (with optional prerelease).
              if ! echo "$SEMVER" | grep -Eq '^v?[0-9]+\\.[0-9]+\\.[0-9]+([-.][0-9A-Za-z]+)?$'; then
                SEMVER="0.1.0-${BUILD_NUMBER}"
              fi
              echo "SEMVER=${SEMVER}" > build.env
            '''
            def props = readProperties file: 'build.env'
            env.SEMVER = props['SEMVER'] ?: "0.1.0-${env.BUILD_NUMBER}"
            env.VERSION_TAG = env.SEMVER
          }
        }
      }
    }

    stage('Buildx setup') {
      steps {
        container('builder') {
          sh '''
            set -euo pipefail
            mkdir -p build
            set +e
            ready=0
            for i in $(seq 1 10); do
              if docker info >/dev/null 2>&1; then
                ready=1
                break
              fi
              sleep 2
            done
            rc=0
            if [ "${ready}" -ne 1 ]; then
              echo "docker daemon did not become ready on ${DOCKER_HOST}" >&2
              docker version || true
              rc=1
            else
              BUILDER_NAME="bstein-builder-${BUILD_NUMBER}"
              docker buildx rm "${BUILDER_NAME}" >/dev/null 2>&1 || true
              docker buildx create --name "${BUILDER_NAME}" --driver docker-container \
                --driver-opt image=moby/buildkit:buildx-stable-1 \
                --bootstrap --use
              rc=$?
              if [ "${rc}" -eq 0 ]; then
                docker buildx inspect "${BUILDER_NAME}" --bootstrap
                rc=$?
              fi
            fi
            set -e
            printf '%s\n' "${rc}" > build/buildx.rc
            if [ "${rc}" -ne 0 ]; then
              echo "warning: buildx setup failed; publish stages will fail later" >&2
            fi
          '''
        }
      }
    }

    stage('Backend unit tests') {
      steps {
        container('tester') {
          sh '''
            set -euo pipefail
            mkdir -p build
            export PYTHONPATH="${WORKSPACE}/backend:${PYTHONPATH:-}"
            python -m pip install --no-cache-dir -r backend/requirements.txt -r backend/requirements-dev.txt
            set +e
            python -m pytest backend/tests -q --cov=backend/atlas_portal --cov-report=xml:build/backend-coverage.xml --junitxml=build/junit-backend.xml
            backend_rc=$?
            set -e
            printf '%s\n' "${backend_rc}" > build/backend-tests.rc
          '''
        }
      }
    }

    stage('Frontend tests') {
      steps {
        container('frontend') {
          sh(script: '''#!/usr/bin/env bash
set -euo pipefail
mkdir -p build
cd frontend
set +e
npm ci
npm run lint
npm run test:unit
npm run test:component
npm run test:e2e
frontend_rc=$?
set -e
printf '%s\n' "${frontend_rc}" > ../build/frontend-tests.rc
''')
        }
      }
    }

    stage('Run quality gate') {
      steps {
        container('tester') {
          sh '''
            set -euo pipefail
            export PYTHONPATH="${WORKSPACE}:${PYTHONPATH:-}"
            set +e
            python -m testing.ci.quality_gate \
              --backend-coverage build/backend-coverage.xml \
              --frontend-coverage frontend/coverage/coverage-summary.json \
              --report build/quality-gate.json
            gate_rc=$?
            backend_rc="$(cat build/backend-tests.rc 2>/dev/null || echo 1)"
            frontend_rc="$(cat build/frontend-tests.rc 2>/dev/null || echo 1)"
            if [ "${backend_rc}" -ne 0 ] || [ "${frontend_rc}" -ne 0 ]; then
              gate_rc=1
            fi
            set -e
            printf '%s\n' "${gate_rc}" > build/quality-gate.rc
          '''
        }
      }
    }

    stage('Publish test metrics') {
      steps {
        container('tester') {
          sh '''
            set -euo pipefail
            gate_rc="$(cat build/quality-gate.rc 2>/dev/null || echo 1)"
            status="ok"
            if [ "${gate_rc}" -ne 0 ]; then
              status="failed"
            fi
            python -m testing.ci.publish_metrics \
              --gateway "${PUSHGATEWAY_URL}" \
              --suite "${SUITE_NAME}" \
              --job platform-quality-ci \
              --status "${status}" \
              --quality-report build/quality-gate.json \
              --junit build/junit-backend.xml build/junit-frontend-unit.xml build/junit-frontend-component.xml build/junit-frontend-e2e.xml
          '''
        }
      }
    }

    stage('Enforce quality gate') {
      steps {
        container('tester') {
          sh '''
            set -euo pipefail
            test "$(cat build/quality-gate.rc 2>/dev/null || echo 1)" -eq 0
          '''
        }
      }
    }

    stage('Build & push frontend') {
      steps {
        container('builder') {
          sh '''
            set -euo pipefail
            test "$(cat build/buildx.rc 2>/dev/null || echo 1)" -eq 0
            VERSION_TAG="$(cut -d= -f2 build.env)"
            docker buildx build \
              --platform linux/arm64 \
              --tag "${FRONT_IMAGE}:${VERSION_TAG}" \
              --tag "${FRONT_IMAGE}:latest" \
              --file Dockerfile.frontend \
              --push \
              .
          '''
        }
      }
    }

    stage('Build & push backend') {
      steps {
        container('builder') {
          sh '''
            set -euo pipefail
            test "$(cat build/buildx.rc 2>/dev/null || echo 1)" -eq 0
            VERSION_TAG="$(cut -d= -f2 build.env)"
            docker buildx build \
              --platform linux/arm64 \
              --tag "${BACK_IMAGE}:${VERSION_TAG}" \
              --tag "${BACK_IMAGE}:latest" \
              --file Dockerfile.backend \
              --push \
              .
          '''
        }
      }
    }
  }

  post {
    always {
      script {
        def props = fileExists('build.env') ? readProperties(file: 'build.env') : [:]
        echo "Build complete for ${props['SEMVER'] ?: env.VERSION_TAG}"
      }
      archiveArtifacts artifacts: 'build/junit-backend.xml,build/junit-frontend-unit.xml,build/junit-frontend-component.xml,build/junit-frontend-e2e.xml,build/quality-gate.json', allowEmptyArchive: true
    }
  }
}