def APP_NAME = 'frontend-workstation'
def SLACK_NOTIFY_CHANNEL = '#osp-alerts'
def SLACK_E2E_NOTIFY_CHANNEL = '#playwright-test-e2e-results'

def DATADOG_APPLICATION_ID = '0e7314b7-2551-4fd0-a11f-f2b62be2752c'
def DATADOG_CLIENT_TOKEN = 'pub8a30359b2665253d22defaa70dcb8da0'
def INTERCOM_APP_ID = 'chdcbpv7'
def POEDITOR_PROJECT_ID = '222177'
def GRASS_SESSION_TOKEN_START_ENDPOINT = '/login/startsession'
def GRASS_SESSION_TOKEN_CLEAR_ENDPOINT = '/logout/clearsession'
def SENTRY_ORG = 'the-orchard'
def GRASS_TOKEN_DURATION_SECONDS = 1200

def QA_SENTRY_DSN = 'https://a45c5578f6854d72b3b354fd39a56690@o22178.ingest.us.sentry.io/5394756'
def QA_SENTRY_PROJECT = 'qa-frontend-workstation'
def QA_SEGMENT_WRITE_KEY = 'm3zYEQl9n3xh2knnsnv72BTUVjIdScAV'
def QA_SPLIT_IO_BROWSER_KEY = '762g9vh0be863221uq16vjbesad4q6bj28ol'
def QA_API_URL = 'https://qa-ows-grass.theorchard.io'
def QA_GRAPHQL_URL = 'https://qa-ows-grass.theorchard.io/graphql-gateway/graphql'
def QA_AUTH_TOKEN_INVALIDATION_URL = 'https://qa-ows-grass.theorchard.io/token/store/'
def QA_AUTH0_CLIENT_ID = 'UwAkQHgn1qszdr59k2A3kn8FuYITQ373'

def PROD_SENTRY_DSN = 'https://75c3b1fc167e45df8822fd2e669c987f@o22178.ingest.us.sentry.io/5394755'
def PROD_SENTRY_PROJECT = 'prod-frontend-workstation'
def PROD_SEGMENT_WRITE_KEY = '38SQn7092M3aZn4AQWYwksOwBhOa0V2J'
def PROD_SPLIT_IO_BROWSER_KEY = 'laenfvld1bqppup2538jtj1le8atkodkn002'
def PROD_API_URL = 'https://ows-grass.theorchard.io'
def PROD_GRAPHQL_URL = 'https://ows-grass.theorchard.io/graphql-gateway/graphql'
def PROD_AUTH_TOKEN_INVALIDATION_URL = 'https://ows-grass.theorchard.io/token/store/'
def PROD_AUTH0_CLIENT_ID = 'm9qgDGYhtlmA2q3JR17eqi9TnSsbjzsR'

pipeline {
    agent {
        label 'aws'
    }

    options {
        ansiColor('xterm')
        disableConcurrentBuilds()
        timestamps()
    }

    parameters {
        booleanParam(name: 'DEPLOY_TO_PROD', defaultValue: true, description: 'Whether or not to deploy to prod.')
        string(name: 'SHARED_LIBRARIES_VERSION', defaultValue: 'master', description: 'The version of the Jenkins shared libraries to use. Can be a branch, tag or Git revision.')
    }

    triggers {
        // "skip vulnerability scan" is a separate GitHub check, not controlled by this pipeline
        issueCommentTrigger('.*retest this please.*|.*skip vulnerability scan.*|.*deploy pri.*|.*run e2e tests.*')
    }

    environment {
        PRI_DOMAIN = "workstation-${env.CHANGE_ID}.pullrequests.qaorch.com"
    }

