pipeline {
  agent {
    label 'linux && genarrative-rust-api'
  }

  options {
    disableConcurrentBuilds()
    skipDefaultCheckout(true)
    buildDiscarder(logRotator(numToKeepStr: '20', artifactNumToKeepStr: '20'))
  }

  environment {
    GIT_REMOTE_URL = 'ssh://git@127.0.0.1:2222/GenarrativeAI/Genarrative.git'
    GIT_REMOTE_CREDENTIAL_ID = 'genarrative-local-gitea-ssh'
    GIT_REMOTE_FALLBACK_URL = ''
    GIT_REMOTE_FALLBACK_CREDENTIAL_ID = ''
    GENARRATIVE_API_CACHE_ROOT = 'caches/genarrative-jenkins/api-server'
    CARGO_INCREMENTAL = '0'
    RUSTC_WRAPPER = 'sccache'
    SCCACHE_CACHE_SIZE = '30G'
  }

  parameters {
    string(name: 'SOURCE_BRANCH', defaultValue: 'master', description: '源码分支，默认 master 最新提交')
    string(name: 'COMMIT_HASH', defaultValue: '', description: '可选，指定属于 SOURCE_BRANCH 的 Git commit')
    string(name: 'BUILD_VERSION', defaultValue: '', description: '发布版本号，留空则使用 Jenkins BUILD_NUMBER')
    string(name: 'NOTIFICATION_EMAILS', defaultValue: '', description: '本次运行追加通知邮箱；会与 Jenkins Secret Text 凭据 genarrative-notification-emails 合并发送')
    booleanParam(name: 'INCLUDE_PINGORA_GATEWAY', defaultValue: true, description: '是否构建并归档 Pingora 影子网关二进制；release 发布默认必须包含')
    booleanParam(name: 'PUBLISH_AFTER_BUILD', defaultValue: false, description: '构建成功后是否触发 API 发布')
    string(name: 'DEPLOY_JOB_NAME', defaultValue: 'Genarrative-Api-Deploy', description: 'API 发布流水线作业名')
    choice(name: 'DEPLOY_TARGET', choices: ['development', 'release'], description: 'PUBLISH_AFTER_BUILD=true 时的逻辑部署目标；development 使用当前 Linux 开发/构建/开发部署 agent')
    booleanParam(name: 'CONFIRM_RELEASE_DEPLOY_AGENT', defaultValue: false, description: 'PUBLISH_AFTER_BUILD=true 且目标为 release 时必须确认已有独立 release 部署 agent')
  }

