pipeline {
    agent any

    environment {
        RTI_VERSION = '7.7.0'
        HARBOR_REGISTRY = 'harbor.sl.defence-elec.de/proxydockerhub'
        IMAGE_NAME = 'rti-connext-dds'
        IMAGE_TAG = "${RTI_VERSION}"
        OFFLINE_CACHE_PATH = '/opt/offline-cache/rti_connext_dds-7.7.0'
        RTI_LICENSE_FILE = '/opt/rti_connext_dds-7.7.0/rti_license.dat'
    }

    options {
        timeout(time: 20, unit: 'MINUTES')
        buildDiscarder(logRotator(numToKeepStr: '10'))
    }

    stages {
        stage('Checkout') {
            steps {
                checkout scm
            }
        }

        stage('Prepare License Files') {
            steps {
                script {
                    // LICENSE HANDLING: RTI uses file-based licensing.
                    // License file (rti_license.dat) must be copied into container for FlexLM discovery.
                    // Customer has lifetime commercial license.
                    // DEB package (librti-connext-dds-7.7.0-dev) will be installed from internal SCM repository.
                    sh """
                        mkdir -p ${env.WORKSPACE}/rti-license-staging
                        cp ${env.WORKSPACE}/rti_license.dat ${env.WORKSPACE}/rti-license-staging/
                        echo "RTI license file prepared: rti_license.dat"
                    """
                }
            }
        }

        stage('Build RTI Container') {
            steps {
                script {
                    dir('external-dependencies/rti-connext-dds') {
                        sh """
                            docker build \
                              --build-arg RTI_VERSION=${RTI_VERSION} \
                              -t ${HARBOR_REGISTRY}/${IMAGE_NAME}:${IMAGE_TAG} \
                              .
                        """
                    }
                }
            }
        }

        stage('Verify RTI') {
            steps {
                script {
                    sh """
                        docker run --rm ${HARBOR_REGISTRY}/${IMAGE_NAME}:${IMAGE_TAG} bash -c '
                          ls -la /opt/rti_connext_dds-7.7.0/
                          test -f /opt/rti_connext_dds-7.7.0/rti_license.dat
                          test -d /opt/rti_connext_dds-7.7.0/include
                        '
                    """
                }
            }
        }

        stage('Generate SBOM') {
            steps {
                script {
                    dir('external-dependencies/rti-connext-dds') {
                        sh """
                            mkdir -p sbom
                            
                            # Set environment variables for SBOM generation
                            export GIT_URL="${env.GIT_URL}"
                            export GIT_COMMIT="${env.GIT_COMMIT}"
                            export BUILD_NUMBER="${env.BUILD_NUMBER}"
                            export DOCKERFILE_PATH="external-dependencies/rti-connext-dds/Dockerfile"
                            
                            # Generate CycloneDX SBOM, SLSA provenance, and license report
                            bash ../scripts/generate-sbom.sh rti-connext-dds ${RTI_VERSION} ./sbom
                        """
                    }
                }
            }
        }

        stage('Push to Registry') {
            steps {
                script {
                    withCredentials([usernamePassword(
                        credentialsId: 'harbor-credentials',
                        usernameVariable: 'HARBOR_USER',
                        passwordVariable: 'HARBOR_PASSWORD'
                    )]) {
                        sh """
                            echo ${HARBOR_PASSWORD} | docker login ${HARBOR_REGISTRY} -u ${HARBOR_USER} --password-stdin
                            docker push ${HARBOR_REGISTRY}/${IMAGE_NAME}:${IMAGE_TAG}
                            docker logout ${HARBOR_REGISTRY}
                        """
                    }
                }
            }
        }
    }

    post {
        always {
            cleanWs()
        }
    }
}