    stages {
        stage('Load Shared Libraries') {
            steps {
                library "jenkins-global-libraries@${params.SHARED_LIBRARIES_VERSION}"
            }
        }
        stage('Compliance Checks') {
            steps {
                complianceChecks()
            }
        }
        stage('Validate Software Catalog Definition') {
            steps {
                datadogSoftwareCatalogValidate()
            }
        }
        stage('Unit Tests and Style Checks') {
            when {
                not {
                    anyOf {
                        environment name: 'GITHUB_COMMENT', value: 'deploy pri'
                        environment name: 'GITHUB_COMMENT', value: 'run e2e tests'
                    }
                }
            }
            steps {
                withCredentials([
                    string(credentialsId: 'packagecloud_read_token', variable: 'PACKAGECLOUD_TOKEN'),
                ]) {
                    pnpmRun(
                        scriptNames: ['test'],
                        envVars: [
                            PACKAGECLOUD_TOKEN: "\${PACKAGECLOUD_TOKEN}"
                        ]
                    )
                }
            }
        }
        stage('Static Application Security Tests') {
            when {
                not {
                    anyOf {
                        environment name: 'GITHUB_COMMENT', value: 'deploy pri'
                        environment name: 'GITHUB_COMMENT', value: 'run e2e tests'
                    }
                }
            }
            steps {
                sastTests()
            }
        }
        stage('Deploy to PR Instance') {
            when {
                environment name: 'GITHUB_COMMENT', value: 'deploy pri'
            }
            steps {
                withCredentials([
                    string(credentialsId: 'packagecloud_read_token', variable: 'PACKAGECLOUD_TOKEN'),
                    string(credentialsId: 'poeditor-api-token', variable: 'POEDITOR_API_TOKEN')
                ]) {
                    script {
                        def priId = env.CHANGE_ID
                        def priDomain = "workstation-${priId}.pullrequests.qaorch.com"

                        // Manual nodeSh instead of suiteAppDeployPrInstance because
                        // this app is not yet a fully compatible suite app.
                        // Replicates the old Jenkins job deploy-pri shell config.
                        // See frontend-catalog/frontend-homepage for the same pattern.

                        // nodeSh has no defaults, so Auth0, CDN, Zendesk etc. that
                        // suiteAppBuild injects via DEFAULT_VARS_BY_ENV must be set here.
                        nodeSh(
                            envVars: [
                                PACKAGECLOUD_TOKEN: "\${PACKAGECLOUD_TOKEN}",
                                POEDITOR_API_TOKEN: "\${POEDITOR_API_TOKEN}",
                                ENV: 'qa',
                                PRI_ID: priId,
                                CDN_URL: 'https://qa-cdn.theorchard.io',
                                DEPLOY_TIMESTAMP: "prs/${priId}",
                                DATADOG_APPLICATION_ID: DATADOG_APPLICATION_ID,
                                DATADOG_CLIENT_TOKEN: DATADOG_CLIENT_TOKEN,
                                INTERCOM_APP_ID: INTERCOM_APP_ID,
                                POEDITOR_PROJECT_ID: POEDITOR_PROJECT_ID,
                                ZENDESK_KEY_ORCHARD: 'ab325f48-8a68-41ff-99e2-b50928a025b5',
                                ZENDESK_KEY_AWAL: '6312381f-4a7f-4ef3-bb5a-c825df8c46ef',
                                ZENDESK_TICKET_FORM_IDS_AWAL: '5633146238483',
                                ZENDESK_MESSAGING_KEY_AWAL: '24f594c3-063e-4be9-b730-abe737e14e19',
                                GRASS_SESSION_TOKEN_START_ENDPOINT: 'https://workstation.qaorch.com/login/startsession',
                                GRASS_SESSION_TOKEN_CLEAR_ENDPOINT: 'https://workstation.qaorch.com/logout/clearsession',
                                GRASS_TOKEN_DURATION_SECONDS: GRASS_TOKEN_DURATION_SECONDS,
                                SENTRY_ORG: SENTRY_ORG,
                                SENTRY_DSN: QA_SENTRY_DSN,
                                SENTRY_PROJECT: QA_SENTRY_PROJECT,
                                SEGMENT_WRITE_KEY: QA_SEGMENT_WRITE_KEY,
                                SPLIT_IO_BROWSER_KEY: QA_SPLIT_IO_BROWSER_KEY,
                                API_URL: 'https://grassproxy.pullrequests.qaorch.com',
                                AUTH_TOKEN_INVALIDATION_URL: 'https://grassproxy.pullrequests.qaorch.com/token/store/',
                                // Override graphql-router default until OSP-1327 is FF-ed ON
                                GRAPHQL_URL: 'https://grassproxy.pullrequests.qaorch.com/graphql-gateway/graphql',
                                AUTH0_DOMAIN: 'qalogin.theorchard.com',
                                AUTH0_CLIENT_ID: QA_AUTH0_CLIENT_ID,
                                AUTH0_AUDIENCE: 'https://workstation.qaorch.com/api',
                                AUTH0_REDIRECT: "https://pullrequests.qaorch.com/auth0Redirect?to=${priDomain}",
                                AUTH0_ORG_ID_ORCHARD: 'org_vdEfyCAGWYnTkX6G',
                                AUTH0_ORG_ID_AWAL: 'org_ZowffAYGJyqvOeIJ',
                            ],
                            script: """
                                set -ex
                                mkdir -p ~/bin
                                corepack enable --install-directory ~/bin pnpm
                                export PATH=~/bin:\$PATH
                                pnpm install --frozen-lockfile
                                pnpm run build:pri
                            """
                        )

