pipeline {
    agent {
        docker {
            image 'harbor.sl.defence-elec.de/proxydockerhub/library/ubuntu:26.04'
            registryUrl 'https://harbor.sl.defence-elec.de'
            args '--network=host'
        }
    }

    environment {
        HTTP_PROXY = credentials('http-proxy-url')
        HTTPS_PROXY = credentials('https-proxy-url')
        NO_PROXY = 'localhost,127.0.0.1,.sl.defence-elec.de'
        QT_VERSION = '6.10.2'
        KDREPORTS_VERSION = '2.3.0'
        LOG4QT_VERSION = '2.0.0'
        HARBOR_REGISTRY = 'harbor.sl.defence-elec.de/proxydockerhub'
        IMAGE_NAME = 'legatus-build-container'
        IMAGE_TAG = "ubuntu26-qt6.${QT_VERSION}"
    }

    options {
        timeout(time: 60, unit: 'MINUTES')
        buildDiscarder(logRotator(numToKeepStr: '10'))
    }

    stages {
        stage('Checkout') {
            steps {
                checkout scm
            }
        }

        stage('Build Container') {
            steps {
                script {
                    dir('external-dependencies/ubuntu-26.04-build-container') {
                        sh """
                            docker build \
                              --build-arg HTTP_PROXY=${HTTP_PROXY} \
                              --build-arg HTTPS_PROXY=${HTTPS_PROXY} \
                              --build-arg NO_PROXY=${NO_PROXY} \
                              --build-arg QT_VERSION=${QT_VERSION} \
                              --build-arg KDREPORTS_VERSION=${KDREPORTS_VERSION} \
                              --build-arg LOG4QT_VERSION=${LOG4QT_VERSION} \
                              -t ${HARBOR_REGISTRY}/${IMAGE_NAME}:${IMAGE_TAG} \
                              -t ${HARBOR_REGISTRY}/${IMAGE_NAME}:latest \
                              .
                        """
                    }
                }
            }
        }

        stage('Verify Container') {
            steps {
                script {
                    sh """
                        docker run --rm ${HARBOR_REGISTRY}/${IMAGE_NAME}:${IMAGE_TAG} bash -c '
                          echo "Qt6 Version:" && qmake6 --version &&
                          echo "KDReports:" && pkg-config --modversion KDReports-qt6 &&
                          echo "Log4Qt:" && pkg-config --modversion Log4Qt &&
                          echo "Grantlee:" && grantlee-view --version
                        '
                    """
                }
            }
        }

        stage('Generate SBOM') {
            steps {
                script {
                    dir('external-dependencies/ubuntu-26.04-build-container') {
                        sh """
                            mkdir -p sbom
                            
                            # Set environment variables for SBOM generation
                            export GIT_URL="${env.GIT_URL}"
                            export GIT_COMMIT="${env.GIT_COMMIT}"
                            export BUILD_NUMBER="${env.BUILD_NUMBER}"
                            export DOCKERFILE_PATH="external-dependencies/ubuntu-26.04-build-container/Dockerfile"
                            
                            # Generate CycloneDX SBOM, SLSA provenance, and license report
                            bash ../scripts/generate-sbom.sh ubuntu26-qt6-build-container ubuntu26-qt6.${QT_VERSION} ./sbom
                            
                            # Generate additional component SBOMs
                            cat > sbom/components.json << EOF
                            {
                              "components": [
                                {"name": "Qt6", "version": "${QT_VERSION}"},
                                {"name": "KDReports", "version": "${KDREPORTS_VERSION}"},
                                {"name": "Log4Qt", "version": "${LOG4QT_VERSION}"},
                                {"name": "Grantlee", "version": "5.3.1"},
                                {"name": "GoogleTest", "version": "1.15.2"},
                                {"name": "PostgreSQL", "version": "16"}
                              ]
                            }
                            EOF
                        """
                    }
                }
            }
        }

        stage('Push to Registry') {
            steps {
                script {
                    withCredentials([usernamePassword(
                        credentialsId: 'harbor-credentials',
                        usernameVariable: 'HARBOR_USER',
                        passwordVariable: 'HARBOR_PASSWORD'
                    )]) {
                        sh """
                            echo ${HARBOR_PASSWORD} | docker login ${HARBOR_REGISTRY} -u ${HARBOR_USER} --password-stdin
                            docker push ${HARBOR_REGISTRY}/${IMAGE_NAME}:${IMAGE_TAG}
                            docker push ${HARBOR_REGISTRY}/${IMAGE_NAME}:latest
                            docker logout ${HARBOR_REGISTRY}
                        """
                    }
                }
            }
        }
    }

    post {
        always {
            cleanWs()
        }
        success {
            echo "Build container ${IMAGE_NAME}:${IMAGE_TAG} successfully built and pushed"
        }
        failure {
            echo "Build container build failed"
        }
    }
}