// Pseudocode from argocdCreateOrUpdateApp.groovy
def appExists = sh(
  script: "argocd app get ${appName}",
  returnStatus: true
) == 0

if (appExists) {
  sh "argocd app set ${appName} --repo ${repoUrl}"
} else {
  sh "argocd app create ${appName} --repo ${repoUrl} --dest-server https://kubernetes.default.svc --dest-namespace default --path ." 
}

# GitLab CI .gitlab-ci.yml
argocd_sync:
  script:
    - |
      if argocd app get $APP_NAME &>/dev/null; then
        echo "App exists, updating..."
        argocd app set $APP_NAME --repo $REPO_URL
      else
        echo "App not found, creating..."
        argocd app create $APP_NAME --repo $REPO_URL --dest-server https://kubernetes.default.svc --dest-namespace default --path .
      fi

stages:
  - test
  - build

variables:
  DOCKER_IMAGE_NAME: $CI_REGISTRY_IMAGE
  DOCKER_IMAGE_TAG: $CI_COMMIT_SHORT_SHA

# Lint job - check code quality
lint:
  stage: test
  image: python:3.12-slim
  before_script:
    - pip install flake8
  script:
    - flake8 app.py tests/ --max-line-length=100 --statistics
  allow_failure: true

# Test job - run unit tests
test:
  stage: test
  image: python:3.12-slim
  script:
    - pip install -r requirements.txt
    - pytest tests/ -v --junitxml=report.xml
  artifacts:
    reports:
      junit: report.xml

# Build and push Docker image
build:
  stage: build
  needs:
    - test # Ensure tests pass before building
  image: docker:24-dind
  services:
    - docker:24-dind # Without this, docker will not able to push!
  before_script:
    - echo "Container Registry - $CI_REGISTRY"
    - echo $CI_REGISTRY_PASSWORD | docker login -u $CI_REGISTRY_USER --password-stdin $CI_REGISTRY
  script:
    - docker build -t $DOCKER_IMAGE_NAME:$DOCKER_IMAGE_TAG -t $DOCKER_IMAGE_NAME:latest .

    # Install Trivy
    - echo "Installing Trivy..."
    - apk add --no-cache curl
    - curl -sfL https://raw.githubusercontent.com/aquasecurity/trivy/main/contrib/install.sh | sh -s -- -b /usr/local/bin

    # Scan the image for vulnerabilities
    - echo "Scanning image with Trivy for MEDIUM, HIGH and CRITICAL vulnerabilities..."
    # Generate full report (MEDIUM, HIGH, CRITICAL) for visibility
    - trivy image --severity MEDIUM,HIGH,CRITICAL --format table $DOCKER_IMAGE_NAME:$DOCKER_IMAGE_TAG
    # Fail build only if HIGH or CRITICAL vulnerabilities found
    - trivy image --severity HIGH,CRITICAL --exit-code 1 --quiet $DOCKER_IMAGE_NAME:$DOCKER_IMAGE_TAG > /dev/null 2>&1

    - docker push $DOCKER_IMAGE_NAME:$DOCKER_IMAGE_TAG
    - docker push $DOCKER_IMAGE_NAME:latest
  after_script:
    - docker logout $CI_REGISTRY

pytest==7.4.3
pytest-flask==1.3.0
flake8==6.1.0
- gunicorn==21.2.0
+ gunicorn==22.0.0

stages:
  - test
  - build

# Lint job - check code quality
lint:
  stage: test

# Test job - run unit tests
test:
  stage: test

# Build and push Docker image
build:
  stage: build
rules:
    - if: '$CI_COMMIT_TAG'
      when: always
    - when: never

#=== SONARQUBE STAGE ===#
#=== 5.0.1 compatible with Sonarqube Server 10.5.xx ===#
sonarqube:
  <<: *sonar_variables
  variables:
    SONAR_PROJECT_KEY: "sonarqube-project-name"
    SONAR_SOURCES: "scanner"
    SONAR_SCANNER_OPTS: "-Dhttp.proxyHost=10.0.0.99 -Dhttp.proxyPort=8080 -Dhttps.proxyHost=10.0.0.99 -Dhttps.proxyPort=8080"
  script:
    - sonar-scanner -Dsonar.host.url=$SONAR_HOST_URL -Dsonar.token=$SONAR_TOKEN -Dsonar.projectKey=$SONAR_PROJECT_KEY -Dsonar.sources=$SONAR_SOURCES -Dsonar.python.coverage.reportPaths=coverage.xml
    - |
      # Get task ID from report-task.txt
      if [ ! -f .scannerwork/report-task.txt ]; then
        echo "Error: report-task.txt not found"
        exit 1
      fi

      TASK_ID=$(cat .scannerwork/report-task.txt | grep ceTaskId | cut -d'=' -f2)

      if [ -z "$TASK_ID" ]; then
        echo "Error: Could not extract ceTaskId"
        exit 1
      fi

      echo "Task ID: ${TASK_ID}"

