# Bitbucket Pipelines workflow for iac-policies ================================

# Pipeline definitions ---------------------------------------------------------

definitions:
  steps:
    - step: &run-diagnostics
        name: Run diagnostics
        runs-on:
          - self.hosted
          - linux.shell
          - acme.linux.prod
        script:
          - python3.12 pipeline.py run-diagnostics

    - step: &run-scan
        name: Run security scan
        runs-on:
          - self.hosted
          - linux.shell
          - acme.linux.prod
        script:
          - python3.12 pipeline.py run-scan

    - step: &validate-policies
        name: Validate policies and catalog
        runs-on:
          - self.hosted
          - linux.shell
          - acme.linux.prod
        script:
          - python3.12 pipeline.py validate-policies

    - step: &publish-policies
        name: Publish policies to Artifactory
        runs-on:
          - self.hosted
          - linux.shell
          - acme.linux.prod
        script:
          - python3.12 pipeline.py publish-policies

# Pipeline Triggers ------------------------------------------------------------

pipelines:
  # PR — security scan and validate
  pull-requests:
    "**":
      - step: *run-scan
      - step: *validate-policies

  # Main — publish on merge
  branches:
    main:
      - step: *publish-policies

  # On-demand
  custom:
    run-scan:
      - step: *run-scan
    run-diagnostics:
      - step: *run-diagnostics
