# Service Release Pipeline
# Sprint: CI/CD Enhancement - Per-Service Auto-Versioning
#
# Purpose: Automated per-service release pipeline with semantic versioning
# and Docker tag format: {semver}+{YYYYMMDDHHmmss}
#
# Triggers:
#   - Tag: service-{name}-v{semver} (e.g., service-scanner-v1.2.3)
#   - Manual dispatch with service selection and bump type

name: Service Release

on:
  push:
    tags:
      - 'service-*-v*'
  workflow_dispatch:
    inputs:
      service:
        description: 'Service to release'
        required: true
        type: choice
        options:
          - authority
          - attestor
          - concelier
          - scanner
          - policy
          - signer
          - excititor
          - gateway
          - scheduler
          - cli
          - orchestrator
          - notify
          - sbomservice
          - vexhub
          - evidencelocker
      bump_type:
        description: 'Version bump type'
        required: true
        type: choice
        options:
          - patch
          - minor
          - major
        default: 'patch'
      dry_run:
        description: 'Dry run (no actual release)'
        required: false
        type: boolean
        default: false
      skip_tests:
        description: 'Skip tests (use with caution)'
        required: false
        type: boolean
        default: false

env:
  DOTNET_VERSION: '10.0.100'
  DOTNET_SKIP_FIRST_TIME_EXPERIENCE: true
  DOTNET_CLI_TELEMETRY_OPTOUT: true
  REGISTRY: git.stella-ops.org/stella-ops.org
  SYFT_VERSION: '1.21.0'

jobs:
  # ===========================================================================
  # Parse tag or manual inputs to determine service and version
  # ===========================================================================
  resolve:
    name: Resolve Release Parameters
    runs-on: ubuntu-latest
    outputs:
      service: ${{ steps.resolve.outputs.service }}
      bump_type: ${{ steps.resolve.outputs.bump_type }}
      current_version: ${{ steps.resolve.outputs.current_version }}
      new_version: ${{ steps.resolve.outputs.new_version }}
      docker_tag: ${{ steps.resolve.outputs.docker_tag }}
      is_dry_run: ${{ steps.resolve.outputs.is_dry_run }}
      skip_tests: ${{ steps.resolve.outputs.skip_tests }}

    steps:
      - name: Checkout repository
        uses: actions/checkout@v4

      - name: Resolve parameters
        id: resolve
        run: |
          if [[ "${{ github.event_name }}" == "push" ]]; then
            # Parse tag: service-{name}-v{version}
            TAG="${GITHUB_REF#refs/tags/}"
            echo "Processing tag: $TAG"

            if [[ "$TAG" =~ ^service-([a-z]+)-v([0-9]+\.[0-9]+\.[0-9]+)$ ]]; then
              SERVICE="${BASH_REMATCH[1]}"
              VERSION="${BASH_REMATCH[2]}"
              BUMP_TYPE="explicit"
            else
              echo "::error::Invalid tag format: $TAG (expected: service-{name}-v{semver})"
              exit 1
            fi

            IS_DRY_RUN="false"
            SKIP_TESTS="false"
          else
            # Manual dispatch
            SERVICE="${{ github.event.inputs.service }}"
            BUMP_TYPE="${{ github.event.inputs.bump_type }}"
            VERSION=""  # Will be calculated
            IS_DRY_RUN="${{ github.event.inputs.dry_run }}"
            SKIP_TESTS="${{ github.event.inputs.skip_tests }}"
          fi

          # Read current version
          CURRENT_VERSION=$(.gitea/scripts/release/read-service-version.sh "$SERVICE")
          echo "Current version: $CURRENT_VERSION"

          # Calculate new version
          if [[ -n "$VERSION" ]]; then
            NEW_VERSION="$VERSION"
          else
            NEW_VERSION=$(python3 .gitea/scripts/release/bump-service-version.py "$SERVICE" "$BUMP_TYPE" --output-version)
          fi
          echo "New version: $NEW_VERSION"

