pipeline {
    agent any

    options {
        timestamps()
        disableConcurrentBuilds()
    }

    stages {
        stage('Verify source checkout') {
            steps {
                echo 'FlashRead source checkout succeeded.'
                sh 'pwd && git log -1 --oneline'
            }
        }

        stage('Build FlashRead CI image') {
            steps {
                script {
                    def ciImage = docker.build(
                        'fast_reader-ci:latest',
                        '-f Dockerfile.ci .'
                    )
                    echo "Built CI image: ${ciImage.id}"
                }
            }
        }

        stage('Inspect build environment') {
            steps {
                sh '''
                    echo "=== Build environment ==="
                    echo

                    for tool in git go node npm wails syft grype docker; do
                        if command -v "$tool" >/dev/null 2>&1; then
                            echo "[FOUND] $tool"
                            "$tool" --version 2>&1 | head -n 1 || true
                        else
                            echo "[MISSING] $tool"
                        fi
                    done
                '''
            }
        }
        stage('Build FlashRead') {
            agent {
                docker {
                    image 'fast_reader-ci:latest'
                    reuseNode true
                }
            }
            steps {
                sh '''
                    mkdir -p frontend/dist
                    touch frontend/dist/.keep
                    wails generate module

                    echo "=== Frontend dependencies ==="
                    cd frontend
                    npm ci

                    echo "=== Frontend build ==="
                    npm run build

                    cd ..
                    
                    echo "=== Go tests ==="
                    go test ./...

                    echo "=== Wails build ==="
                    wails build -tags webkit2_41
                    echo "=== Build output files ==="
                    find build -maxdepth 3 -type f -printf '%p (%s bytes)\n'
                '''
            }
        }

        stage('Security scan') {
            agent {
                docker {
                    image 'fast_reader-ci:latest'
                    reuseNode true
                }
            }
            steps {
                sh '''
                    echo "=== Generate SBOM ==="
                    syft dir:. -o cyclonedx-json=fast_reader-sbom.json

                    echo "=== Scan SBOM for vulnerabilities ==="
                    grype sbom:fast_reader-sbom.json -o table
                '''

                archiveArtifacts artifacts: 'fast_reader-sbom.json',
                                 fingerprint: true
            }
        }
        
        stage('Publish to Nexus') {
            steps {
                withCredentials([usernamePassword(
                    credentialsId: 'nexus-fast_reader',
                    usernameVariable: 'NEXUS_USERNAME',
                    passwordVariable: 'NEXUS_PASSWORD'
                )]) {
                    sh '''
                        echo "=== Upload FlashRead binary ==="
                        curl --fail --silent --show-error \
                            --user "$NEXUS_USERNAME:$NEXUS_PASSWORD" \
                            --upload-file build/bin/fast_reader \
                            http://nexus:8081/repository/fast_reader-releases/fast_reader/0.1.0/linux-amd64/fast_reader

                        echo "=== Upload SBOM ==="
                        curl --fail --silent --show-error \
                            --user "$NEXUS_USERNAME:$NEXUS_PASSWORD" \
                            --upload-file fast_reader-sbom.json \
                            http://nexus:8081/repository/fast_reader-releases/fast_reader/0.1.0/fast_reader-sbom.json
                    '''
                }
            }
        }

    }

    post {
        success {
            echo 'FlashRead CI environment check completed successfully.'
        }
        failure {
            echo 'FlashRead CI environment check failed.'
        }
    }
}
