# ============================================================
# GitLab CI – build & release OCI image via pipeship + deploy
# ============================================================
# Uses the pipeship "release_oci_image" product which bundles:
#   stages, build/scan/promote_oci_image, semantic_release, etc.
# See: https://bridge.pipeship.comp.db.de/modules/?searchKeyword=release_oci_image&filterTypeSubmit=product
# ============================================================

include:
  - remote: https://bahnhub.tech.rz.db.de/artifactory/pipeship-generic-release-local/canary/products/release_oci_image/4.9.96-20250909050014-9d6e6c21.yaml

variables:
  PIPESHIP_PRODUCT: "release_oci_image"
  PIPESHIP_VERSION: "$CI_DEFAULT_BRANCH"

  # Version schema
  PGV_SCHEMA: "stateful-semver"

  # Enable semantic-release
  SEMANTIC_RELEASE_ENABLED: "true"
  SR_PLUGINS: "@semantic-release/commit-analyzer,@semantic-release/release-notes-generator,@semantic-release/gitlab"

  # Disable unused jobs
  RST_JOB_DISABLED: "true"
  LINT_CODE_JOB_DISABLED: "true"
  SDC_JOB_DISABLED: "true"
  SCAN_SONARQUBE_JOB_DISABLED: "true"
  SSQ_JOB_DISABLED: "true"
  SSG_JOB_DISABLED: "true"
  CAON_JOB_DISABLED: "true"

  # Version file for promote_oci_image
  POI_SOURCE_IMAGE_VERSION_FILE: "VERSION"
  POI_DESTINATION_IMAGE_VERSION_FILE: "VERSION"
  POI_TAG_LATEST: "true"

  # Use dotenv artifact from build_oci_image
  SOIST_USE_URI_ARTIFACT: "true"
  SOIT_USE_URI_ARTIFACT: "true"
  POI_USE_URI_ARTIFACT: "true"
  CAON_USE_URI_ARTIFACT: "true"
  CAON_USE_VERSION_FILE: "false"

  # Use Aqua scanner
  AQUA_ENABLED: "true"

  # Node base image for test jobs
  NODE_IMAGE: "db-container-lib-docker-release-local.bahnhub.tech.rz.db.de/node:22-alpine"

  # Azure subscriptions
  SUBSCRIPTION_DEV: "245822e7-9f8b-4c8a-993b-e9ae726c9c42"
  SUBSCRIPTION_IAT: "245822e7-9f8b-4c8a-993b-e9ae726c9c42"

  # Proxy settings
  HTTP_PROXY: "http://webproxy.comp.db.de:8080"
  HTTPS_PROXY: "http://webproxy.comp.db.de:8080"
  http_proxy: "http://webproxy.comp.db.de:8080"
  https_proxy: "http://webproxy.comp.db.de:8080"
  no_proxy: "172.30.0.1,127.0.0.1,localhost,cluster.local,db.de,169.254.169.254"

# ── Code quality gate (lint + unit tests) ─────────────────────
code_quality:
  stage: code_analysis
  image: $NODE_IMAGE
  tags:
    - dev
  rules:
    - if: $CI_MERGE_REQUEST_ID
    - if: $CI_COMMIT_REF_PROTECTED == "true"
  script:
    - npm ci --ignore-scripts
    - npm run test

# ── Bicep validation (MR only) ───────────────────────────────
validate_bicep:
  stage: code_analysis
  image: mcr-docker-remote.bahnhub.tech.rz.db.de/azure-cli:2.76.0
  tags:
    - dev
  script:
    - az login --federated-token "$(cat $AZURE_FEDERATED_TOKEN_FILE)" --service-principal -u $AZURE_CLIENT_ID -t $AZURE_TENANT_ID
    - az account set --subscription $SUBSCRIPTION_DEV
    - az deployment sub what-if --location westeurope --parameters infra/parameters/dev.bicepparam --parameters deployContainerApp=true --no-pretty-print
  rules:
    - if: $CI_MERGE_REQUEST_ID

