pipeline {
  agent none
  options {
    skipDefaultCheckout(true)
    disableConcurrentBuilds()
    timestamps()
    timeout(time: 120, unit: 'MINUTES')
    buildDiscarder(logRotator(numToKeepStr: '30', artifactNumToKeepStr: '10'))
  }
  environment {
    APP_KIND = 'go' // Shared enterprise reference: python; other supported projects: go / node.
    AWS_REGION = 'ap-east-1'
    ECR_REPOSITORY = 'ci/orders-api'
    STAGING_CLUSTER = 'REPLACE_STAGING_EKS_CLUSTER'
    PRODUCTION_CLUSTER = 'REPLACE_PRODUCTION_EKS_CLUSTER'
  }
  stages {
    stage('Build once') {
      agent { label 'trusted-build' }
      steps {
        deleteDir()
        checkout scm
        sh '''#!/usr/bin/env bash
set -euo pipefail
case "$APP_KIND" in
  go) go test -race ./...; go vet ./... ;;
  node) npm ci; npm run lint; npm test ;;
  python) test -f requirements.txt; test -f ci/test.sh ;;
  *) exit 2 ;;
esac
bash ci/build-image.sh
'''
        stash name: 'release', includes: 'audit/image.txt,audit/commit.txt,ci/deploy.py,ci/verify-business.sh'
      }
      post {
        always {
          archiveArtifacts artifacts: 'audit/**', allowEmptyArchive: true, fingerprint: true
          deleteDir()
        }
      }
    }
    stage('Staging') {
      agent { label 'staging-release' }
      steps {
        deleteDir()
        unstash 'release'
        lock(resource: 'orders-staging') {
          sh '''#!/usr/bin/env bash
set -euo pipefail
export KUBECONFIG
KUBECONFIG=$(mktemp)
trap 'rm -f "$KUBECONFIG"' EXIT
aws eks update-kubeconfig --region "$AWS_REGION" --name "$STAGING_CLUSTER" --alias release-staging --kubeconfig "$KUBECONFIG"
python3 ci/deploy.py --context release-staging --environment staging
'''
        }
      }
      post {
        always {
          archiveArtifacts artifacts: 'audit/**', allowEmptyArchive: true, fingerprint: true
          deleteDir()
        }
      }
    }
    stage('Approve production') {
      steps {
        timeout(time: 30, unit: 'MINUTES') {
          input message: 'Review image digest, staging receipt and data compatibility; approve production?',
                ok: 'Deploy', submitter: 'release-managers', submitterParameter: 'APPROVED_BY'
        }
      }
    }
    stage('Production') {
      agent { label 'production-release' }
      steps {
        deleteDir()
        unstash 'release'
        lock(resource: 'orders-production') {
          sh '''#!/usr/bin/env bash
set -euo pipefail
export KUBECONFIG
KUBECONFIG=$(mktemp)
trap 'rm -f "$KUBECONFIG"' EXIT
aws eks update-kubeconfig --region "$AWS_REGION" --name "$PRODUCTION_CLUSTER" --alias release-production --kubeconfig "$KUBECONFIG"
python3 ci/deploy.py --context release-production --environment production
'''
        }
      }
      post {
        always {
          archiveArtifacts artifacts: 'audit/**', allowEmptyArchive: true, fingerprint: true
          deleteDir()
        }
      }
    }
  }
  post {
    unsuccessful { echo 'Release did not complete. Inspect receipts; do not blindly retry production writes.' }
  }
}