stages:
  - build

build:
  stage: build
  tags:
    - saas-windows-medium-amd64
  rules:
    - if: '$CI_PIPELINE_SOURCE == "schedule"'
    - if: '$CI_PIPELINE_SOURCE == "web"'
    - if: '$CI_COMMIT_BRANCH == "main"'
      changes:
        - build-pipeline.js
        - package.json
        - config/**/*
        - main.js
        - service-manager.js
        - patcher.js
        - credential-manager.js
        - crypto-utils.js
        - update-client.js
        - .gitlab-ci.yml
  variables:
    GITLAB_TOKEN: $VYLA_GITLAB_TOKEN
    PLAYER_TMDB_KEY: $TMDB_KEY
    PLAYER_API_KEY: $API_KEY
    STREAM_API_TMDB_API_KEY: $TMDB_API_KEY
    STREAM_API_GA_API_SECRET: $GA_API_SECRET
    STREAM_API_GA_MEASUREMENT_ID: $GA_MEASUREMENT_ID
    STREAM_API_TOKEN_SECRET: $TOKEN_SECRET
    PLAYER_BASE_URL: $BASE_URL
    STREAM_API_PROXY_URL: $PROXY_URL
    STREAM_API_PROXY_STREAMS: $PROXY_STREAMS
    STREAM_API_ENABLE_DEBUG_ROUTE: $ENABLE_DEBUG_ROUTE
    PLAYER_BYPASS_AUTH: $BYPASS_AUTH
    STREAM_API_BYPASS_AUTH: $BYPASS_AUTH
    AUTH_PROXY_VITE_BASE_URL: $AUTH_PROXY_BASE_URL
    AUTH_PROXY_VITE_API_KEY: $AUTH_PROXY_API_KEY
    AUTH_PROXY_DEV_BYPASS_AUTH: $DEV_BYPASS_AUTH
    AUTH_PROXY_PROXY_VITE_API_KEY: $PROXY_VITE_API_KEY
    GIT_TERMINAL_PROMPT: "0"
  cache:
    key:
      files:
        - package-lock.json
    paths:
      - node_modules/
  script:
    - npm ci
    
    - |
      $repos = @("frontend", "player", "stream-api", "auth-proxy")
      $last = @{}
      
      if (Test-Path "last-shas.json") {
        $rawJson = Get-Content "last-shas.json" -Raw | ConvertFrom-Json
        if ($rawJson) {
          $rawJson.psobject.properties | ForEach-Object { $last[$_.Name] = $_.Value }
        }
      }

      $current = @{}
      $changed = $false

      foreach ($repo in $repos) {
        $headers = @{
          "PRIVATE-TOKEN" = "$env:GITLAB_TOKEN"
        }
        
        $uri = "https://gitlab.com/api/v4/projects/vyla-entertainment%2F$repo/repository/commits/main"
        
        try {
          $resp = Invoke-RestMethod -Uri $uri -Headers $headers
          $sha = $resp.id
          $current[$repo] = $sha

          if (-not $last.ContainsKey($repo) -or $last[$repo] -ne $sha) {
            Write-Host "Change detected in $repo (main): $sha"
            $changed = $true
          } else {
            Write-Host "No change in $repo (main)"
          }
        } catch {
          Write-Warning "Failed to fetch commit info for $repo."
        }
      }

      $current | ConvertTo-Json | Set-Content last-shas.json

      if ($env:CI_PIPELINE_SOURCE -ne "schedule") {
        $changed = $true
      }

      if (-not $changed) {
        Write-Host "No changes detected. Skipping build."
        exit 0
      }

    - Write-Host "Starting secure build process..."
    - node build-pipeline.js

    - |
      if (Test-Path "update-payload.zip") {
        Write-Host "Build artifact verified: update-payload.zip exists"
        $size = (Get-Item update-payload.zip).Length
        Write-Host "  Size: $size bytes"
      } else {
        Write-Error "Build artifact missing: update-payload.zip"
        exit 1
      }

      if (Test-Path "manifest.json") {
        Write-Host "Manifest file verified"
        Get-Content manifest.json | ConvertFrom-Json | ConvertTo-Json -Depth 10
      } else {
        Write-Error "Manifest file missing"
        exit 1
      }

      if (Test-Path "validation-report.json") {
        Write-Host "Validation report verified"
      }

    - Write-Host "Packaging Electron application..."
    - npm run dist

    - |
      Write-Host "Publishing Release to GitLab..."
      $versionTag = "v$env:CI_PIPELINE_IID"
      $exeItem = Get-ChildItem dist/*.exe | Select-Object -First 1
      $exeName = $exeItem.Name
      $exeEncoded = [System.Uri]::EscapeDataString($exeName)
      
      $releaseBody = @{
        name = "Vyla Home Release $versionTag"
        tag_name = "$versionTag"
        description = "Automated release for build $versionTag. Download the Windows installer below."
        ref = "$env:CI_COMMIT_SHA"
        assets = @{
          links = @(
            @{
              name = "$exeName"
              url = "$env:CI_PROJECT_URL/-/jobs/$env:CI_JOB_ID/artifacts/raw/dist/$exeEncoded"
              link_type = "package"
            },
            @{
              name = "update-payload.zip"
              url = "$env:CI_PROJECT_URL/-/jobs/$env:CI_JOB_ID/artifacts/raw/update-payload.zip"
              link_type = "other"
            },
            @{
              name = "manifest.json"
              url = "$env:CI_PROJECT_URL/-/jobs/$env:CI_JOB_ID/artifacts/raw/manifest.json"
              link_type = "other"
            }
          )
        }
      } | ConvertTo-Json -Depth 5

      $releaseHeaders = @{
        "JOB-TOKEN" = "$env:CI_JOB_TOKEN"
        "Content-Type" = "application/json"
      }

      try {
        $createdRelease = Invoke-RestMethod -Uri "https://gitlab.com/api/v4/projects/$env:CI_PROJECT_ID/releases" -Method Post -Headers $releaseHeaders -Body $releaseBody
        Write-Host "Release successfully published: $($createdRelease.tag_name)"
      } catch {
        Write-Warning "Release creation failed: $($_.Exception.Message)"
        exit 1
      }

  artifacts:
    paths:
      - update-payload.zip
      - manifest.json
      - validation-report.json
      - dist/*.exe
      - dist/*.exe.blockmap
    expire_in: 30 days