          # Generate Docker tag
          DOCKER_TAG=$(.gitea/scripts/release/generate-docker-tag.sh --version "$NEW_VERSION")
          echo "Docker tag: $DOCKER_TAG"

          # Set outputs
          echo "service=$SERVICE" >> $GITHUB_OUTPUT
          echo "bump_type=$BUMP_TYPE" >> $GITHUB_OUTPUT
          echo "current_version=$CURRENT_VERSION" >> $GITHUB_OUTPUT
          echo "new_version=$NEW_VERSION" >> $GITHUB_OUTPUT
          echo "docker_tag=$DOCKER_TAG" >> $GITHUB_OUTPUT
          echo "is_dry_run=$IS_DRY_RUN" >> $GITHUB_OUTPUT
          echo "skip_tests=$SKIP_TESTS" >> $GITHUB_OUTPUT

      - name: Summary
        run: |
          echo "## Release Parameters" >> $GITHUB_STEP_SUMMARY
          echo "" >> $GITHUB_STEP_SUMMARY
          echo "| Parameter | Value |" >> $GITHUB_STEP_SUMMARY
          echo "|-----------|-------|" >> $GITHUB_STEP_SUMMARY
          echo "| Service | ${{ steps.resolve.outputs.service }} |" >> $GITHUB_STEP_SUMMARY
          echo "| Current Version | ${{ steps.resolve.outputs.current_version }} |" >> $GITHUB_STEP_SUMMARY
          echo "| New Version | ${{ steps.resolve.outputs.new_version }} |" >> $GITHUB_STEP_SUMMARY
          echo "| Docker Tag | ${{ steps.resolve.outputs.docker_tag }} |" >> $GITHUB_STEP_SUMMARY
          echo "| Dry Run | ${{ steps.resolve.outputs.is_dry_run }} |" >> $GITHUB_STEP_SUMMARY

  # ===========================================================================
  # Update version in source files
  # ===========================================================================
  update-version:
    name: Update Version
    runs-on: ubuntu-latest
    needs: [resolve]
    if: needs.resolve.outputs.is_dry_run != 'true'

    steps:
      - name: Checkout repository
        uses: actions/checkout@v4
        with:
          token: ${{ secrets.GITEA_TOKEN }}
          fetch-depth: 0

      - name: Set up Python
        uses: actions/setup-python@v5
        with:
          python-version: '3.12'

      - name: Update version
        run: |
          python3 .gitea/scripts/release/bump-service-version.py \
            "${{ needs.resolve.outputs.service }}" \
            "${{ needs.resolve.outputs.new_version }}" \
            --docker-tag "${{ needs.resolve.outputs.docker_tag }}" \
            --git-sha "${{ github.sha }}"

      - name: Commit version update
        run: |
          git config user.name "github-actions[bot]"
          git config user.email "github-actions[bot]@users.noreply.github.com"

          git add src/Directory.Versions.props devops/releases/service-versions.json

          if git diff --cached --quiet; then
            echo "No version changes to commit"
          else
            git commit -m "chore(${{ needs.resolve.outputs.service }}): release v${{ needs.resolve.outputs.new_version }}

          Docker tag: ${{ needs.resolve.outputs.docker_tag }}

          🤖 Generated with [Claude Code](https://claude.com/claude-code)

          Co-Authored-By: github-actions[bot] <github-actions[bot]@users.noreply.github.com>"

            git push
          fi

  # ===========================================================================
  # Build and test the service
  # ===========================================================================
  build-test:
    name: Build and Test
    runs-on: ubuntu-latest
    needs: [resolve, update-version]
    if: always() && (needs.update-version.result == 'success' || needs.update-version.result == 'skipped')

    steps:
      - name: Checkout repository
        uses: actions/checkout@v4
        with:
          ref: ${{ github.ref }}

      - name: Setup .NET
        uses: actions/setup-dotnet@v4
        with:
          dotnet-version: ${{ env.DOTNET_VERSION }}
          include-prerelease: true

      - name: Restore dependencies
        run: dotnet restore src/StellaOps.sln

      - name: Build solution
        run: |
          dotnet build src/StellaOps.sln \
            --configuration Release \
            --no-restore \
            -p:StellaOpsServiceVersion=${{ needs.resolve.outputs.new_version }}

