pipeline {
  agent any

  options {
    timestamps()
    disableConcurrentBuilds()
    timeout(time: 45, unit: 'MINUTES')
  }

  environment {
    APP_NAME = 'agent-foundation'
    IMAGE_NAME = 'agent-foundation'
    IMAGE_TAG = "${env.BUILD_NUMBER}"
    CONTAINER_NAME = 'agent-foundation'
    APP_PORT = '8880'
    CONTAINER_PORT = '8880'
    MAVEN_IMAGE = 'maven:3.9.16-eclipse-temurin-17-alpine'
    RUNTIME_IMAGE = 'eclipse-temurin:17-jre-alpine'
    DOCKER_BUILDKIT = '1'
  }

  stages {
    stage('Checkout') {
      steps {
        checkout scm
      }
    }

    stage('Pull Base Images') {
      steps {
        script {
          [env.MAVEN_IMAGE, env.RUNTIME_IMAGE].each { image ->
            retry(3) {
              timeout(time: 10, unit: 'MINUTES') {
                sh "docker pull ${image}"
              }
            }
          }
        }
      }
    }

    stage('Build Image') {
      steps {
        script {
          timeout(time: 20, unit: 'MINUTES') {
            sh """
              docker build --progress=plain \
                --build-arg MAVEN_IMAGE=${MAVEN_IMAGE} \
                --build-arg RUNTIME_IMAGE=${RUNTIME_IMAGE} \
                -t ${IMAGE_NAME}:${IMAGE_TAG} \
                -t ${IMAGE_NAME}:latest .
            """
          }
        }
      }
    }

    stage('Push Image') {
      when {
        expression { return env.IMAGE_NAME?.contains('/') }
      }
      steps {
        withCredentials([usernamePassword(credentialsId: 'docker-registry-cred', usernameVariable: 'DOCKER_USER', passwordVariable: 'DOCKER_PASS')]) {
          sh 'echo "$DOCKER_PASS" | docker login -u "$DOCKER_USER" --password-stdin'
          sh "docker push ${IMAGE_NAME}:${IMAGE_TAG}"
          sh "docker push ${IMAGE_NAME}:latest"
        }
      }
    }

    stage('Deploy') {
      steps {
        withCredentials([
          string(credentialsId: 'deepseek-api-key', variable: 'DEEPSEEK_API_KEY'),
          string(credentialsId: 'wecom-corp-id', variable: 'WECOM_CORP_ID'),
          string(credentialsId: 'wecom-agent-id', variable: 'WECOM_AGENT_ID'),
          string(credentialsId: 'wecom-secret', variable: 'WECOM_SECRET'),
          string(credentialsId: 'wecom-token', variable: 'WECOM_TOKEN')
        ]) {
          sh "docker rm -f ${CONTAINER_NAME} || true"
          sh '''
            docker run -d \
              --name ${CONTAINER_NAME} \
              --restart unless-stopped \
              -p ${APP_PORT}:${CONTAINER_PORT} \
              -e DEEPSEEK_API_KEY=${DEEPSEEK_API_KEY} \
              -e WECOM_CORP_ID=${WECOM_CORP_ID} \
              -e WECOM_AGENT_ID=${WECOM_AGENT_ID} \
              -e WECOM_SECRET=${WECOM_SECRET} \
              -e WECOM_TOKEN=${WECOM_TOKEN} \
              ${IMAGE_NAME}:${IMAGE_TAG}
          '''
        }
      }
    }

    stage('Verify') {
      steps {
        timeout(time: 3, unit: 'MINUTES') {
          sh '''
            for attempt in $(seq 1 30); do
              if docker exec ${CONTAINER_NAME} wget -qO- http://127.0.0.1:${CONTAINER_PORT}/actuator/health | grep -q '"status":"UP"'; then
                echo "Health check passed"
                exit 0
              fi
              sleep 5
            done
            docker logs --tail 200 ${CONTAINER_NAME}
            exit 1
          '''
        }
      }
    }
  }

  post {
    success {
      echo "Deploy success: ${IMAGE_NAME}:${IMAGE_TAG}"
    }
    failure {
      echo 'Pipeline failed'
    }
  }
}