# Definitive CI/CD pipeline for the OPAX-MCP service.

# --- Pipeline Steps ---
steps:
  # 0. Clone the specific branch from the repository
  - name: 'gcr.io/cloud-builders/git'
    id: 'Clone Repository'
    args:
      - 'clone'
      - '--branch'
      - '${_BRANCH_NAME}'
      - '--single-branch'
      - 'http://34.59.131.162:3000/chris/osvauco.git'
      - '.' # Clone into the current directory (/workspace)
    waitFor: ['-'] # Run first

  # 1. Run Tyr Policy Check
  - name: 'gcr.io/google.com/cloudsdktool/cloud-sdk'
    id: 'Tyr Policy Check'
    entrypoint: 'bash'
    waitFor: ['Clone Repository']
    args:
      - '-c'
      - |
        echo "INFO: Simulating Tyr Policy Check for branch [${_BRANCH_NAME}]..."
        # This step will be replaced with the actual Tyr CLI call.
        # Example: tyr-cli validate --source=. --commit=${_SHORT_SHA} --branch=${_BRANCH_NAME}
        # A non-zero exit code here will fail the build.
        echo "SUCCESS: Tyr Policy Check passed."

  # 2. Build and Push the image
  - name: 'gcr.io/cloud-builders/docker'
    id: 'Build and Push Image'
    entrypoint: 'bash'
    waitFor: ['Tyr Policy Check']
    args:
      - '-c'
      - |
        set -e
        echo "INFO: Building Docker image for service [${_SERVICE_NAME}]."
        docker build \
          --no-cache \
          -t "${_REGION}-docker.pkg.dev/${PROJECT_ID}/${_REPOSITORY}/${_SERVICE_NAME}:${_SHORT_SHA}" \
          -t "${_REGION}-docker.pkg.dev/${PROJECT_ID}/${_REPOSITORY}/${_SERVICE_NAME}:${_BRANCH_NAME}" \
          --build-arg "COMMIT_SHA=${_SHORT_SHA}" \
          -f "${_DOCKERFILE_PATH}" .

        echo "INFO: Pushing tags [${_SHORT_SHA}, ${_BRANCH_NAME}] to Artifact Registry."
        docker push --all "${_REGION}-docker.pkg.dev/${PROJECT_ID}/${_REPOSITORY}/${_SERVICE_NAME}"

  # 3. Conditionally deploy to Cloud Run
  - name: 'gcr.io/google.com/cloudsdktool/cloud-sdk'
    id: 'Deploy to Cloud Run'
    entrypoint: 'bash'
    waitFor: ['Build and Push Image']
    args:
      - '-c'
      - |
        set -e
        if [[ "${_BRANCH_NAME}" == "main" || "${_BRANCH_NAME}" == opax-* ]]; then
          echo "INFO: Branch [${_BRANCH_NAME}] is deployable. Deploying service [${_SERVICE_NAME}]..."
          gcloud run deploy "${_SERVICE_NAME}" \
            --project="${PROJECT_ID}" \
            --region="${_REGION}" \
            --image="${_REGION}-docker.pkg.dev/${PROJECT_ID}/${_REPOSITORY}/${_SERVICE_NAME}:${_SHORT_SHA}" \
            --platform="managed" \
            --service-account="${_MCP_SA}" \
            --set-secrets="MCP_SECRET=mcp-server-key:latest" \
            --no-allow-unauthenticated \
            --set-env-vars="BRANCH_NAME=${_BRANCH_NAME}" \
            --update-labels="gcb-commit-sha=${_SHORT_SHA},branch-name=${_BRANCH_NAME}" \
            --quiet
        else
          echo "INFO: Branch [${_BRANCH_NAME}] is not a deployable branch. Skipping deployment."
        fi

# --- Images created by this build ---
images:
  - '${_REGION}-docker.pkg.dev/${PROJECT_ID}/${_REPOSITORY}/${_SERVICE_NAME}:${_SHORT_SHA}'
  - '${_REGION}-docker.pkg.dev/${PROJECT_ID}/${_REPOSITORY}/${_SERVICE_NAME}:${_BRANCH_NAME}'

# --- Substitutions ---
substitutions:
  # Default values, can be overridden by triggers
  _REGION: 'us-central1'
  _REPOSITORY: 'osvauco-repo'
  _SERVICE_NAME: 'opax-mcp'
  _DOCKERFILE_PATH: 'opax-mcp/Dockerfile'
  _MCP_SA: 'jason-vauger@propane-will-491900-m5.iam.gserviceaccount.com'
  # These are automatically populated by Cloud Build
  _BRANCH_NAME: 'main' # Default for manual runs, will be overridden
  _SHORT_SHA: 'manual'

options:
  logging: CLOUD_LOGGING_ONLY
  substitutionOption: ALLOW_LOOSE