// TEMPLATE: trusted main-only Pipeline job, dedicated agent, protected folder.
// Never attach this credentialed job to untrusted pull requests.
pipeline {
 agent { label 'beatit-mule-trusted' }
 tools { jdk 'jdk17'; maven 'maven3' }
 options { skipDefaultCheckout(true); disableConcurrentBuilds(); timeout(time: 60, unit: 'MINUTES'); timestamps() }
 parameters {
  booleanParam(name: 'DEPLOY_SANDBOX', defaultValue: false, description: 'Approved deployment can consume CloudHub capacity')
  booleanParam(name: 'PROMOTE_PRODUCTION', defaultValue: false, description: 'Requires sandbox validation and separate approval')
 }
 stages {
  stage('Checkout trusted main') {
   steps {
    deleteDir()
    checkout scm
    sh 'git rev-parse HEAD'
   }
  }
  stage('Offline starter checks') {
   steps {
    sh 'python3 scripts/verify_setup.py --configured'
    sh 'python3 scripts/test_setup.py'
    sh 'java -version'
    sh 'mvn -version'
   }
  }
  stage('Build, MUnit test and publish Exchange ONCE') {
   steps {
    withCredentials([usernamePassword(credentialsId: 'exchange-publisher', usernameVariable: 'EXCHANGE_CLIENT_ID', passwordVariable: 'EXCHANGE_CLIENT_SECRET')]) {
     sh '''
      set +x
      set -eu
      settings_dir=$(mktemp -d)
      trap 'rm -rf "$settings_dir"' EXIT
      cp settings.template.xml "$settings_dir/settings.xml"
      mvn -B -s "$settings_dir/settings.xml" -f store-api/pom.xml clean deploy
     '''
    }
    sh 'python3 scripts/candidate.py record'
   }
   post {
    always { junit testResults: 'store-api/target/surefire-reports/*.xml', allowEmptyResults: false }
   }
  }
  stage('Archive candidate identity') {
   steps {
    sh 'python3 scripts/candidate.py verify'
    archiveArtifacts artifacts: 'candidate/manifest.json,store-api/target/*-mule-application.jar,pom.xml,store-api/pom.xml', fingerprint: true
   }
  }
  stage('Approve sandbox target') {
   when { expression { params.DEPLOY_SANDBOX } }
   steps { input message: 'Review manifest, sandbox target/capacity and complete property set. Authorize this deployment?', submitter: 'REPLACE_WITH_RELEASE_APPROVER_IDS' }
  }
  stage('Deploy existing candidate to CloudHub 2 sandbox') {
   when { expression { params.DEPLOY_SANDBOX } }
   steps {
    withCredentials([
     usernamePassword(credentialsId: 'exchange-reader', usernameVariable: 'EXCHANGE_CLIENT_ID', passwordVariable: 'EXCHANGE_CLIENT_SECRET'),
     usernamePassword(credentialsId: 'ch2-sandbox-deployer', usernameVariable: 'DEPLOY_CLIENT_ID', passwordVariable: 'DEPLOY_CLIENT_SECRET')
    ]) {
     sh '''
      set +x
      set -eu
      settings_dir=$(mktemp -d)
      trap 'rm -rf "$settings_dir"' EXIT
      cp settings.template.xml "$settings_dir/settings.xml"
      python3 scripts/deploy_existing.py --environment environments/sandbox.json --settings "$settings_dir/settings.xml" --confirm
     '''
    }
   }
  }
  stage('Validate sandbox and approve production') {
   when { expression { params.PROMOTE_PRODUCTION } }
   steps {
    script { if (!params.DEPLOY_SANDBOX) { error('Production promotion requires this candidate sandbox path first') } }
    input message: 'Inspect sandbox HTTP/MUnit/runtime evidence and manifest. Approve SAME candidate for the reviewed production target?', submitter: 'REPLACE_WITH_RELEASE_APPROVER_IDS'
   }
  }
  stage('Promote same existing candidate to CloudHub 2 production') {
   when { expression { params.PROMOTE_PRODUCTION } }
   steps {
    withCredentials([
     usernamePassword(credentialsId: 'exchange-reader', usernameVariable: 'EXCHANGE_CLIENT_ID', passwordVariable: 'EXCHANGE_CLIENT_SECRET'),
     usernamePassword(credentialsId: 'ch2-production-deployer', usernameVariable: 'DEPLOY_CLIENT_ID', passwordVariable: 'DEPLOY_CLIENT_SECRET')
    ]) {
     sh '''
      set +x
      set -eu
      settings_dir=$(mktemp -d)
      trap 'rm -rf "$settings_dir"' EXIT
      cp settings.template.xml "$settings_dir/settings.xml"
      python3 scripts/deploy_existing.py --environment environments/production.json --settings "$settings_dir/settings.xml" --confirm
     '''
    }
   }
  }
 }
 post { always { echo 'Retain exact artifact identity, sanitized reports, target configuration and known limitations.' } }
}