                        suiteAppPublish(
                            env: 'qa',
                            appName: APP_NAME,
                            subpath: "prs/${priId}",
                            // Bundles use static filenames (disableFilenameHash),
                            // so they must not be long-cached on PR instances or
                            // redeploys to the same path get served stale.
                            noCacheExtraPatterns: '*.js,*.css'
                        )

                        githubPostPrComment(
                            repo: APP_NAME,
                            message: "PR-Instance deployed to: https://${priDomain}"
                        )
                    }
                }
            }
        }
        stage('Sonar Scan and Analysis') {
            when {
                branch 'master'
            }
            steps {
                script {
                    echo "Running Sonar scan for ${APP_NAME}"
                    sonarScan project: APP_NAME, language: 'js'
                }
            }
        }
        stage('Deploy to QA') {
            when {
                branch 'master'
            }
            steps {
                withCredentials([
                    string(credentialsId: 'packagecloud_read_token', variable: 'PACKAGECLOUD_TOKEN'),
                ]) {
                    suiteAppBuild (
                        detectPackageManager: true,
                        env: 'qa',
                        envVars: [
                            PACKAGECLOUD_TOKEN: "\${PACKAGECLOUD_TOKEN}",
                            DATADOG_APPLICATION_ID: DATADOG_APPLICATION_ID,
                            DATADOG_CLIENT_TOKEN: DATADOG_CLIENT_TOKEN,
                            DEPLOY_TIMESTAMP: env.GIT_COMMIT,
                            TIMESTAMP: env.GIT_COMMIT,
                            INTERCOM_APP_ID: INTERCOM_APP_ID,
                            POEDITOR_PROJECT_ID: POEDITOR_PROJECT_ID,
                            GRASS_SESSION_TOKEN_START_ENDPOINT: GRASS_SESSION_TOKEN_START_ENDPOINT,
                            GRASS_SESSION_TOKEN_CLEAR_ENDPOINT: GRASS_SESSION_TOKEN_CLEAR_ENDPOINT,
                            GRASS_TOKEN_DURATION_SECONDS: GRASS_TOKEN_DURATION_SECONDS,
                            SENTRY_ORG: SENTRY_ORG,
                            SENTRY_DSN: QA_SENTRY_DSN,
                            SENTRY_PROJECT: QA_SENTRY_PROJECT,
                            SEGMENT_WRITE_KEY: QA_SEGMENT_WRITE_KEY,
                            SPLIT_IO_BROWSER_KEY: QA_SPLIT_IO_BROWSER_KEY,
                            API_URL: QA_API_URL,
                            AUTH_TOKEN_INVALIDATION_URL: QA_AUTH_TOKEN_INVALIDATION_URL,
                            // Override graphql-router default until OSP-1327 is FF-ed ON
                            GRAPHQL_URL: QA_GRAPHQL_URL,
                            AUTH0_CLIENT_ID: QA_AUTH0_CLIENT_ID,
                        ]
                    )

                    suiteAppPublish (
                        env: "qa",
                        appName: APP_NAME,
                        noCacheExtraPatterns: 'main.dml.js,main.dml.js.map'
                    )

