name: acdl-modules-lifecycle

# Nova Modules Lifecycle Pipeline — apply→modify→destroy against live AWS.
#
# Matrix-runs each L1 module's examples/{simple,complex}.yml contracts:
#   1. --apply simple.yml (terraform apply — creates resources)
#   2. --apply complex.yml (same state key — terraform modifies)
#   3. --destroy complex.yml (terraform destroy — cleans up)
#
# No per-module Python. The "test" = the pipeline cell going green.
# VPC-dependent L1s (alb, ecs-service, rds, uptime) reference the platform
# VPC applied by a prerequisite job. Non-VPC L1s run independent.
#
# Lifecycle mode (REQ-134, v1.12): `default_mode: plan` — the lifecycle
# scripts run `run_platform.sh --plan-only` (fast, no AWS mutation, no
# AWS credentials, no cost) on every PR. Set the NOVA_LIFECYCLE_MODE CI
# variable (workflow_dispatch input `lifecycle_mode`) to `full` for the
# real apply→modify→destroy against live AWS. The CI VPC apply/destroy
# jobs are skipped in plan mode (nothing is applied).
#
# GitHub
# (.github/workflows/modules-lifecycle.yml) implements this contract
# byte-identically.

triggers:
  pull_request: [main]
  workflow_dispatch:
    inputs:
      - name: lifecycle_mode
        description: "Lifecycle mode: 'plan' (default, fast) or 'full' (real apply→destroy)"
        default: plan

runner: ubuntu-latest
python_version: "3.12"
terraform_version: "1.9.*"

# Default lifecycle mode: "plan" (plan-only, fast, no AWS mutation) or "full"
# (real apply→modify→destroy against live AWS). Overridable via the
# NOVA_LIFECYCLE_MODE CI variable / workflow_dispatch input.
default_mode: plan

stages:
  - name: platform-vpc-apply
    command: cd terraform/platform && terraform init -input=false && terraform apply -auto-approve -lock=false
    required: true
    description: "Apply the shared platform VPC (prerequisite for VPC-dependent L1s)"

  - name: lifecycle-apply
    command: bash scripts/run_platform.sh --apply "modules/l1/${MODULE}/examples/simple.yml"
    required: true
    description: "Apply the module's simple example contract (terraform apply)"

  - name: lifecycle-modify
    command: bash scripts/run_platform.sh --apply "modules/l1/${MODULE}/examples/complex.yml"
    required: true
    description: "Apply the module's complex example (same state key — terraform modifies)"

  - name: lifecycle-destroy
    command: bash scripts/run_platform.sh --destroy "modules/l1/${MODULE}/examples/complex.yml"
    required: true
    description: "Destroy the module's resources (terraform destroy)"

  - name: platform-vpc-destroy
    command: cd terraform/platform && terraform destroy -auto-approve -lock=false
    required: false
    description: "Destroy the shared platform VPC (cleanup — runs even if lifecycle steps fail)"

  # L2 lifecycle stages (composition modules)
  - name: l2-lifecycle-apply
    command: bash scripts/run_platform.sh --apply "modules/l2/${L2_MODULE}/examples/simple.yml"
    required: true
    description: "Apply the L2 module's simple example contract (terraform apply)"

  - name: l2-lifecycle-modify
    command: bash scripts/run_platform.sh --apply "modules/l2/${L2_MODULE}/examples/complex.yml"
    required: true
    description: "Apply the L2 module's complex example (same state key — terraform modifies)"

  - name: l2-lifecycle-destroy
    command: bash scripts/run_platform.sh --destroy "modules/l2/${L2_MODULE}/examples/complex.yml"
    required: true
    description: "Destroy the L2 module's resources (terraform destroy)"

matrix:
  modules: [s3, kms-key, ecr, ecs-cluster, iam-role, cloudfront, waf, vpc, alb, ecs-service, rds, uptime]
  vpc_dependent: [alb, ecs-service, rds, uptime]
  independent: [s3, kms-key, ecr, ecs-cluster, iam-role, cloudfront, waf, vpc]
  l2_modules: [static-assets, microservice]