  stages {
    stage('Checkout') {
      steps {
        script {
          def checkoutFromRemote = { String remoteUrl, String credentialsId ->
            def remoteConfig = [url: remoteUrl, refspec: "+refs/heads/${params.SOURCE_BRANCH}:refs/remotes/origin/${params.SOURCE_BRANCH}"]
            def checkoutCredentialId = credentialsId?.trim()
            if (checkoutCredentialId) {
              remoteConfig.credentialsId = checkoutCredentialId
            }
            checkout([
              $class: 'GitSCM',
              branches: [[name: "*/${params.SOURCE_BRANCH}"]],
              doGenerateSubmoduleConfigurations: false,
              extensions: [
                [$class: 'CleanBeforeCheckout'],
                [$class: 'CloneOption', shallow: true, depth: 1, noTags: true, timeout: 30, honorRefspec: true],
              ],
              userRemoteConfigs: [remoteConfig],
            ])
          }
          try {
            checkoutFromRemote(env.GIT_REMOTE_URL, env.GIT_REMOTE_CREDENTIAL_ID)
            env.EFFECTIVE_GIT_REMOTE_URL = env.GIT_REMOTE_URL
          } catch (error) {
            def fallbackRemoteUrl = env.GIT_REMOTE_FALLBACK_URL?.trim()
            if (!fallbackRemoteUrl) {
              throw error
            }
            echo "Git 主地址拉取失败: ${env.GIT_REMOTE_URL}，改用备用地址: ${fallbackRemoteUrl}"
            checkoutFromRemote(fallbackRemoteUrl, env.GIT_REMOTE_FALLBACK_CREDENTIAL_ID)
            env.EFFECTIVE_GIT_REMOTE_URL = fallbackRemoteUrl
          }
        }
        withCredentials([sshUserPrivateKey(credentialsId: env.GIT_REMOTE_CREDENTIAL_ID, keyFileVariable: 'GENARRATIVE_GIT_SSH_KEY')]) {
          sh '''
            bash -lc '
              set -euo pipefail
              chmod +x scripts/jenkins-checkout-source.sh
              SOURCE_BRANCH="${SOURCE_BRANCH:-master}" \
              COMMIT_HASH="${COMMIT_HASH:-}" \
              GIT_REMOTE_URL="${EFFECTIVE_GIT_REMOTE_URL:-${GIT_REMOTE_URL}}" \
              GIT_REMOTE_FALLBACK_URL="" \
              SOURCE_COMMIT_FILE=".jenkins-source-commit" \
              GENARRATIVE_JENKINS_REUSE_EXISTING_CHECKOUT="true" \
              GIT_SSH_COMMAND="ssh -i ${GENARRATIVE_GIT_SSH_KEY:?GENARRATIVE_GIT_SSH_KEY 不能为空} -o IdentitiesOnly=yes -o StrictHostKeyChecking=accept-new" \
              scripts/jenkins-checkout-source.sh
            '
          '''
        }
        script {
          env.SOURCE_COMMIT = readFile('.jenkins-source-commit').trim()
          env.EFFECTIVE_BUILD_VERSION = params.BUILD_VERSION?.trim() ? params.BUILD_VERSION.trim() : env.BUILD_NUMBER
        }
      }
    }

    stage('Build Api') {
      steps {
        sh '''
          bash -lc '
            set -euo pipefail
            api_cache_root="${GENARRATIVE_API_CACHE_ROOT:-caches/genarrative-jenkins/api-server}"
            if [[ "${api_cache_root}" != /* ]]; then
              api_cache_root="${HOME:?HOME 不能为空}/${api_cache_root}"
            fi
            export CARGO_HOME="${api_cache_root}/cargo-home"
            export CARGO_TARGET_DIR="${api_cache_root}/cargo-target/prod-release"
            export SCCACHE_DIR="${api_cache_root}/sccache"
            chmod +x scripts/jenkins-prepare-cargo-env.sh
            source scripts/jenkins-prepare-cargo-env.sh
            if ! command -v clang >/dev/null 2>&1 || ! command -v lld >/dev/null 2>&1; then
              echo "[api-build] 缺少 clang/lld。请在 genarrative-build 节点预先安装 Linux 构建依赖。" >&2
              exit 1
            fi
            if [[ "${INCLUDE_PINGORA_GATEWAY:-false}" == "true" ]]; then
              if ! command -v cmake >/dev/null 2>&1; then
                echo "[api-build] 构建 Pingora 影子网关缺少 cmake；请在 genarrative-build 节点预先安装 cmake。" >&2
                exit 1
              fi
              if ! command -v cc >/dev/null 2>&1 && ! command -v clang >/dev/null 2>&1 && ! command -v gcc >/dev/null 2>&1; then
                echo "[api-build] 构建 Pingora 影子网关缺少 C 编译器；请预先安装 clang 或 gcc。" >&2
                exit 1
              fi
              if ! command -v c++ >/dev/null 2>&1 && ! command -v clang++ >/dev/null 2>&1 && ! command -v g++ >/dev/null 2>&1; then
                echo "[api-build] 构建 Pingora 影子网关缺少 C++ 编译器；请预先安装 clang++ 或 g++。" >&2
                exit 1
              fi
            fi
            if ! command -v sccache >/dev/null 2>&1; then
              echo "[api-build] 未找到 sccache，改用 rustc 直接构建。"
              unset RUSTC_WRAPPER
            fi
            npm run check:rustfmt
            pingora_args=()
            if [[ "${INCLUDE_PINGORA_GATEWAY:-false}" == "true" ]]; then
              pingora_args+=(--include-pingora-gateway)
            fi
            SOURCE_BRANCH="${SOURCE_BRANCH}" SOURCE_COMMIT="${SOURCE_COMMIT}" \
            npm run build:production-release -- --component api-server --name "${EFFECTIVE_BUILD_VERSION}" "${pingora_args[@]}"
          '
        '''
      }
    }

