image: node:20

workflow:
  rules:
    - if: '$CI_PIPELINE_SOURCE == "merge_request_event"'
    - if: '$CI_COMMIT_BRANCH == "main"'
    - if: '$CI_COMMIT_BRANCH'
      when: always

variables:
  GIT_DEPTH: 0
  GIT_STRATEGY: fetch

include:
  # Módulos de qualidade
  - project: 'kontrole1/cicd/pipeline'
    file: 'ci/templates/claude-review.yml'
    ref: 'main'
  - project: 'kontrole1/cicd/pipeline'
    file: 'ci/templates/mr-description-check.yml'
    ref: 'main'
  - project: 'kontrole1/cicd/pipeline'
    file: 'ci/templates/commit-lint.yml'
    ref: 'main'
  - project: 'kontrole1/cicd/pipeline'
    file: 'ci/templates/security.yml'
    ref: 'main'
  - project: 'kontrole1/cicd/pipeline'
    file: 'ci/templates/review-gate.yml'
    ref: 'main'
  - project: 'kontrole1/cicd/pipeline'
    file: 'ci/templates/approval-check.yml'
    ref: 'main'
  - project: 'kontrole1/cicd/pipeline'
    file: 'ci/templates/notifications.yml'
    ref: 'main'

stages:
  - .pre
  - review
  - test
  - build
  - tag
  - publish
  - notify

default:
  cache:
    key: ${CI_COMMIT_REF_SLUG}
    paths:
      - node_modules/
  before_script:
    - npm ci
  tags:
    - docker

# Security scans
sast:
  extends: .sast-scan

dependency-scan:
  extends: .dependency-scan

secret-detection:
  extends: .secret-detection

# Pipeline original preservada
lint_and_test:
  stage: test
  script:
    - npm test -- --watch=false || echo "No tests configured"
  rules:
    - if: '$CI_COMMIT_BRANCH == "main"'

build:
  stage: build
  script:
    - npm run build
  artifacts:
    paths:
      - dist/
  needs:
    - lint_and_test
  rules:
    - if: '$CI_COMMIT_BRANCH == "main"'

create_tag:
  stage: tag
  needs:
    - build
  before_script: []
  script:
    - git config --global user.email "${GITLAB_USER_EMAIL:-ci@gitlab}"
    - git config --global user.name "${GITLAB_USER_NAME:-gitlab-ci}"
    - git fetch --all --tags
    - VERSION=$(node -p "require('./package.json').version")
    - TAG="v${VERSION}"
    - if git rev-parse "$TAG" >/dev/null 2>&1; then echo "Tag $TAG already exists, skipping"; exit 0; fi
    - |
      if [ -z "${GITLAB_TOKEN:-}" ]; then
        echo "GITLAB_TOKEN não configurado com permissão write_repository; não é possível criar tag."
        exit 1
      fi
    - |
      AUTH_USER="oauth2"
      AUTH_TOKEN="$GITLAB_TOKEN"
      REPO_URL="${CI_SERVER_PROTOCOL}://${AUTH_USER}:${AUTH_TOKEN}@${CI_SERVER_HOST}${CI_SERVER_PORT:+:$CI_SERVER_PORT}/${CI_PROJECT_PATH}.git"
      git tag "$TAG"
    - git push "$REPO_URL" "$TAG"
  rules:
    - if: '$CI_COMMIT_BRANCH == "main"'

publish_npm:
  stage: publish
  needs:
    - job: build
      artifacts: true
    - create_tag
  script:
    - echo "//registry.npmjs.org/:_authToken=${NPM_TOKEN}" > ~/.npmrc
    - npm publish --access public
  rules:
    - if: '$CI_COMMIT_BRANCH == "main"'
      when: manual
      allow_failure: false

# Notificação unificada (Slack + Roam)
notify:publish:
  extends: .notify-success
  needs:
    - job: publish_npm
  script:
    - VERSION=$(jq -r '.version' package.json 2>/dev/null || echo "?")
    - notify_all "#2EB67D" "Publicação npm @reachy/audience-module v${VERSION}" "✅" "Pacote publicado a partir da main."
  rules:
    - if: '$CI_COMMIT_BRANCH == "main"'
      when: on_success
    - when: never

notify:failure:pipeline:
  extends: .notify-failure
  needs: []
  script:
    - notify_all "#E01E5A" "Pipeline Audience Module falhou" "❌" ""
  rules:
    - if: '$CI_COMMIT_BRANCH == "main"'
      when: on_failure
    - when: never