pipeline {
    agent { label 'ssh-agent' }

    options {
        skipDefaultCheckout(true)
    }

    stages {
        stage('Checkout') {
            steps {
                withCredentials([usernamePassword(
                    credentialsId: 'gitea_user',
                    usernameVariable: 'GIT_USER',
                    passwordVariable: 'GIT_TOKEN')]) {
                    sh '''
                        git init -q .
                        git remote add origin \
                          "https://${GIT_USER}:${GIT_TOKEN}@git.jouwdomain.duckdns.org/willemjan/glucose-dashboard.git" \
                          2>/dev/null || true
                        git fetch --depth 1 origin "${BRANCH_NAME}"
                        git checkout -q FETCH_HEAD
                        git rev-parse --short HEAD
                    '''
                }
            }
        }

        stage('Test') {
            steps {
                sh '''
                    python -m venv .venv
                    . .venv/bin/activate
                    pip install -q -r requirements.txt -r requirements-dev.txt
                    pytest -q --junitxml=report.xml
                '''
            }
            post {
                always { junit 'report.xml' }
            }
        }

        stage('Build & push image') {
            steps {
                withCredentials([usernamePassword(
                    credentialsId: 'gitea-registry',
                    usernameVariable: 'REG_USER',
                    passwordVariable: 'REG_PASS')]) {
                    sh '''
                        echo "$REG_PASS" | docker login $REGISTRY -u "$REG_USER" --password-stdin
                        docker build -t $IMAGE:$TAG -t $IMAGE:latest .
                        docker push $IMAGE:$TAG
                        docker push $IMAGE:latest
                    '''
                }
            }
        }

        stage('Scan') {
            steps {
                sh 'trivy image --exit-code 0 --severity HIGH,CRITICAL $IMAGE:$TAG'
            }
        }

        stage('Deploy to OpenShift') {
            steps {
                withCredentials([string(
                    credentialsId: 'openshift-token',
                    variable: 'OC_TOKEN')]) {
                    sh '''
                        oc login --token="$OC_TOKEN" --server="$OC_SERVER"
                        oc project $OC_PROJECT

                        oc apply -f openshift/service.yaml
                        oc apply -f openshift/route.yaml
                        oc apply -f openshift/deployment.yaml

                        oc set image deployment/glucose-dashboard \
                            glucose-dashboard=$IMAGE:$TAG

                        oc rollout status deployment/glucose-dashboard --timeout=5m
                    '''
                }
            }
        }
    }

    post {
        always  { sh 'oc logout || true' }
        success {
            sh 'echo "Deployed: $(oc get route glucose-dashboard -o jsonpath={.spec.host})" || true'
        }
    }
}