# Definitive CI/CD pipeline for the OPAX-MCP service.
# Uses YAML anchors for readable and reusable steps.

# --- Reusable Step Definitions (YAML Anchors) ---
x-reusable-steps:
  # Anchor for Tyr Policy Check
  - &tyr-policy-check
    name: 'gcr.io/google.com/cloudsdktool/cloud-sdk'
    id: 'Tyr Policy Check'
    entrypoint: 'bash'
    args:
      - '-c'
      - |
        echo "INFO: Simulating Tyr Policy Check for branch [${_BRANCH_NAME}]..."
        # This step will be replaced with the actual Tyr CLI call.
        # Example: tyr-cli validate --source=. --commit=${_SHORT_SHA} --branch=${_BRANCH_NAME}
        # A non-zero exit code here will fail the build.
        echo "SUCCESS: Tyr Policy Check passed."

  # Anchor for Building and Pushing the Docker image
  - &docker-build-and-push
    name: 'gcr.io/cloud-builders/docker'
    id: 'Build and Push Image'
    entrypoint: 'bash'
    args:
      - '-c'
      - |
        set -e
        echo "INFO: Building Docker image for service [${_SERVICE_NAME}]."
        docker build \
          -t "${_REGION}-docker.pkg.dev/${PROJECT_ID}/${_REPOSITORY}/${_SERVICE_NAME}:${_SHORT_SHA}" \
          -t "${_REGION}-docker.pkg.dev/${PROJECT_ID}/${_REPOSITORY}/${_SERVICE_NAME}:${_BRANCH_NAME}" \
          --build-arg "COMMIT_SHA=${_SHORT_SHA}" \
          -f "${_DOCKERFILE_PATH}" .

        echo "INFO: Pushing tags [${_SHORT_SHA}, ${_BRANCH_NAME}] to Artifact Registry."
        docker push --all "${_REGION}-docker.pkg.dev/${PROJECT_ID}/${_REPOSITORY}/${_SERVICE_NAME}"

  # Anchor for Conditional Deployment to Cloud Run
  - &deploy-to-cloud-run
    name: 'gcr.io/google.com/cloudsdktool/cloud-sdk'
    id: 'Deploy to Cloud Run'
    entrypoint: 'bash'
    args:
      - '-c'
      - |
        set -e
        if [[ "${_BRANCH_NAME}" == "main" || "${_BRANCH_NAME}" == opax-* ]]; then
          echo "INFO: Branch [${_BRANCH_NAME}] is deployable. Deploying service [${_SERVICE_NAME}]..."
          gcloud run deploy "${_SERVICE_NAME}" \
            --project="${PROJECT_ID}" \
            --region="${_REGION}" \
            --image="${_REGION}-docker.pkg.dev/${PROJECT_ID}/${_REPOSITORY}/${_SERVICE_NAME}:${_SHORT_SHA}" \
            --platform="managed" \
            --service-account="${_MCP_SA}" \
            --set-secrets="MCP_SECRET=mcp-server-key:latest" \
            --no-allow-unauthenticated \
            --set-env-vars="BRANCH_NAME=${_BRANCH_NAME}" \
            --update-labels="gcb-commit-sha=${_SHORT_SHA},branch-name=${_BRANCH_NAME}" \
            --quiet
        else
          echo "INFO: Branch [${_BRANCH_NAME}] is not a deployable branch. Skipping deployment."
        fi

# --- Pipeline Steps ---
steps:
  # 1. Run Tyr Policy Check
  - <<: *tyr-policy-check

  # 2. Build and Push the image
  - <<: *docker-build-and-push
    waitFor: ['Tyr Policy Check']

  # 3. Conditionally deploy to Cloud Run
  - <<: *deploy-to-cloud-run
    waitFor: ['Build and Push Image']

# --- Images created by this build ---
images:
  - '${_REGION}-docker.pkg.dev/${PROJECT_ID}/${_REPOSITORY}/${_SERVICE_NAME}:${_SHORT_SHA}'
  - '${_REGION}-docker.pkg.dev/${PROJECT_ID}/${_REPOSITORY}/${_SERVICE_NAME}:${_BRANCH_NAME}'

# --- Substitutions ---
substitutions:
  # Default values, can be overridden by triggers
  _REGION: 'us-central1'
  _REPOSITORY: 'osvauco-repo'
  _SERVICE_NAME: 'opax-mcp'
  _DOCKERFILE_PATH: 'opax-mcp/Dockerfile'
  _MCP_SA: 'jason-vauger@propane-will-491900-m5.iam.gserviceaccount.com'
  # These are automatically populated by Cloud Build
  _BRANCH_NAME: ${BRANCH_NAME}
  _SHORT_SHA: ${SHORT_SHA}

options:
  logging: CLOUD_LOGGING_ONLY
  substitutionOption: ALLOW_LOOSE