      - name: Run tests
        if: needs.resolve.outputs.skip_tests != 'true'
        run: |
          SERVICE="${{ needs.resolve.outputs.service }}"
          SERVICE_PASCAL=$(echo "$SERVICE" | sed -r 's/(^|-)(\w)/\U\2/g')

          # Find and run tests for this service
          TEST_PROJECTS=$(find src -path "*/${SERVICE_PASCAL}/*" -name "*.Tests.csproj" -o -path "*/${SERVICE_PASCAL}*Tests*" -name "*.csproj" | head -20)

          if [[ -n "$TEST_PROJECTS" ]]; then
            echo "Running tests for: $TEST_PROJECTS"
            echo "$TEST_PROJECTS" | xargs -I{} dotnet test {} --configuration Release --no-build --verbosity normal
          else
            echo "::warning::No test projects found for service: $SERVICE"
          fi

      - name: Upload build artifacts
        uses: actions/upload-artifact@v4
        with:
          name: build-${{ needs.resolve.outputs.service }}
          path: |
            src/**/bin/Release/**/*.dll
            src/**/bin/Release/**/*.exe
            src/**/bin/Release/**/*.pdb
          retention-days: 7

  # ===========================================================================
  # Build and publish Docker image
  # ===========================================================================
  publish-container:
    name: Publish Container
    runs-on: ubuntu-latest
    needs: [resolve, build-test]
    if: needs.resolve.outputs.is_dry_run != 'true'
    outputs:
      image_digest: ${{ steps.push.outputs.digest }}

    steps:
      - name: Checkout repository
        uses: actions/checkout@v4

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3

      - name: Login to registry
        uses: docker/login-action@v3
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ secrets.REGISTRY_USERNAME }}
          password: ${{ secrets.REGISTRY_PASSWORD }}

      - name: Determine Dockerfile path
        id: dockerfile
        run: |
          SERVICE="${{ needs.resolve.outputs.service }}"
          SERVICE_PASCAL=$(echo "$SERVICE" | sed -r 's/(^|-)(\w)/\U\2/g')

          # Look for service-specific Dockerfile
          DOCKERFILE_PATHS=(
            "devops/docker/${SERVICE}/Dockerfile"
            "devops/docker/${SERVICE_PASCAL}/Dockerfile"
            "src/${SERVICE_PASCAL}/Dockerfile"
            "src/${SERVICE_PASCAL}/StellaOps.${SERVICE_PASCAL}.WebService/Dockerfile"
            "devops/docker/platform/Dockerfile"
          )

          for path in "${DOCKERFILE_PATHS[@]}"; do
            if [[ -f "$path" ]]; then
              echo "dockerfile=$path" >> $GITHUB_OUTPUT
              echo "Found Dockerfile: $path"
              exit 0
            fi
          done

          echo "::error::No Dockerfile found for service: $SERVICE"
          exit 1

      - name: Build and push image
        id: push
        uses: docker/build-push-action@v5
        with:
          context: .
          file: ${{ steps.dockerfile.outputs.dockerfile }}
          push: true
          tags: |
            ${{ env.REGISTRY }}/${{ needs.resolve.outputs.service }}:${{ needs.resolve.outputs.docker_tag }}
            ${{ env.REGISTRY }}/${{ needs.resolve.outputs.service }}:${{ needs.resolve.outputs.new_version }}
            ${{ env.REGISTRY }}/${{ needs.resolve.outputs.service }}:latest
          labels: |
            org.opencontainers.image.title=${{ needs.resolve.outputs.service }}
            org.opencontainers.image.version=${{ needs.resolve.outputs.new_version }}
            org.opencontainers.image.revision=${{ github.sha }}
            org.opencontainers.image.source=${{ github.server_url }}/${{ github.repository }}
            com.stellaops.service.name=${{ needs.resolve.outputs.service }}
            com.stellaops.service.version=${{ needs.resolve.outputs.new_version }}
            com.stellaops.docker.tag=${{ needs.resolve.outputs.docker_tag }}
          build-args: |
            VERSION=${{ needs.resolve.outputs.new_version }}
            GIT_SHA=${{ github.sha }}
          cache-from: type=gha
          cache-to: type=gha,mode=max

