# Azure Pipelines steps template: pull a rules artifact for your own publish step.
#
#   resources:
#     repositories:
#       - repository: gorules
#         type: github
#         name: gorules/cli
#         ref: refs/tags/cli-v0.3.3 # x-release-please-version
#         endpoint: <your GitHub service connection>
#
#   jobs:
#     - job: deploy_rules
#       pool:
#         vmImage: ubuntu-latest
#       steps:
#         - template: templates/azure-pipelines-pull.yml@gorules
#           parameters:
#             url: https://acme.us1.gorules.io
#         - script: <publish $(Build.ArtifactStagingDirectory)/rules however you deploy>
#
# The template only pulls: it downloads the artifact and sets result variables
# (rulesChanged, rulesProject, rulesTarget, rulesVersion, rulesRelease,
# rulesSha256) for the steps you add after it. Publishing is yours.
#
# GORULES_TOKEN must exist as a secret variable, either in the pipeline or in a
# linked variable group.
#
# For BRMS-triggered runs, the pipeline must accept the GRL_PAYLOAD variable at
# queue time: add a pipeline variable named GRL_PAYLOAD (any value) with "Let
# users override this value when running this pipeline" checked. Organizations
# with "Limit variables that can be set at queue time" enabled (the default on
# newer organizations) reject the queue request otherwise.

parameters:
  - name: url
    type: string
  # Project and target normally arrive in GRL_PAYLOAD; set them only for
  # runs that have no payload (schedules), or pass them at queue time.
  - name: project
    type: string
    default: ''
  - name: target
    type: string
    default: ''
  - name: out
    type: string
    default: $(Build.ArtifactStagingDirectory)/rules
  - name: name
    type: string
    default: ''
  - name: unpack
    type: boolean
    default: false
  # With unpack, deletes files in the destination that are not in the artifact
  - name: delete
    type: boolean
    default: false
  # Release or commit id already held; when unchanged, rulesChanged is 'false'
  - name: current
    type: string
    default: ''
  - name: cliVersion
    type: string
    default: 0.3.3 # x-release-please-version

steps:
  # Microsoft-hosted images already ship Node; self-hosted agents may not.
  - task: NodeTool@0
    displayName: Use Node 24
    inputs:
      versionSpec: '24.x'

  - script: |
      set -euo pipefail

      # BRMS passes GRL_PAYLOAD when it triggers the run. On a manual run the
      # macro below does not resolve and Azure leaves the literal
      # '$(GRL_PAYLOAD)' in place, so that exact string means "not set".
      if [ -n "${GRL_PAYLOAD:-}" ] && [ "${GRL_PAYLOAD}" != '$(GRL_PAYLOAD)' ]; then
        GORULES_PROJECT=$(node -e 'const p=JSON.parse(process.env.GRL_PAYLOAD);process.stdout.write(p.project?.key||p.projectId||"")')
        GORULES_TARGET=$(node -e 'const p=JSON.parse(process.env.GRL_PAYLOAD);process.stdout.write(p.target||"main")')
        export GORULES_PROJECT GORULES_TARGET
        echo "Triggered by BRMS: $GORULES_PROJECT $GORULES_TARGET"
      fi

      args=(pull --out "${{ parameters.out }}" --json)
      if [ -n "${{ parameters.name }}" ]; then args+=(--name "${{ parameters.name }}"); fi
      if [ -n "${{ parameters.current }}" ]; then args+=(--current "${{ parameters.current }}"); fi
      if [ "${{ lower(parameters.unpack) }}" = "true" ]; then args+=(--unpack); fi
      if [ "${{ lower(parameters.delete) }}" = "true" ]; then args+=(--delete); fi

      # Exit 3 means the target has not moved: a normal outcome, not a failure
      set +e
      npx --yes "@gorules/cli@${{ parameters.cliVersion }}" "${args[@]}" > result.json
      code=$?
      set -e

      # The effective values, payload-aware, for the steps that follow
      echo "##vso[task.setvariable variable=rulesProject]${GORULES_PROJECT:-}"
      echo "##vso[task.setvariable variable=rulesTarget]${GORULES_TARGET:-main}"

      if [ "$code" -eq 3 ]; then
        echo "##vso[task.setvariable variable=rulesChanged]false"
        echo "Target unchanged, nothing downloaded."
        exit 0
      fi
      [ "$code" -ne 0 ] && exit "$code"

      echo "##vso[task.setvariable variable=rulesChanged]true"
      echo "##vso[task.setvariable variable=rulesVersion]$(node -p "require('./result.json').version || ''")"
      echo "##vso[task.setvariable variable=rulesRelease]$(node -p "require('./result.json').release || ''")"
      echo "##vso[task.setvariable variable=rulesSha256]$(node -p "require('./result.json').sha256 || ''")"
    displayName: gorules pull
    env:
      GORULES_URL: ${{ parameters.url }}
      GORULES_PROJECT: ${{ parameters.project }}
      GORULES_TARGET: ${{ parameters.target }}
      # Secret variables are NOT mapped into the environment automatically;
      # without this line the token is simply absent.
      GORULES_TOKEN: $(GORULES_TOKEN)
      # Empty on a manual run; set by BRMS when it queues the pipeline
      GRL_PAYLOAD: $(GRL_PAYLOAD)