      # Wait for task completion
      MAX_WAIT=600
      ELAPSED=0

      while [ $ELAPSED -lt $MAX_WAIT ]; do
        STATUS=$(curl -s -u "${SONAR_TOKEN}:" "${SONAR_HOST_URL}/api/ce/task?id=${TASK_ID}" | jq -r '.task.status')

        if [ -z "$STATUS" ] || [ "$STATUS" = "null" ]; then
          echo "Error: Failed to get task status from API"
          exit 1
        fi

        echo "Analysis status: ${STATUS} (elapsed: ${ELAPSED}s)"

        if [ "$STATUS" = "SUCCESS" ]; then
          echo "Analysis completed successfully"
          break
        elif [ "$STATUS" = "FAILED" ] || [ "$STATUS" = "CANCELED" ]; then
          echo "SonarQube analysis failed with status: ${STATUS}"
          exit 1
        fi

        sleep 5
        ELAPSED=$((ELAPSED + 5))
      done

      if [ $ELAPSED -ge $MAX_WAIT ]; then
        echo "Timeout waiting for analysis (${MAX_WAIT}s)"
        exit 1
      fi

      # Check quality gate
      echo "Checking quality gate..."
      ANALYSIS_ID=$(curl -s -u "${SONAR_TOKEN}:" "${SONAR_HOST_URL}/api/ce/task?id=${TASK_ID}" | jq -r '.task.analysisId')

      if [ -z "$ANALYSIS_ID" ] || [ "$ANALYSIS_ID" = "null" ]; then
        echo "Error: Could not get analysisId"
        exit 1
      fi

      echo "Analysis ID: ${ANALYSIS_ID}"

      QG_STATUS=$(curl -s -u "${SONAR_TOKEN}:" "${SONAR_HOST_URL}/api/qualitygates/project_status?analysisId=${ANALYSIS_ID}" | jq -r '.projectStatus.status')

      echo "Quality Gate status: ${QG_STATUS}"

      if [ "$QG_STATUS" != "OK" ]; then
        echo "Quality gate failed: ${QG_STATUS}"
        echo "View details at: ${SONAR_HOST_URL}/dashboard?id=${SONAR_PROJECT_KEY}"
        exit 1
      fi

      echo "Quality gate passed!!!"

{
    "auths": {
        "docker.io": {
            "auth": "base64(username:password)"
        }
    }
}

{"auths":{"docker.io":{"auth":"base64(username:password)"}}}

include:
  - project: 'kientl-demo-group/demo-real-template'
    ref: v0.0.7
    file:
      - '/templates/jobs/sonarqube.yml'
      - '/templates/jobs/build-and-scan-image.yml'

stages:
  - sonarqube
  - build

#=== SONARQUBE STAGE ===#
#=== 5.0.1 compatible with Sonarqube Server 10.5.xx ===#
sonarqube: # ← This is the KEY that links template and consumer
  variables:
    SONAR_PROJECT_KEY: "demo-project-key"
    SONAR_SOURCES: "." # scan all files in repo

# Add workflow to build stage
build-image: # ← This is the KEY that links template and consumer
  rules:
    - if: >
        $CI_PIPELINE_SOURCE == "merge_request_event" &&
        $CI_COMMIT_BRANCH != $CI_DEFAULT_BRANCH &&
        $CI_COMMIT_TAG == null
    - if: $CI_COMMIT_BRANCH == "kienlt-demo-branch"
    - if: $CI_COMMIT_TAG

# Pre-installs Wine + Python 3.12 + cx-Freeze + PySide6 + all dependencies

FROM tobix/pywine:3.12

# Install system dependencies
RUN apt-get update && apt-get install -y \
    cabextract \
    curl \
    git \
    p7zip-full \
    s3cmd \
    wget \
    xvfb \
    && rm -rf /var/lib/apt/lists/*

# Debug: Check Wine prefix location
RUN echo "=== Wine Environment Debug ===" && \
    wine --version && \
    echo "WINEPREFIX: $WINEPREFIX" && \
    echo "HOME: $HOME" && \
    wine cmd /c echo %PROGRAMFILES% && \
    wine cmd /c dir "C:\\" && \
    find / -name "drive_c" -type d 2>/dev/null | head -5

# Download and install Inno Setup using Wine  
RUN cd /tmp && \
    wget -q https://files.jrsoftware.org/is/6/innosetup-6.5.4.exe -O innosetup.exe && \
    echo "Running Inno Setup installer...." && \
    DISPLAY=:99 xvfb-run -a wine innosetup.exe /VERYSILENT /SUPPRESSMSGBOXES /NORESTART /SP- && \
    wineserver -w && \
    echo "Checking Inno Setup installation..." && \
    ls -la "/opt/wineprefix/drive_c/Program Files (x86)/Inno Setup 6/" && \
    test -f "/opt/wineprefix/drive_c/Program Files (x86)/Inno Setup 6/ISCC.exe" && \
    echo "✓ ISCC.exe installed successfully" && \
    rm -rf /tmp/innosetup.exe

