def utils

pipeline {
    agent {
        label 'can_reach_orchard_aws_dev'
    }

    options {
        ansiColor('xterm')
        timestamps()
    }

    parameters {
        string(
            name: 'GIT_COMMIT',
            defaultValue: 'master',
            description: 'Commit version to checkout and build bundle to.')
        choice(
            name: 'CODE_PUSH_PROJECT',
            choices: ['OrchardGoAndroid', 'OrchardGoIOS'],
            description: 'Project')
        choice(
            name: 'CODE_PUSH_ENV',
            choices: ['Production', 'QA'],
            description: 'Env')
        string(
            name: 'CODE_PUSH_TARGET_RELEASE',
            defaultValue: 'v???',
            description: 'Target release')
        choice(
            name: 'CODE_PUSH_BUNDLE_ENABLE',
            choices: ['false', 'true'],
            description: 'Enable bundle')
    }

    environment {
        // override PATH to include /usr/local/bin
        PATH = "${sh (script: 'echo "/usr/local/bin:${PATH}"', returnStdout: true)}"
    }

    stages {
        stage('Initialize') {
            environment {
                AWS_ACCOUNT_ID = '437795906767'
                AWS_ROLE_NAME = 'jenkins-mac-mini-agent'
            }
            steps {
                script {
                    checkout([
                        $class: 'GitSCM',
                        branches: [[name: params.GIT_COMMIT]],
                        doGenerateSubmoduleConfigurations: false,
                        extensions: [],
                        submoduleCfg: [],
                        userRemoteConfigs: [[
                            credentialsId: '577cbc72-7d9e-4eba-924c-ecbbe6de9805',
                            url: 'git@github.com:theorchard/orchardgo.git'
                        ]]
                    ])
                    shared = load './jenkins/shared.groovy'
                    shared.initGitSha(params.GIT_COMMIT)

                    // Load Utils from the shared library
                    utils = library(shared.library()).com.sonymusic.Utils.new(this)

                    // Use the AWS credentials to assume the role
                    withCredentials([[
                        $class: 'AmazonWebServicesCredentialsBinding',
                        credentialsId: 'jenkins-mac-mini-agent',
                        accessKeyVariable: 'AWS_ACCESS_KEY_ID',
                        secretKeyVariable: 'AWS_SECRET_ACCESS_KEY'
                    ]]) {
                        // Assume the role
                        def assumeRoleCommand = """
                            aws sts assume-role \
                            --role-arn arn:aws:iam::${AWS_ACCOUNT_ID}:role/${AWS_ROLE_NAME} \
                            --role-session-name ${NODE_NAME}
                        """
                        def assumeRoleResult = sh(script: assumeRoleCommand, returnStdout: true)
                        def credentials = readJSON text: assumeRoleResult

                        // Export temporary credentials
                        env.AWS_ACCESS_KEY_ID = credentials.Credentials.AccessKeyId
                        env.AWS_SECRET_ACCESS_KEY = credentials.Credentials.SecretAccessKey
                        env.AWS_SESSION_TOKEN = credentials.Credentials.SessionToken
                        env.AWS_DEFAULT_REGION = 'us-east-1'
                    }
                }
            }
        }
        stage('Prepare Environment') {
            steps {
                script {
                    def secretNames = [
                        'PACKAGECLOUD_TOKEN',
                        'GITHUB_TOKEN',
                        'CODE_PUSH_STANDALONE_ACCESS_KEY'
                    ]
                    secretNames.each { secretName ->
                        def secretValue = utils.getSecretValue("prod/orchardgo/${secretName}")
                        env."${secretName}" = secretValue
                    }
                }
            }
        }
        stage('History') {
            environment {
                // clean up AWS credentials previously set by assume-role
                AWS_ACCESS_KEY_ID = ''
                AWS_SECRET_ACCESS_KEY = ''
                AWS_SESSION_TOKEN = ''

                // Set environment variables from the parameters
                CODE_PUSH_PROJECT = "${params.CODE_PUSH_PROJECT}"
                CODE_PUSH_ENV = "${params.CODE_PUSH_ENV}"
                CODE_PUSH_TARGET_RELEASE = "${params.CODE_PUSH_TARGET_RELEASE}"
                CODE_PUSH_BUNDLE_ENABLE = "${params.CODE_PUSH_BUNDLE_ENABLE}"
            }
            steps {
                withCredentials([
                    aws(accessKeyVariable: 'AWS_ACCESS_KEY',
                        secretKeyVariable: 'AWS_SECRET_ACCESS_KEY',
                        credentialsId: 'prod-orcd-mobile-user'),
                ]) {
                    echo "Enabled bundle for ${CODE_PUSH_PROJECT} ${CODE_PUSH_ENV} ${CODE_PUSH_TARGET_RELEASE} ${CODE_PUSH_BUNDLE_ENABLE}"
                    sh label: 'Enable bundle', script: '''#!/bin/bash -l
# Authenticate
if [ -f ~/.docker/config.json ]; then
  rm -rf ~/.docker/config.json
fi

# Docker login needed for access to pull the docker image
aws ecr get-login-password --region us-east-1 | docker login --username AWS --password-stdin 086679231553.dkr.ecr.us-east-1.amazonaws.com

# Run
make mobile-codepush-bundle-enable

# Clean up
make docker_down
'''
                }
            }
        }
    }
    post {
        always {
            cleanWs(notFailBuild: true)
        }
    }
}