# ACDL Central Deployment Pipeline Contract (v1.5)
#
# This is the single source of truth for the deployment pipeline. It
# declares the stages that run when a consumer submits a contract:
#   validate-contract -> resolve-stack -> terraform-plan -> checkov ->
#   confidence -> apply (dev only)
#
# Consumers reference this pipeline via `uses: acdl/pipelines/deploy.yaml@v1`
# in their contract YAML. The platform (scripts/run_platform.sh) implements
# these stages.
#
# Validated against schemas/deploy-pipeline.schema.json.

name: acdl-deploy
environment: dev
triggers:
  push: [main]
  pull_request: [main]
runner: ubuntu-latest
python_version: "3.12"

stages:
  - name: validate-contract
    description: Validate the consumer contract against the contract schema
    command: python3 -c "import jsonschema, yaml; jsonschema.validate(yaml.safe_load(open('contracts/static-assets.yaml')), json.load(open('schemas/contract.schema.json')))"
    required: true

  - name: resolve-stack
    description: Resolve the contract to a Target Stack instance via the contract resolver
    command: python3 core/contract_resolver.py contracts/static-assets.yaml /tmp/acdl-stack.json
    required: true

  - name: terraform-plan
    description: Compile the stack to Terraform and run terraform plan
    command: bash scripts/run_platform.sh --plan-only contracts/static-assets.yaml
    required: true

  - name: checkov
    description: Run Checkov policy checks on the emitted Terraform
    command: checkov -f terraform/spike/main.tf --framework terraform -o json --soft-fail
    required: false

  - name: confidence
    description: Compute the confidence signal from policy + validation inputs
    command: python3 core/confidence_signal.py /tmp/acdl-deploy-inputs.json dev
    required: true

  - name: apply
    description: Apply the Terraform plan (dev environment only, autonomous per §10)
    command: terraform -chdir=terraform/spike apply -auto-approve -lock=false
    required: false

  - name: publish-outputs
    description: Publish deploy outputs to SSM Parameter Store (SecureString) + GitHub PR comment
    command: python3 -c "from core.output_publisher import publish_to_ssm, format_comment, post_github_comment; import json,subprocess; tf=json.loads(subprocess.check_output(['terraform','-chdir=terraform/spike','output','-json']) or '{}'); outputs={k:v.get('value') if isinstance(v,dict) else v for k,v in tf.items()}; ssm=publish_to_ssm(outputs,'dev','spike'); comment=format_comment(outputs,'dev','spike',ssm); post_github_comment(comment)"
    required: false

  - name: comment-outputs
    description: Post a structured GitHub PR comment with human-readable deploy outputs
    command: bash scripts/post_stage_comment.sh publish-outputs pass
    required: false