      - name: Image summary
        run: |
          echo "## Container Image" >> $GITHUB_STEP_SUMMARY
          echo "" >> $GITHUB_STEP_SUMMARY
          echo "| Property | Value |" >> $GITHUB_STEP_SUMMARY
          echo "|----------|-------|" >> $GITHUB_STEP_SUMMARY
          echo "| Image | \`${{ env.REGISTRY }}/${{ needs.resolve.outputs.service }}\` |" >> $GITHUB_STEP_SUMMARY
          echo "| Tag | \`${{ needs.resolve.outputs.docker_tag }}\` |" >> $GITHUB_STEP_SUMMARY
          echo "| Digest | \`${{ steps.push.outputs.digest }}\` |" >> $GITHUB_STEP_SUMMARY

  # ===========================================================================
  # Generate SBOM
  # ===========================================================================
  generate-sbom:
    name: Generate SBOM
    runs-on: ubuntu-latest
    needs: [resolve, publish-container]
    if: needs.resolve.outputs.is_dry_run != 'true'

    steps:
      - name: Checkout repository
        uses: actions/checkout@v4

      - name: Install Syft
        run: |
          curl -sSfL https://raw.githubusercontent.com/anchore/syft/main/install.sh | \
            sh -s -- -b /usr/local/bin v${{ env.SYFT_VERSION }}

      - name: Login to registry
        uses: docker/login-action@v3
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ secrets.REGISTRY_USERNAME }}
          password: ${{ secrets.REGISTRY_PASSWORD }}

      - name: Generate SBOM
        run: |
          IMAGE="${{ env.REGISTRY }}/${{ needs.resolve.outputs.service }}:${{ needs.resolve.outputs.docker_tag }}"

          syft "$IMAGE" \
            --output cyclonedx-json=sbom.cyclonedx.json \
            --output spdx-json=sbom.spdx.json

          echo "Generated SBOMs for: $IMAGE"

      - name: Upload SBOM artifacts
        uses: actions/upload-artifact@v4
        with:
          name: sbom-${{ needs.resolve.outputs.service }}-${{ needs.resolve.outputs.new_version }}
          path: |
            sbom.cyclonedx.json
            sbom.spdx.json
          retention-days: 90

  # ===========================================================================
  # Sign artifacts with Cosign
  # ===========================================================================
  sign-artifacts:
    name: Sign Artifacts
    runs-on: ubuntu-latest
    needs: [resolve, publish-container, generate-sbom]
    if: needs.resolve.outputs.is_dry_run != 'true'

    steps:
      - name: Install Cosign
        uses: sigstore/cosign-installer@v3

      - name: Login to registry
        uses: docker/login-action@v3
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ secrets.REGISTRY_USERNAME }}
          password: ${{ secrets.REGISTRY_PASSWORD }}

      - name: Sign container image
        if: env.COSIGN_PRIVATE_KEY_B64 != ''
        env:
          COSIGN_PRIVATE_KEY_B64: ${{ secrets.COSIGN_PRIVATE_KEY_B64 }}
          COSIGN_PASSWORD: ${{ secrets.COSIGN_PASSWORD }}
        run: |
          echo "$COSIGN_PRIVATE_KEY_B64" | base64 -d > cosign.key

          IMAGE="${{ env.REGISTRY }}/${{ needs.resolve.outputs.service }}@${{ needs.publish-container.outputs.image_digest }}"

          cosign sign --key cosign.key \
            -a "service=${{ needs.resolve.outputs.service }}" \
            -a "version=${{ needs.resolve.outputs.new_version }}" \
            -a "docker-tag=${{ needs.resolve.outputs.docker_tag }}" \
            "$IMAGE"

          rm -f cosign.key
          echo "Signed: $IMAGE"

