# Bitbucket Pipelines workflow for iac-modules =================================

# Pipeline definitions ---------------------------------------------------------

definitions:
  steps:
    - step: &run-diagnostics
        name: Run diagnostics
        runs-on:
          - self.hosted
          - linux.shell
          - acme.linux.prod
        script:
          - python3.12 pipeline.py run-diagnostics

    - step: &run-scan
        name: Run security scans
        runs-on:
          - self.hosted
          - linux.shell
          - acme.linux.prod
        script:
          - python3.12 pipeline.py run-scan

    - step: &validate-modules
        name: Validate changed modules
        runs-on:
          - self.hosted
          - linux.shell
          - acme.linux.prod
        script:
          - python3.12 pipeline.py validate-modules

    - step: &publish-modules
        name: Publish changed modules
        runs-on:
          - self.hosted
          - linux.shell
          - acme.linux.prod
        script:
          - python3.12 pipeline.py publish-modules

# Pipeline Triggers ------------------------------------------------------------

pipelines:
  # PR — security scan and validate changed modules
  pull-requests:
    "**":
      - step: *run-scan
      - step: *validate-modules

  # Main — publish changed modules
  branches:
    main:
      - step: *publish-modules

  # On-demand — run by manually triggering pipeline
  custom:
    run-scan:
      - step: *run-scan
    run-diagnostics:
      - step: *run-diagnostics