# Pre-install Python dependencies under Wine
COPY requirements/base.txt /tmp/requirements-base.txt
COPY requirements/compiler.txt /tmp/requirements-compiler.txt

RUN wine pip install --no-cache-dir -r /tmp/requirements-base.txt && \
    wine pip install --no-cache-dir -r /tmp/requirements-compiler.txt && \
    wine pip install --no-cache-dir cx-Freeze && \
    wine pip install --no-cache-dir pypiwin32 pywin32 pywin32-ctypes

# Warm up Wine prefix
RUN wine python --version && wine pip --version

# Clean up
RUN rm /tmp/requirements-*.txt

WORKDIR /workspace

#############################################
# Stage 3 (continued): Build Windows Package. Built with Dockerfile.windows-builder
#############################################
build-windows:
  stage: build-packages
  image: ${BUILDER_IMAGE_WINDOWS}  # Pre-built Windows builder image. 
  dependencies:
    - build-windows-libs
  variables:
    WINEDEBUG: "-all"  # Suppress Wine debug messages
  script:
    - |
      # Generate version (keep Windows version simple, just strip prefix)
      if [ -n "${CI_COMMIT_TAG}" ]; then
        # Strip non-numeric prefix from tag (e.g., "test-1.0.0" -> "1.0.0")
        VERSION=$(echo "${CI_COMMIT_TAG}" | sed 's/^[^0-9]*//')
        if [ -z "$VERSION" ]; then
          VERSION="${CI_COMMIT_TAG}"
        fi
      else
        VERSION="${CI_COMMIT_SHORT_SHA}"
      fi
      echo "Building Windows package - Version ${VERSION}"

      # Convert QRC resources
      wine pyside6-rcc resources/icons.qrc -o src/views/base/pyside6/icons_rc.py

      # Build executable with cx-Freeze (dependencies already installed in image!)
      cd src
      wine python setup.py build
      cd ..

      # Create installer with Inno Setup using Wine
      echo "🔧 Running Inno Setup to create installer..."
      wine "C:\\Program Files (x86)\\Inno Setup 6\\ISCC.exe" fcdclient_installer.iss

      # Find the generated installer file
      INSTALLER_FILE=$(find Output -name "*.exe" -type f | head -n 1)

      if [ -f "$INSTALLER_FILE" ]; then
        # Rename with version
        INSTALLER_VERSIONED="FCDClient_${VERSION}_win64.exe"
        mv "$INSTALLER_FILE" "$INSTALLER_VERSIONED"

        PACKAGE_SIZE=$(du -h "$INSTALLER_VERSIONED" | cut -f1)
        echo "✓ Installer created: $INSTALLER_VERSIONED ($PACKAGE_SIZE)"
      else
        echo "❌ ERROR: Installer file not found!"
        exit 1
      fi

      # Configure s3cmd
      S3_HOST=$(echo ${S3_ENDPOINT} | sed 's|https://||' | sed 's|http://||')
      cat > ~/.s3cfg <<EOF
      [default]
      access_key = ${S3_ACCESS_KEY}
      secret_key = ${S3_SECRET_KEY}
      host_base = ${S3_HOST}
      host_bucket = ${S3_HOST}
      use_https = True
      check_ssl_certificate = False
      EOF

      # Upload to S3
      S3_PATH="fcdclient/windows/${INSTALLER_VERSIONED}"
      echo "Uploading to S3: ${S3_PATH}"
      s3cmd put --acl-public "$INSTALLER_VERSIONED" "s3://${S3_BUCKET}/${S3_PATH}"

      # Construct download URL (include bucket in path)
      DOWNLOAD_URL="${S3_ENDPOINT}/${S3_BUCKET}/${S3_PATH}"
      echo "Download URL: $DOWNLOAD_URL"

      # Save build info for notify stage
      mkdir -p build-info
      echo "${DOWNLOAD_URL}" > "build-info/windows_url.txt"
      echo "${INSTALLER_VERSIONED}" > "build-info/windows_filename.txt"
      echo "${PACKAGE_SIZE}" > "build-info/windows_size.txt"
      echo "${VERSION}" > "build-info/windows_version.txt"

      echo "✓ Windows build and upload completed successfully"
  after_script:
    - |
      # Save job URL (runs even on failure)
      mkdir -p build-info
      echo "${CI_JOB_URL}" > "build-info/windows_job_url.txt"
  artifacts:
    paths:
      - build-info/
    when: always
    expire_in: "1 day"