def serviceModules = [
    'gateway', 'auth', 'iam', 'firstleg', 'finance', 'order', 'warehouse', 'file', 'print',
    'integration-service', 'lastleg-service', 'warehouse-overseas-service', 'audit-service'
]

def serviceJars = [
    'gateway': 'gateway/target/gateway-1.0.0-SNAPSHOT.jar',
    'auth': 'auth/target/auth-service-1.0.0-SNAPSHOT.jar',
    'iam': 'iam/target/iam-service-1.0.0-SNAPSHOT.jar',
    'firstleg': 'firstleg/target/firstleg-service-1.0.0-SNAPSHOT.jar',
    'finance': 'finance/target/finance-service-1.0.0-SNAPSHOT.jar',
    'order': 'order/target/order-service-1.0.0-SNAPSHOT.jar',
    'warehouse': 'warehouse/target/warehouse-service-1.0.0-SNAPSHOT.jar',
    'file': 'file/target/file-service-1.0.0-SNAPSHOT.jar',
    'print': 'print/target/print-service-1.0.0-SNAPSHOT.jar',
    'integration-service': 'integration-service/target/integration-service-1.0.0-SNAPSHOT.jar',
    'lastleg-service': 'lastleg-service/target/lastleg-service-1.0.0-SNAPSHOT.jar',
    'warehouse-overseas-service': 'warehouse-overseas-service/target/warehouse-overseas-service-1.0.0-SNAPSHOT.jar',
    'audit-service': 'audit-service/target/audit-service-1.0.0-SNAPSHOT.jar'
]

def fixedEnvironmentForServiceJob(String jobBaseName) {
    if (jobBaseName?.startsWith('baiyue-firstleg-prod-')) return 'production'
    if (jobBaseName?.startsWith('baiyue-firstleg-') && !jobBaseName.startsWith('baiyue-firstleg-dev-') && !jobBaseName.startsWith('baiyue-firstleg-prod-')) {
        return 'test'
    }
    return null
}

def environmentChoicesForServiceJob(String jobBaseName) {
    return [fixedEnvironmentForServiceJob(jobBaseName) ?: 'test']
}

pipeline {
    // 构建在任意 java-builder 节点执行，部署再回到目标环境节点。
    agent none

    options {
        skipDefaultCheckout(true)
        disableConcurrentBuilds()
        timestamps()
        buildDiscarder(logRotator(numToKeepStr: '30'))
    }

    parameters {
        string(name: 'SOURCE_COMMIT', defaultValue: '', description: '必须构建的 Git commit；通常由总控 Job 传入')
        string(name: 'IMAGE_TAG', defaultValue: '', description: '不可变镜像标签；通常使用 Git commit 前 12 位')
        choice(name: 'ENVIRONMENT', choices: environmentChoicesForServiceJob(env.JOB_BASE_NAME), description: '由当前单服务 Job 固定的部署环境')
        booleanParam(name: 'ALLOW_SAME_CONTRACT_ROLLBACK', defaultValue: false, description: '仅确认相同协议与Schema时允许回滚；架构切换保持关闭')
        booleanParam(name: 'DEPLOY', defaultValue: false, description: '构建成功后是否部署本服务')
        booleanParam(name: 'SKIP_TESTS', defaultValue: false, description: '是否跳过测试')
        // 独立构建沿用本 Job 配置，总控调度时保留其明确传入的地址。
        string(name: 'IMAGE_REPOSITORY', defaultValue: params.IMAGE_REPOSITORY ?: '', description: '沿用当前 Job 已配置的镜像仓库基础路径，不包含服务名和标签；首次配置或更换仓库时填写')
        string(name: 'DOCKER_BASE_IMAGE', defaultValue: 'eclipse-temurin:17-jre-alpine', description: 'Java 17 基础镜像')
    }

    environment {
        REGISTRY_CREDENTIALS = 'gitea-registry-token'
        MAVEN_SETTINGS = 'deploy/maven/settings-ci.xml'
    }

    stages {
        stage('构建并发布单服务') {
            agent { label 'java-builder' }
            tools { maven 'maven-3.8.8' }
            stages {
                stage('校验参数并检出指定提交') {
                    steps {
                        checkout scm

                        script {
                            String service = serviceModules.find { candidate ->
                                env.JOB_BASE_NAME?.endsWith("-${candidate}")
                            }
                            String sourceCommit = params.SOURCE_COMMIT?.trim()
                            String imageTag = params.IMAGE_TAG?.trim()
                            String imageRepository = params.IMAGE_REPOSITORY?.trim()
                            String resolvedEnvironment = fixedEnvironmentForServiceJob(env.JOB_BASE_NAME)

                            if (!sourceCommit) {
                                sourceCommit = sh(script: 'git rev-parse HEAD', returnStdout: true).trim()
                            }
                            if (!imageTag) {
                                imageTag = sh(script: 'git rev-parse --short=12 HEAD', returnStdout: true).trim()
                            }

