#!/usr/bin/env bash
# scripts/run_decommission.sh — decommission mode (extracted from run_platform.sh, P9/REQ-173).
# Sourced by run_platform.sh (G-112: source, not invoke — shares CONTRACT/WORK/ROOT env).
# Exits 0 on completion; caller exits after sourcing.

echo ""
echo "=== Decommission Step 1: validate change request against CMDB ==="
[ -n "$CHANGE_REQUEST_ID" ] || fail "change request ID required for decommission mode"
CONSUMER_REPO="${GITHUB_REPOSITORY:-$(python3 -c "import yaml; c=yaml.safe_load(open('$CONTRACT')); print(c.get('id','unknown'))" 2>/dev/null || echo 'unknown')}"
python3 -c "
import json, sys
sys.path.insert(0, '$ROOT')
# In a real deployment, this invokes the Lambda. For local/CI, we simulate.
cr_id = '$CHANGE_REQUEST_ID'
repo = '$CONSUMER_REPO'
print(f'validate_change_request: crId={cr_id} repo={repo}')
# The Lambda action would be:
# payload = {'action': 'validate_change_request', 'changeRequestId': cr_id, 'consumerRepo': repo}
# result = invoke_lambda(payload)
# For now, just print the intent (the actual validation happens via the Lambda in CI/prod)
print('change request validation: PASS (simulated for local mode)')
"
echo ""
echo "=== Decommission Step 2: disable deletion protection (HITL SRE gate) ==="
echo "This step requires SRE approval via GitHub environment 'decommission-gate-sre'."
echo "The contract is resolved with deletion_protection=false injected."
python3 core/contract_resolver.py "$CONTRACT" "$WORK/stack.json" 2>/dev/null || fail "resolver failed"
python3 -c "
import json, sys
sys.path.insert(0, '$ROOT')
from core.contract_resolver import resolve, decommission_transform
stack = resolve('$CONTRACT', '$ROOT')
# Step 2: disable deletion protection only (counts still as-is)
for res in stack['resources']:
    if 'nfrs' not in res:
        res['nfrs'] = {}
    res['nfrs']['deletion_protection'] = False
with open('$WORK/stack-decommission-step1.json', 'w') as f:
    json.dump(stack, f, indent=2)
print(f'decommission step 1: {len(stack[\"resources\"])} resources with deletion_protection=false')
"
echo ""
echo "=== Decommission Step 3: zero counts (HITL SRE gate) ==="
echo "This step requires a second SRE approval via GitHub environment 'decommission-destroy-sre'."
python3 -c "
import json, sys
sys.path.insert(0, '$ROOT')
from core.contract_resolver import resolve, decommission_transform
stack = resolve('$CONTRACT', '$ROOT')
stack = decommission_transform(stack)
with open('$WORK/stack-decommission-step2.json', 'w') as f:
    json.dump(stack, f, indent=2)
zeroed = sum(1 for r in stack['resources'] if r.get('nfrs',{}).get('deletion_protection') is False)
print(f'decommission step 2: {zeroed} resources with deletion_protection=false + counts=0')
"
echo ""
echo "=== Decommission Step 4: confirm ==="
echo "The terraform apply for step 2 + step 3 would now destroy all resources."
echo "=== DECOMMISSION READY ==="
exit 0