name: acdl-modules-lifecycle

# ACDL Modules Lifecycle Pipeline — apply→modify→destroy against live AWS.
#
# Matrix-runs each L1 module's examples/{simple,complex}.yml contracts:
#   1. --apply simple.yml (terraform apply — creates resources)
#   2. --apply complex.yml (same state key — terraform modifies)
#   3. --destroy complex.yml (terraform destroy — cleans up)
#
# No per-module Python. The "test" = the pipeline cell going green.
# VPC-dependent L1s (alb, ecs-service, rds, uptime) reference the platform
# VPC applied by a prerequisite job. Non-VPC L1s run independent.
#
# Both Gitea (.gitea/workflows/modules-lifecycle.yml) and GitHub
# (.github/workflows/modules-lifecycle.yml) implement this contract
# byte-identically.

triggers:
  pull_request: [main]
  workflow_dispatch: []

runner: ubuntu-latest
python_version: "3.12"
terraform_version: "1.9.*"

stages:
  - name: platform-vpc-apply
    command: cd terraform/platform && terraform init -input=false && terraform apply -auto-approve -lock=false
    required: true
    description: "Apply the shared platform VPC (prerequisite for VPC-dependent L1s)"

  - name: lifecycle-apply
    command: bash scripts/run_platform.sh --apply "modules/l1/${MODULE}/examples/simple.yml"
    required: true
    description: "Apply the module's simple example contract (terraform apply)"

  - name: lifecycle-modify
    command: bash scripts/run_platform.sh --apply "modules/l1/${MODULE}/examples/complex.yml"
    required: true
    description: "Apply the module's complex example (same state key — terraform modifies)"

  - name: lifecycle-destroy
    command: bash scripts/run_platform.sh --destroy "modules/l1/${MODULE}/examples/complex.yml"
    required: true
    description: "Destroy the module's resources (terraform destroy)"

  - name: platform-vpc-destroy
    command: cd terraform/platform && terraform destroy -auto-approve -lock=false
    required: false
    description: "Destroy the shared platform VPC (cleanup — runs even if lifecycle steps fail)"

matrix:
  modules: [s3, kms-key, ecr, ecs-cluster, iam-role, cloudfront, waf, vpc, alb, ecs-service, rds, uptime]
  vpc_dependent: [alb, ecs-service, rds, uptime]
  independent: [s3, kms-key, ecr, ecs-cluster, iam-role, cloudfront, waf, vpc]