                    // Versioned copy for rollback support (used by frontend-fastrack-rollback).
                    // See python-deployment-utils PR #345.
                    withAWS(region: 'us-east-1', credentials: 'cdn-deploy') {
                        s3Upload(
                            bucket: 'qa-orcd-cdn',
                            path: "${APP_NAME}/${env.GIT_COMMIT}",
                            workingDir: 'build',
                            includePathPattern: '**/*',
                            cacheControl: 'public,max-age=31536000'
                        )
                    }
                }
            }
        }
        stage('Invalidate QA CDN') {
            when {
                branch 'master'
            }
            steps {
                cdnInvalidate env: 'qa', appName: APP_NAME
            }
        }
        stage('E2E QA Tests') {
            when {
                branch 'master'
            }
            steps {
                retry(2) {
                    playwrightTests tags: "@workstation", reportSuffix: "qa_v2"
                }
            }
            post {
                regression {
                    slackNotify channel: SLACK_NOTIFY_CHANNEL
                }
                fixed {
                    slackNotify channel: SLACK_NOTIFY_CHANNEL
                }
            }
        }
        stage('E2E Tests on PR Instance') {
            when {
                environment name: 'GITHUB_COMMENT', value: 'run e2e tests'
            }
            steps {
                playwrightTests(
                    tags: "@workstation",
                    envVars: [
                        BASE_URL_OVERRIDE_WORKSTATION: "https://workstation-${env.CHANGE_ID}.pullrequests.qaorch.com",
                        USE_DYNAMIC_THROTTLING: 'true'
                    ],
                    reportSuffix: "pri_v2",
                    githubPRRepo: APP_NAME
                )
            }
        }
        stage('Deploy to Prod') {
            when {
                allOf {
                    branch 'master'
                    expression { params.DEPLOY_TO_PROD }
                }
            }
            steps {
                withCredentials([
                    string(credentialsId: 'packagecloud_read_token', variable: 'PACKAGECLOUD_TOKEN'),
                ]) {
                    suiteAppBuild (
                        detectPackageManager: true,
                        env: 'prod',
                        envVars: [
                            PACKAGECLOUD_TOKEN: "\${PACKAGECLOUD_TOKEN}",
                            DATADOG_APPLICATION_ID: DATADOG_APPLICATION_ID,
                            DATADOG_CLIENT_TOKEN: DATADOG_CLIENT_TOKEN,
                            DEPLOY_TIMESTAMP: env.GIT_COMMIT,
                            INTERCOM_APP_ID: INTERCOM_APP_ID,
                            POEDITOR_PROJECT_ID: POEDITOR_PROJECT_ID,
                            GRASS_SESSION_TOKEN_START_ENDPOINT: GRASS_SESSION_TOKEN_START_ENDPOINT,
                            GRASS_SESSION_TOKEN_CLEAR_ENDPOINT: GRASS_SESSION_TOKEN_CLEAR_ENDPOINT,
                            GRASS_TOKEN_DURATION_SECONDS: GRASS_TOKEN_DURATION_SECONDS,
                            SENTRY_ORG: SENTRY_ORG,
                            SENTRY_DSN: PROD_SENTRY_DSN,
                            SENTRY_PROJECT: PROD_SENTRY_PROJECT,
                            SEGMENT_WRITE_KEY: PROD_SEGMENT_WRITE_KEY,
                            SPLIT_IO_BROWSER_KEY: PROD_SPLIT_IO_BROWSER_KEY,
                            API_URL: PROD_API_URL,
                            AUTH_TOKEN_INVALIDATION_URL: PROD_AUTH_TOKEN_INVALIDATION_URL,
                            // Override graphql-router default until OSP-1327 is FF-ed ON
                            GRAPHQL_URL: PROD_GRAPHQL_URL,
                            AUTH0_CLIENT_ID: PROD_AUTH0_CLIENT_ID,
                        ]
                    )

                    suiteAppPublish (
                        env: "prod",
                        appName: APP_NAME,
                        noCacheExtraPatterns: 'main.dml.js,main.dml.js.map'
                    )

                    // Versioned copy for rollback support (used by frontend-fastrack-rollback).
                    // See python-deployment-utils PR #345.
                    withAWS(region: 'us-east-1', credentials: 'cdn-deploy') {
                        s3Upload(
                            bucket: 'prod-orcd-cdn',
                            path: "${APP_NAME}/${env.GIT_COMMIT}",
                            workingDir: 'build',
                            includePathPattern: '**/*',
                            cacheControl: 'public,max-age=31536000'
                        )
                    }
                }
            }
        }
        stage('Invalidate Prod CDN') {
            when {
                allOf {
                    branch 'master'
                    expression { params.DEPLOY_TO_PROD }
                }
            }
            steps {
                cdnInvalidate env: 'prod', appName: APP_NAME
            }
        }
        stage('E2E Prod Tests') {
            when {
                allOf {
                    branch 'master'
                    expression { params.DEPLOY_TO_PROD }
                }
            }
            steps {
                retry(2) {
                    playwrightTests(configEnvironment: "prod", tags: "@workstation_prod")
                }
            }
            post {
                regression {
                    slackNotify channel: SLACK_E2E_NOTIFY_CHANNEL
                }
                fixed {
                    slackNotify channel: SLACK_E2E_NOTIFY_CHANNEL
                }
            }
        }
        stage('Publish Software Catalog') {
            when {
                allOf {
                    branch 'master'
                }
            }
            steps {
                datadogSoftwareCatalogPublish()
            }
        }
    }
    post {
        fixed {
            script {
                if (env.BRANCH_NAME == 'master') {
                    slackNotify channel: SLACK_NOTIFY_CHANNEL
                }
            }
        }
        failure {
            script {
                if (env.BRANCH_NAME == 'master') {
                    slackNotify channel: SLACK_NOTIFY_CHANNEL
                }
            }
        }
        always {
            cleanWs()
        }
    }
}