# ── Job overrides (stages & runner tags) ──────────────────────
generate_version:
  stage: init
  tags:
    - dev

submit_telemetry:
  stage: init
  tags:
    - dev

scan_config_trivy:
  stage: code_analysis
  tags:
    - dev

build_oci_image:
  stage: build_image
  tags:
    - dev
  needs:
    - job: generate_version
      optional: true
    - job: code_quality

promote_oci_image:
  stage: promote_image
  tags:
    - dev
  rules:
    - if: $CI_COMMIT_BRANCH == "main"
      variables:
        POI_USE_URI_ARTIFACT: "true"
        POI_SOURCE_IMAGE_NAME: "generativeai-docker-stage-dev-local.bahnhub.tech.rz.db.de/db-planet-mcp-server"
        POI_DESTINATION_IMAGE_NAME: "generativeai-docker-stage-iat-local.bahnhub.tech.rz.db.de/db-planet-mcp-server"
        POI_DESTINATION_REGISTRY_CREDENTIALS_USER: "${GLOBAL_ARTIFACTORY_USER_STAGE}"
        POI_DESTINATION_REGISTRY_CREDENTIALS_PASSWORD: "${GLOBAL_ARTIFACTORY_TOKEN_STAGE}"
    - if: $CI_COMMIT_TAG
      variables:
        POI_SOURCE_IMAGE_NAME: "generativeai-docker-stage-dev-local.bahnhub.tech.rz.db.de/db-planet-mcp-server"
        POI_DESTINATION_IMAGE_NAME: "generativeai-docker-prod-local.bahnhub.tech.rz.db.de/db-planet-mcp-server"
        POI_SOURCE_IMAGE_VERSION: "${CI_PIPELINE_ID}"
        POI_DESTINATION_IMAGE_VERSION: "${CI_COMMIT_TAG}"
        POI_DESTINATION_REGISTRY_CREDENTIALS_USER: "${GLOBAL_ARTIFACTORY_USER_PROD}"
        POI_DESTINATION_REGISTRY_CREDENTIALS_PASSWORD: "${GLOBAL_ARTIFACTORY_TOKEN_PROD}"

cleanup_artifactory_oci_nonprod:
  stage: cleanup
  tags:
    - dev

# ── Deploy to Azure ───────────────────────────────────────────
.deploy_template:
  image: mcr-docker-remote.bahnhub.tech.rz.db.de/azure-cli:2.76.0
  stage: post_promote_image
  tags:
    - dev
  script:
    - az login --federated-token "$(cat $AZURE_FEDERATED_TOKEN_FILE)" --service-principal -u $AZURE_CLIENT_ID -t $AZURE_TENANT_ID
    - az account set --subscription $DEPLOY_SUBSCRIPTION
    - chmod +x ./infra/deploy.sh
    - IMAGE_TAG=$(cat VERSION 2>/dev/null || echo "$CI_COMMIT_SHORT_SHA")
    - ./infra/deploy.sh --environment $DEPLOY_ENVIRONMENT --image-tag "$IMAGE_TAG"

deploy_dev:
  extends: .deploy_template
  variables:
    DEPLOY_ENVIRONMENT: "DEV"
    DEPLOY_SUBSCRIPTION: $SUBSCRIPTION_DEV
  rules:
    - if: $CI_COMMIT_BRANCH == "develop"
  needs:
    - job: build_oci_image
      artifacts: true
    - job: generate_version
      artifacts: true
      optional: true

deploy_iat:
  extends: .deploy_template
  variables:
    DEPLOY_ENVIRONMENT: "IAT"
    DEPLOY_SUBSCRIPTION: $SUBSCRIPTION_IAT
  rules:
    - if: $CI_COMMIT_BRANCH == "main"
  needs:
    - job: promote_oci_image
      artifacts: true
    - job: generate_version
      artifacts: true
      optional: true