                            if (!serviceModules.contains(service)) {
                                error("无法从 Job 名称 ${env.JOB_BASE_NAME} 识别服务；名称必须以以下服务之一结尾: ${serviceModules.join(', ')}")
                            }
                            if (!resolvedEnvironment) {
                                error("未配置单服务 Job ${env.JOB_BASE_NAME} 的固定部署环境，拒绝继续")
                            }
                            if (params.ENVIRONMENT != resolvedEnvironment) {
                                error('部署环境必须与当前单服务 Job 固定映射一致')
                            }
                            if (!sourceCommit || !(sourceCommit ==~ /(?i)[0-9a-f]{7,40}/)) {
                                error('SOURCE_COMMIT 必须是 7 到 40 位十六进制 Git commit')
                            }
                            if (!imageTag || !(imageTag ==~ /[A-Za-z0-9_][A-Za-z0-9_.-]{0,127}/)) {
                                error('IMAGE_TAG 不是合法的 Docker 镜像标签')
                            }
                            if (!imageRepository || imageRepository.contains('://')) {
                                error('IMAGE_REPOSITORY 不能为空且不能包含协议前缀')
                            }
                            if (imageRepository.tokenize('/')[0] ==~ /(?i)(?:[a-z0-9-]+\.)*example\.(?:com|net|org)(?::[0-9]+)?/) {
                                error('IMAGE_REPOSITORY 不能使用 example 示例域名，请填写已核实的镜像仓库地址')
                            }
                            if (!imageRepository.contains('/')) {
                                error('IMAGE_REPOSITORY 必须使用 host[:port]/owner/image 格式')
                            }

                            env.RESOLVED_SERVICE = service
                            env.RESOLVED_ENVIRONMENT = resolvedEnvironment
                            env.RESOLVED_SOURCE_COMMIT = sourceCommit
                            env.RESOLVED_IMAGE_TAG = imageTag
                            env.RESOLVED_IMAGE_REPOSITORY = imageRepository


                        }

                        sh '''
                            if ! git cat-file -e "${RESOLVED_SOURCE_COMMIT}^{commit}" 2>/dev/null; then
                              git fetch --no-tags origin
                            fi
                            git cat-file -e "${RESOLVED_SOURCE_COMMIT}^{commit}"
                            git checkout --detach "${RESOLVED_SOURCE_COMMIT}"
                            test "$(git rev-parse HEAD)" = "$(git rev-parse "${RESOLVED_SOURCE_COMMIT}^{commit}")"
                            if [ "$RESOLVED_ENVIRONMENT" = "production" ]; then
                              git fetch --no-tags origin +refs/heads/main:refs/remotes/origin/main
                              git merge-base --is-ancestor "$RESOLVED_SOURCE_COMMIT" origin/main || {
                                echo "灰度发布提交必须已经合并到 main" >&2
                                exit 1
                              }
                            fi
                        '''


                        script {
                            currentBuild.description = "${env.RESOLVED_SERVICE} | ${env.RESOLVED_IMAGE_TAG} | ${env.RESOLVED_ENVIRONMENT} | ${env.NODE_NAME}"
                            echo "独立构建服务: ${env.RESOLVED_SERVICE}，提交: ${env.RESOLVED_SOURCE_COMMIT}，节点: ${env.NODE_NAME}"
                        }
                    }
                }

                stage('Maven 测试与打包') {
                    steps {
                        script {
                            boolean coordinatorPinnedCommit = params.SOURCE_COMMIT?.trim() as boolean

                            boolean skipTestExecution = params.SKIP_TESTS
                            String testOption = skipTestExecution ? '-DskipTests' : ''
                            if (params.SKIP_TESTS && coordinatorPinnedCommit) {
                                echo "总控已处理提交 ${env.RESOLVED_SOURCE_COMMIT} 的测试门禁，本单服务仅编译测试源码并打包"
                            }
                            lock(resource: 'firstleg-test-maven') {
                                timeout(time: 50, unit: 'MINUTES') {
                                    sh "sh deploy/scripts/run-ci-maven.sh --settings ${env.MAVEN_SETTINGS} --batch-mode --errors -pl ${env.RESOLVED_SERVICE} -am clean package ${testOption}"
                                }
                            }
                        }
                    }
                    post {
                        always {
                            junit allowEmptyResults: true, testResults: '**/target/surefire-reports/TEST-*.xml'
                        }
                    }
                }

                stage('构建并发布单服务镜像') {
                    steps {
                        script {
                            String image = "${env.RESOLVED_IMAGE_REPOSITORY}/${env.RESOLVED_SERVICE}:${env.RESOLVED_IMAGE_TAG}"
                            String contextDir = ".docker-context/${env.RESOLVED_SERVICE}"
                            String jar = serviceJars[env.RESOLVED_SERVICE]
                            String registryHost = env.RESOLVED_IMAGE_REPOSITORY.tokenize('/')[0]
                            String dockerConfigDir = "${pwd(tmp: true)}/docker-auth"
                            sh "mkdir -p '${contextDir}' && cp -f '${jar}' '${contextDir}/app.jar'"