    stage('Archive') {
      steps {
        archiveArtifacts artifacts: "build/${env.EFFECTIVE_BUILD_VERSION}/api-server,build/${env.EFFECTIVE_BUILD_VERSION}/api-server.sha256,build/${env.EFFECTIVE_BUILD_VERSION}/release-manifest.json,build/${env.EFFECTIVE_BUILD_VERSION}/scripts/database-backup-to-oss.mjs,build/${env.EFFECTIVE_BUILD_VERSION}/scripts/ops/production-health-patrol.mjs,build/${env.EFFECTIVE_BUILD_VERSION}/scripts/ops/pingora-current-release-audit.mjs,build/${env.EFFECTIVE_BUILD_VERSION}/scripts/ops/pingora-direct-rehearsal-status.mjs,build/${env.EFFECTIVE_BUILD_VERSION}/scripts/ops/pingora-cutover-status-snapshot.mjs,build/${env.EFFECTIVE_BUILD_VERSION}/scripts/ops/pingora-cutover-evidence-bundle.mjs,build/${env.EFFECTIVE_BUILD_VERSION}/scripts/ops/pingora-cutover-command-evidence.mjs,build/${env.EFFECTIVE_BUILD_VERSION}/scripts/ops/pingora-cutover-evidence-verify.mjs,build/${env.EFFECTIVE_BUILD_VERSION}/scripts/ops/pingora-cutover-evidence-audit.mjs,build/${env.EFFECTIVE_BUILD_VERSION}/scripts/check-production-health-patrol-env.mjs,build/${env.EFFECTIVE_BUILD_VERSION}/scripts/check-pingora-release-readiness.mjs,build/${env.EFFECTIVE_BUILD_VERSION}/scripts/check-pingora-direct-preflight.mjs,build/${env.EFFECTIVE_BUILD_VERSION}/scripts/check-pingora-direct-live.mjs,build/${env.EFFECTIVE_BUILD_VERSION}/scripts/check-pingora-canary-live.mjs,build/${env.EFFECTIVE_BUILD_VERSION}/scripts/check-pingora-canary-access-log-parity.mjs,build/${env.EFFECTIVE_BUILD_VERSION}/scripts/deploy/production-api-deploy.sh,build/${env.EFFECTIVE_BUILD_VERSION}/scripts/deploy/maintenance-on.sh,build/${env.EFFECTIVE_BUILD_VERSION}/scripts/deploy/maintenance-off.sh,build/${env.EFFECTIVE_BUILD_VERSION}/scripts/deploy/pingora-direct-enable.sh,build/${env.EFFECTIVE_BUILD_VERSION}/scripts/deploy/pingora-direct-rollback.sh,build/${env.EFFECTIVE_BUILD_VERSION}/scripts/deploy/pingora-realpath-canary-enable.sh,build/${env.EFFECTIVE_BUILD_VERSION}/scripts/deploy/pingora-realpath-canary-disable.sh,build/${env.EFFECTIVE_BUILD_VERSION}/scripts/deploy/pingora-health-patrol-env-switch.mjs,build/${env.EFFECTIVE_BUILD_VERSION}/scripts/deploy/pingora-gateway-env-shadow-switch.mjs,build/${env.EFFECTIVE_BUILD_VERSION}/scripts/deploy/pingora-tls-cert-sync.mjs,build/${env.EFFECTIVE_BUILD_VERSION}/deploy/systemd/**,build/${env.EFFECTIVE_BUILD_VERSION}/deploy/nginx/**,build/${env.EFFECTIVE_BUILD_VERSION}/deploy/env/**,build/${env.EFFECTIVE_BUILD_VERSION}/deploy/pingora/**", fingerprint: true
        script {
          if (params.INCLUDE_PINGORA_GATEWAY) {
            archiveArtifacts artifacts: "build/${env.EFFECTIVE_BUILD_VERSION}/pingora-gateway,build/${env.EFFECTIVE_BUILD_VERSION}/pingora-gateway.sha256", fingerprint: true
          }
        }
      }
    }

