ENVIRONMENTS = [
    dev: [accountId: '103233932089', role: 'dev-terraform-state-file-fixer-role', sshKeySecret: 'dev/terraform-state-file-fixer/GITHUB_SSH_KEY'],
    qa: [accountId: '437795906767', role: 'prod-terraform-state-file-fixer-role', sshKeySecret: 'prod/terraform-state-file-fixer/GITHUB_SSH_KEY'],
    prod: [accountId: '437795906767', role: 'prod-terraform-state-file-fixer-role', sshKeySecret: 'prod/terraform-state-file-fixer/GITHUB_SSH_KEY']
]

pipeline {
    agent any

    options {
        ansiColor('xterm')
        disableConcurrentBuilds()
        timestamps()
    }

    parameters {
        choice(name: 'ENVIRONMENT', choices: ['dev', 'qa', 'prod'], description: 'The environment to fix terraform state for')
        string(name: 'PROJECT', description: 'The path to the Terraform project in terraform-infra, without the environment prefix')
        string(name: 'PR_NUMBER', description: 'The PR to check out')
    }

    stages {
        stage('Load Shared Libraries') {
            steps {
                library "jenkins-global-libraries@master"
            }
        }
        stage('Fix Terraform State') {
            environment {
                ACCOUNT_ID = "${ENVIRONMENTS[params.ENVIRONMENT].accountId}"
                ROLE = "${ENVIRONMENTS[params.ENVIRONMENT].role}"
                SSH_KEY_SECRET = "${ENVIRONMENTS[params.ENVIRONMENT].sshKeySecret}"
            }
            steps {
                dir('terraform') {
                    checkout([
                        $class: 'GitSCM',
                        branches: [[name: "pull/${params.PR_NUMBER}/merge"]],
                        userRemoteConfigs: [
                            [
                                credentialsId: '577cbc72-7d9e-4eba-924c-ecbbe6de9805',
                                url: "git@github.com:theorchard/terraform-infra.git",
                                refspec: '+refs/pull/*/merge:refs/remotes/origin/pull/*/merge'
                            ]
                        ]]
                    )
                    // Ensure Docker container has permissions to run terraform commands
                    sh "chmod -R a=rwx '${params.ENVIRONMENT}/${params.PROJECT}'"
                }
                dir('state-file-fixer') {
                    withEcr {
                        withAWS(roleAccount: env.ACCOUNT_ID, role: env.ROLE, roleSessionName: env.BUILD_TAG, useNode: true) {
                            withSecrets(secrets: [
                                [id: env.SSH_KEY_SECRET, environmentVariable: 'GITHUB_SSH_KEY'],
                            ]) {
                                withEnv(["TERRAFORM_PROJECT=../terraform/${params.ENVIRONMENT}/${params.PROJECT}"]) {
                                    sh 'docker compose run --rm --build hoist-providers'
                                }
                            }
                        }
                    }
                }
            }
        }
    }

    post {
        cleanup {
            cleanWs()
        }
    }
}