pipeline {
    agent {
        label 'ssh-agent'
    }


    environment {
        REGISTRY    = 'gitea.zb-kw.duckdns.org'
        IMAGE       = "${REGISTRY}/willemjan/glucose-dashboard"
        OC_SERVER   = 'https://api.rm1.0a51.p1.openshiftapps.com:6443'
        OC_PROJECT  = 'willemjan-dev'
    }

    options {
        buildDiscarder(logRotator(numToKeepStr: '20'))
        timeout(time: 20, unit: 'MINUTES')
    }

    stages {
        stage('Checkout') {
            steps {
                checkout scm
                script {
                    env.TAG = sh(script: 'git rev-parse --short HEAD',
                                 returnStdout: true).trim()
                }
            }
        }

        stage('Test') {
            steps {
                sh '''
                    pip install --break-system-packages -q -r requirements.txt
                    pytest -q --junitxml=report.xml
                '''
            }
            post {
                always { junit allowEmptyResults: true, testResults: 'report.xml' }
            }
        }

        stage('Build & push image') {
            steps {
                withCredentials([usernamePassword(
                    credentialsId: 'gitea_user',
                    usernameVariable: 'REG_USER',
                    passwordVariable: 'REG_PASS')]) {
                    sh '''
                        echo "$REG_PASS" | docker login $REGISTRY -u "$REG_USER" --password-stdin
                        docker build -t $IMAGE:$TAG -t $IMAGE:latest .
                        docker push $IMAGE:$TAG
                        docker push $IMAGE:latest
                    '''
                }
            }
        }

        stage('Scan') {
            steps {
                sh '''
                    docker run --rm \
                      -v /var/run/docker.sock:/var/run/docker.sock \
                      -v trivy-cache:/root/.cache/trivy \
                      aquasec/trivy:latest image \
                        --severity HIGH,CRITICAL \
                        --ignore-unfixed \
                        --exit-code 0 \
                        $IMAGE:$TAG
                '''
            }
        }

        stage('Deploy to OpenShift') {
            steps {
                withCredentials([string(
                    credentialsId: 'openshift-token',
                    variable: 'OC_TOKEN')]) {
                    sh '''
                        oc login --token="$OC_TOKEN" --server="$OC_SERVER"
                        oc project $OC_PROJECT

                        oc apply -f openshift/service.yaml
                        oc apply -f openshift/route.yaml
                        oc apply -f openshift/deployment.yaml

                        oc set image deployment/glucose-dashboard \
                            glucose-dashboard=$IMAGE:$TAG

                        oc rollout status deployment/glucose-dashboard --timeout=5m
                    '''
                }
            }
            post {
                always  { sh 'oc logout || true' }
                success {
                    sh 'echo "Deployed: $(oc get route glucose-dashboard -o jsonpath={.spec.host})" || true'
                }
            }
        }
    }
    
}