stages:
  - test
  - deploy

# -----------------------------------------------------------------
# Global Notification Logic (Runs after every job execution)
# -----------------------------------------------------------------
.notify_template: &notify_template
  after_script:
    - |
      # Check if Telegram token is available before sending
      if [ -n "$TELEGRAM_BOT_TOKEN" ] && [ -n "$TELEGRAM_CHAT_ID" ]; then
        MESSAGE="🚀 *GitOps Pipeline Status Notification*
        --------------------------------------
        *Project:* ${CI_PROJECT_NAME}
        *Stage:* ${CI_JOB_STAGE}
        *Status:* ${CI_JOB_STATUS}
        *Branch:* ${CI_COMMIT_REF_NAME}
        *Author:* ${CI_COMMIT_AUTHOR}
        *Commit:* ${CI_COMMIT_TITLE}
        --------------------------------------
        [View Pipeline Details](${CI_PIPELINE_URL})"

        curl -s -X POST "https://api.telegram.org/bot${TELEGRAM_BOT_TOKEN}/sendMessage" \
          -d "chat_id=${TELEGRAM_CHAT_ID}" \
          -d "parse_mode=Markdown" \
          -d "text=${MESSAGE}"
      fi

# -----------------------------------------------------------------
# Stage 1: DevSecOps Vulnerability Scanning
# -----------------------------------------------------------------
security_scan:
  stage: test
  image:
    name: aquasec/trivy:0.49.1
    entrypoint: [""]
  script:
    # Scan the application docker image for High and Critical vulnerabilities
    - trivy image --severity HIGH,CRITICAL nginxdemos/hello:plain-text

# -----------------------------------------------------------------
# Stage 2: Automated GitOps Deployment
# -----------------------------------------------------------------
deploy_application:
  stage: deploy
  image: docker:24.0.7-cli
  script:
    - docker pull nginxdemos/hello:plain-text
    - docker compose -f ./stacks/hello-world/docker-compose.yml up -d
    # Added bonus: Re-running ansible safely in pipeline if configuration changes
    # - echo "$ANSIBLE_VAULT_PASSWORD" > .vault_pass
    # - ansible-playbook -i hosts.ini main.yml --vault-password-file .vault_pass