String GITHUB_REPOSITORY = 'php-pdp-sdk'
String SLACK_NOTIFICATIONS_CHANNEL = '#security-team'

pipeline {
    agent any

    options {
        ansiColor('xterm')
        disableConcurrentBuilds()
        timestamps()
    }

    parameters {
        string(
            name: 'SHARED_LIBRARIES_VERSION',
            defaultValue: 'master',
            description: 'The version of the Jenkins shared libraries to use. Can be a branch, tag or Git revision.'
        )
    }

    triggers {
        issueCommentTrigger('.*retest this please.*')
    }

    stages {
        stage('Load Shared Libraries') {
            steps {
                library "jenkins-global-libraries@${params.SHARED_LIBRARIES_VERSION}"
            }
        }
        stage('Compliance Checks') {
            steps {
                complianceChecks()
            }
        }
        stage('Unit tests and Style Checks') {
            steps {
                withCredentials([string(credentialsId: 'composer-github-auth', variable: 'GITHUB_AUTH')]) {
                    withEcr {
                        sh """
                            mkdir -p build/logs
                            chmod a+w build/logs
                            docker compose run --build --rm unit-lint
                        """
                    }
                }
            }
            post {
                always {
                    sh 'docker compose down unit-lint --remove-orphans'
                    xunit(
                        tools: [
                            PHPUnit(
                                pattern: 'build/logs/phpunit.xml',
                                deleteOutputFiles: true,
                                failIfNotNew: true,
                                stopProcessingIfError: true
                            )
                        ]
                    )
                    clover(
                        cloverReportDir: 'build/logs',
                        cloverReportFileName: 'phpunit.coverage.xml',
                        healthyTarget: [methodCoverage: 70, conditionalCoverage: 80, statementCoverage: 80],
                        unhealthyTarget: [methodCoverage: 0, conditionalCoverage: 0, statementCoverage: 0],
                        failingTarget: [methodCoverage: 0, conditionalCoverage: 0, statementCoverage: 0]
                    )
                }
                cleanup {
                    sh 'rm -rf build/logs'
                }
            }
        }
        stage('Static Application Security Tests') {
            steps {
                sastTests()
            }
        }
         stage('Sonar Scan and Analysis') {
            when {
                branch 'master'
            }
            steps {
                sonarScan project: GITHUB_REPOSITORY, language: 'php'
            }
        }
    }

    post {
        regression {
            script {
                if (env.BRANCH_NAME == 'master') {
                    slackNotify channel: SLACK_NOTIFICATIONS_CHANNEL
                }
            }
        }
        fixed {
            script {
                if (env.BRANCH_NAME == 'master') {
                    slackNotify channel: SLACK_NOTIFICATIONS_CHANNEL
                }
            }
        }
        cleanup {
            cleanWs()
        }
    }
}