    stage('Publish') {
      when {
        expression { return params.PUBLISH_AFTER_BUILD }
      }
      steps {
        build job: params.DEPLOY_JOB_NAME,
          wait: true,
          propagate: true,
          parameters: [
            string(name: 'SOURCE_BRANCH', value: params.SOURCE_BRANCH),
            string(name: 'COMMIT_HASH', value: env.SOURCE_COMMIT),
            string(name: 'BUILD_VERSION', value: env.EFFECTIVE_BUILD_VERSION),
            string(name: 'NOTIFICATION_EMAILS', value: params.NOTIFICATION_EMAILS ?: ''),
            string(name: 'DEPLOY_TARGET', value: params.DEPLOY_TARGET),
            booleanParam(name: 'INCLUDE_PINGORA_GATEWAY', value: params.INCLUDE_PINGORA_GATEWAY),
            booleanParam(name: 'CONFIRM_RELEASE_DEPLOY_AGENT', value: params.CONFIRM_RELEASE_DEPLOY_AGENT),
            string(name: 'BUILD_JOB_NAME', value: env.JOB_NAME),
            string(name: 'BUILD_NUMBER_TO_DEPLOY', value: env.BUILD_NUMBER),
          ]
      }
    }
  }

  post {
    always {
      script {
        def notificationParameters = [
          string(name: 'SOURCE_JOB_NAME', value: env.JOB_NAME),
          string(name: 'SOURCE_BUILD_NUMBER', value: env.BUILD_NUMBER),
          string(name: 'SOURCE_BUILD_URL', value: env.BUILD_URL ?: ''),
          string(name: 'SOURCE_RESULT', value: currentBuild.currentResult ?: 'UNKNOWN'),
          string(name: 'SOURCE_BRANCH', value: params.SOURCE_BRANCH ?: ''),
          string(name: 'SOURCE_COMMIT', value: env.SOURCE_COMMIT ?: (params.COMMIT_HASH ?: '')),
          string(name: 'BUILD_VERSION', value: env.EFFECTIVE_BUILD_VERSION ?: (params.BUILD_VERSION ?: '')),
          string(name: 'DEPLOY_TARGET', value: params.DEPLOY_TARGET ?: ''),
          string(name: 'DATABASE', value: params.DATABASE ?: ''),
          string(name: 'INCLUDE_PINGORA_GATEWAY', value: String.valueOf(params.INCLUDE_PINGORA_GATEWAY)),
          string(name: 'SUMMARY', value: 'API 构建流水线结束'),
        ]
        def notificationRecipients = params.NOTIFICATION_EMAILS?.trim()
        if (notificationRecipients) {
          notificationParameters.add(string(name: 'EMAIL_RECIPIENTS', value: notificationRecipients))
        }
        try {
          build job: 'Genarrative-Notify-Email',
            wait: false,
            propagate: false,
            parameters: notificationParameters
        } catch (error) {
          echo "邮件通知触发失败: ${error.message}"
        }
      }
    }
    success {
      echo "API 构建完成: version=${env.EFFECTIVE_BUILD_VERSION}, commit=${env.SOURCE_COMMIT}"
    }
  }
}