                            echo "推送共享镜像: ${image}"
                            withEnv(["DOCKER_CONFIG=${dockerConfigDir}"]) {
                                sh 'mkdir -p "$DOCKER_CONFIG"'
                                withCredentials([usernamePassword(credentialsId: env.REGISTRY_CREDENTIALS, usernameVariable: 'REGISTRY_USER', passwordVariable: 'REGISTRY_PASSWORD')]) {
                                    try {
                                        sh 'printf %s "$REGISTRY_PASSWORD" | docker login -u "$REGISTRY_USER" --password-stdin "' + registryHost + '"'
                                        sh "docker build -f deploy/docker/Dockerfile --build-arg BASE_IMAGE=${params.DOCKER_BASE_IMAGE} --build-arg JAR_FILE=app.jar -t ${image} '${contextDir}'"
                                        sh "docker push ${image}"
                                    } finally {
                                        sh "docker logout ${registryHost} || true"
                                        sh 'rm -rf "$DOCKER_CONFIG"'
                                    }
                                }
                            }
                            if (params.DEPLOY) {
                                stash name: 'deployment-files', includes: 'deploy/**', useDefaultExcludes: true
                            }
                        }
                    }
                }
            }
        }

        stage('部署 TEST') {
            when { expression { params.DEPLOY && env.RESOLVED_ENVIRONMENT == 'test' } }
            agent none
            steps {
                script {
                    lock(resource: "firstleg-test-${env.RESOLVED_SERVICE}-deploy", inversePrecedence: true) {
                      node('java-test') {
                        deleteDir()
                        unstash 'deployment-files'
                        withCredentials([
                            file(credentialsId: 'firstleg-test-env', variable: 'DEPLOY_ENV_FILE'),
                            usernamePassword(credentialsId: env.REGISTRY_CREDENTIALS, usernameVariable: 'REGISTRY_USER', passwordVariable: 'REGISTRY_PASSWORD')
                        ]) {
                            withEnv(['TARGET_IS_LOCAL=true', "ALLOW_SAME_CONTRACT_ROLLBACK=${params.ALLOW_SAME_CONTRACT_ROLLBACK}"]) {
                                sh 'sh deploy/scripts/deploy-built-service.sh test "$RESOLVED_IMAGE_REPOSITORY" "$RESOLVED_IMAGE_TAG" "$RESOLVED_SERVICE" "$DEPLOY_ENV_FILE"'
                            }
                        }
                      }
                    }
                }
            }
        }

        stage('部署临时灰度') {
            when { expression { params.DEPLOY && env.RESOLVED_ENVIRONMENT == 'production' } }
            agent none
            steps {
                script {
                    lock(resource: "firstleg-production-${env.RESOLVED_SERVICE}-deploy", inversePrecedence: true) {
                        node('java-builder') {
                            deleteDir()
                            unstash 'deployment-files'
                            withCredentials([
                                file(credentialsId: 'firstleg-production-env', variable: 'DEPLOY_ENV_FILE'),
                                usernamePassword(credentialsId: 'gitea-production-pull-token', usernameVariable: 'REGISTRY_USER', passwordVariable: 'REGISTRY_PASSWORD'),
                                sshUserPrivateKey(credentialsId: 'firstleg-production-ssh', keyFileVariable: 'TARGET_SSH_KEY', usernameVariable: 'TARGET_SSH_USER'),
                                string(credentialsId: 'firstleg-production-host', variable: 'TARGET_SSH_HOST'),
                                file(credentialsId: 'firstleg-production-known-hosts', variable: 'TARGET_SSH_KNOWN_HOSTS')
                            ]) {
                                withEnv(['TARGET_IS_LOCAL=false', 'TARGET_SSH_TARGET=' + env.TARGET_SSH_USER + '@' + env.TARGET_SSH_HOST,
                                    "ALLOW_SAME_CONTRACT_ROLLBACK=${params.ALLOW_SAME_CONTRACT_ROLLBACK}"]) {
                                    sh 'sh deploy/scripts/deploy-built-service.sh production "$RESOLVED_IMAGE_REPOSITORY" "$RESOLVED_IMAGE_TAG" "$RESOLVED_SERVICE" "$DEPLOY_ENV_FILE"'
                                }
                            }
                        }
                    }
                }
            }
        }

    }

    post {
        success {
            echo "${env.RESOLVED_SERVICE} 已独立完成构建${params.DEPLOY ? '和部署' : ''}"
        }
    }
}