      - name: Download SBOM
        uses: actions/download-artifact@v4
        with:
          name: sbom-${{ needs.resolve.outputs.service }}-${{ needs.resolve.outputs.new_version }}
          path: sbom/

      - name: Attach SBOM to image
        if: env.COSIGN_PRIVATE_KEY_B64 != ''
        env:
          COSIGN_PRIVATE_KEY_B64: ${{ secrets.COSIGN_PRIVATE_KEY_B64 }}
          COSIGN_PASSWORD: ${{ secrets.COSIGN_PASSWORD }}
        run: |
          echo "$COSIGN_PRIVATE_KEY_B64" | base64 -d > cosign.key

          IMAGE="${{ env.REGISTRY }}/${{ needs.resolve.outputs.service }}@${{ needs.publish-container.outputs.image_digest }}"

          cosign attach sbom --sbom sbom/sbom.cyclonedx.json "$IMAGE"
          cosign sign --key cosign.key --attachment sbom "$IMAGE"

          rm -f cosign.key

  # ===========================================================================
  # Release summary
  # ===========================================================================
  summary:
    name: Release Summary
    runs-on: ubuntu-latest
    needs: [resolve, build-test, publish-container, generate-sbom, sign-artifacts]
    if: always()

    steps:
      - name: Generate summary
        run: |
          echo "# Service Release: ${{ needs.resolve.outputs.service }}" >> $GITHUB_STEP_SUMMARY
          echo "" >> $GITHUB_STEP_SUMMARY
          echo "## Release Details" >> $GITHUB_STEP_SUMMARY
          echo "" >> $GITHUB_STEP_SUMMARY
          echo "| Property | Value |" >> $GITHUB_STEP_SUMMARY
          echo "|----------|-------|" >> $GITHUB_STEP_SUMMARY
          echo "| Service | ${{ needs.resolve.outputs.service }} |" >> $GITHUB_STEP_SUMMARY
          echo "| Version | ${{ needs.resolve.outputs.new_version }} |" >> $GITHUB_STEP_SUMMARY
          echo "| Previous | ${{ needs.resolve.outputs.current_version }} |" >> $GITHUB_STEP_SUMMARY
          echo "| Docker Tag | \`${{ needs.resolve.outputs.docker_tag }}\` |" >> $GITHUB_STEP_SUMMARY
          echo "| Git SHA | \`${{ github.sha }}\` |" >> $GITHUB_STEP_SUMMARY
          echo "" >> $GITHUB_STEP_SUMMARY
          echo "## Job Results" >> $GITHUB_STEP_SUMMARY
          echo "" >> $GITHUB_STEP_SUMMARY
          echo "| Job | Status |" >> $GITHUB_STEP_SUMMARY
          echo "|-----|--------|" >> $GITHUB_STEP_SUMMARY
          echo "| Build & Test | ${{ needs.build-test.result }} |" >> $GITHUB_STEP_SUMMARY
          echo "| Publish Container | ${{ needs.publish-container.result }} |" >> $GITHUB_STEP_SUMMARY
          echo "| Generate SBOM | ${{ needs.generate-sbom.result }} |" >> $GITHUB_STEP_SUMMARY
          echo "| Sign Artifacts | ${{ needs.sign-artifacts.result }} |" >> $GITHUB_STEP_SUMMARY
          echo "" >> $GITHUB_STEP_SUMMARY

          if [[ "${{ needs.resolve.outputs.is_dry_run }}" == "true" ]]; then
            echo "⚠️ **This was a dry run. No artifacts were published.**" >> $GITHUB_STEP_SUMMARY
          else
            echo "## Pull Image" >> $GITHUB_STEP_SUMMARY
            echo "" >> $GITHUB_STEP_SUMMARY
            echo "\`\`\`bash" >> $GITHUB_STEP_SUMMARY
            echo "docker pull ${{ env.REGISTRY }}/${{ needs.resolve.outputs.service }}:${{ needs.resolve.outputs.docker_tag }}" >> $GITHUB_STEP_SUMMARY
            echo "\`\`\`" >> $GITHUB_STEP_SUMMARY
          fi