# Bitbucket Pipelines workflow for iac-deployments =============================

# Pipeline definitions ---------------------------------------------------------

definitions:
  steps:
    - step: &gated-entrypoint
        name: Gated pipeline entrypoint
        runs-on:
          - self.hosted
          - linux.shell
          - acme.linux.prod
        script:
          - |
            echo "Pipeline execution requires manual approval"
            echo "Review and trigger the next step to proceed."

    - step: &run-diagnostics
        name: Run diagnostics
        runs-on:
          - self.hosted
          - linux.shell
          - acme.linux.prod
        script:
          - python3.12 pipeline.py run-diagnostics

    - step: &run-scan
        name: Run security scans
        runs-on:
          - self.hosted
          - linux.shell
          - acme.linux.prod
        script:
          - python3.12 pipeline.py run-scan

    - step: &run-driftcheck
        name: Run drift check
        runs-on:
          - self.hosted
          - linux.shell
          - acme.linux.prod
        oidc: true
        script:
          - |
            export AWS_WEB_IDENTITY_TOKEN_FILE=$(mktemp)
            echo $BITBUCKET_STEP_OIDC_TOKEN > $AWS_WEB_IDENTITY_TOKEN_FILE
            trap 'rm -f $AWS_WEB_IDENTITY_TOKEN_FILE' EXIT
            python3.12 pipeline.py run-driftcheck

    - step: &validate-stack
        name: Validate changed stack
        runs-on:
          - self.hosted
          - linux.shell
          - acme.linux.prod
        oidc: true
        script:
          - |
            export AWS_WEB_IDENTITY_TOKEN_FILE=$(mktemp)
            echo $BITBUCKET_STEP_OIDC_TOKEN > $AWS_WEB_IDENTITY_TOKEN_FILE
            trap 'rm -f $AWS_WEB_IDENTITY_TOKEN_FILE' EXIT
            python3.12 pipeline.py validate-stack

    - step: &plan-stack
        name: Plan changed stack
        runs-on:
          - self.hosted
          - linux.shell
          - acme.linux.prod
        oidc: true
        script:
          - |
            export AWS_WEB_IDENTITY_TOKEN_FILE=$(mktemp)
            echo $BITBUCKET_STEP_OIDC_TOKEN > $AWS_WEB_IDENTITY_TOKEN_FILE
            trap 'rm -f $AWS_WEB_IDENTITY_TOKEN_FILE' EXIT
            python3.12 pipeline.py plan-stack

    - step: &execute-stack
        name: Execute changed stack
        trigger: manual
        runs-on:
          - self.hosted
          - linux.shell
          - acme.linux.prod
        oidc: true
        script:
          - |
            echo "Stack execution approved on $(date -u)"
            echo ""
            echo "approver uuid  : $BITBUCKET_STEP_TRIGGERER_UUID"
            echo "build number   : $BITBUCKET_BUILD_NUMBER"
            echo "branch name    : $BITBUCKET_BRANCH"
            echo "commit hash    : $BITBUCKET_COMMIT"
            echo ""
            export AWS_WEB_IDENTITY_TOKEN_FILE=$(mktemp)
            echo $BITBUCKET_STEP_OIDC_TOKEN > $AWS_WEB_IDENTITY_TOKEN_FILE
            trap 'rm -f $AWS_WEB_IDENTITY_TOKEN_FILE' EXIT
            python3.12 pipeline.py execute-stack

# Pipeline Triggers ------------------------------------------------------------

pipelines:
  # PR — security scan, validate and plan changed stack
  pull-requests:
    "**":
      - step: *run-scan
      - step: *validate-stack
      - step: *plan-stack

  # Main — execute or destroy changed stack
  branches:
    main:
      - step: *gated-entrypoint
      - step: *execute-stack

  # On-demand — run by manually triggering pipeline
  custom:
    run-scan:
      - step: *run-scan
    run-diagnostics:
      - step: *run-diagnostics
    run-driftcheck:
      - step: *run-driftcheck
