Jenkinsfile.web.prod

pipeline {
    agent any

    environment {
        GHCR_URL = 'ghcr.io/poolchaos'
        IMAGE_NAME = 'serelo-web'
        // DELTA-12: Production server from Jenkins credential (not hardcoded)
        PROD_SERVER = credentials('SERELO_PROD_SERVER')
        DOCKER_BUILDKIT = '1'
    }

    options {
        skipDefaultCheckout(true)
        timeout(time: 45, unit: 'MINUTES')
        disableConcurrentBuilds()
    }

    stages {
        stage('Safe Memory Management') {
            steps {
                script {
                    echo "🚦 === SAFE MEMORY MANAGEMENT ==="

                    sh '''
                        echo "🧹 Starting SAFE memory cleanup for web build..."

                        # Basic Docker cleanup
                        echo "🧹 Basic Docker cleanup..."
                        docker container prune -f 2>/dev/null || echo "Container cleanup completed"
                        docker image prune -f 2>/dev/null || echo "Image cleanup completed"

                        # Check available memory
                        AVAILABLE_MB=$(free -m | awk 'NR==2{printf "%d", $7}')
                        echo "💾 Available memory after cleanup: ${AVAILABLE_MB}MB"

                        if [ "$AVAILABLE_MB" -lt "300" ]; then
                            echo "❌ ERROR: Insufficient memory for web build (${AVAILABLE_MB}MB < 300MB required)"
                            exit 1
                        fi

                        echo "✅ Safe memory cleanup completed - Ready for web build"
                    '''
                }
            }
        }

        stage('Workspace Setup') {
            steps {
                echo "🧹 === WORKSPACE SETUP ==="
                script {
                    deleteDir()

                    checkout([
                        $class: 'GitSCM',
                        branches: [[name: '*/main']],
                        doGenerateSubmoduleConfigurations: false,
                        extensions: [
                            [$class: 'CleanBeforeCheckout'],
                            [$class: 'CloneOption', depth: 1, shallow: true]
                        ],
                        userRemoteConfigs: [[
                            url: 'https://github.com/Poolchaos/serelo.git',
                            credentialsId: 'github-repo-access'
                        ]]
                    ])

                    env.IMAGE_TAG = sh(script: 'git rev-parse --short HEAD', returnStdout: true).trim()
                    env.FULL_IMAGE_NAME = "${GHCR_URL}/${IMAGE_NAME}:${env.IMAGE_TAG}"

                    sh '''
                        echo "✅ Checkout completed"
                        echo "📋 Image: ${FULL_IMAGE_NAME}"

                        # Verify frontend structure
                        echo "🔍 Verifying frontend structure..."
                        if [ ! -d "frontend" ]; then
                            echo "❌ ERROR: frontend directory not found!"
                            exit 1
                        fi

                        if [ ! -f "frontend/package.json" ]; then
                            echo "❌ ERROR: frontend/package.json not found!"
                            exit 1
                        fi

                        if [ ! -f "frontend/Dockerfile" ]; then
                            echo "❌ ERROR: frontend/Dockerfile not found!"
                            exit 1
                        fi

                        echo "✅ Frontend structure verified"
                    '''
                }
            }
        }

        stage('Run Tests') {
            steps {
                catchError(buildResult: 'SUCCESS', stageResult: 'UNSTABLE') {
                    script {
                        echo "🧪 === RUNNING WEB TESTS ==="

                        sh '''
                            set +e
                            echo "Running frontend tests in Docker container..."

                            docker run --rm \
                                -e CI=true \
                                node:20-alpine \
                                sh -c "npm install --no-audit && npm test -- --watchAll=false --passWithNoTests" 2>&1 || echo "Tests encountered issues but continuing..."

                            echo "✅ Test stage completed"
                        '''
                    }
                }
            }
            post {
                always {
                    sh 'docker rmi node:20-alpine 2>/dev/null || true'
                }
            }
        }

        stage('Docker Build') {
            steps {
                withCredentials([
                    string(credentialsId: 'SERELO_VITE_API_URL', variable: 'VITE_API_URL'),
                    string(credentialsId: 'SERELO_PAYSTACK_PUBLIC', variable: 'VITE_PAYSTACK_PUBLIC_KEY')
                ]) {
                    script {
                        echo "🐳 === WEB DOCKER BUILD ==="
                        echo "Building: ${env.FULL_IMAGE_NAME}"

                        sh '''
                            set -e

                            echo "🔍 Pre-build verification..."
                            echo "Build context: $(pwd)/frontend"

                            # Pull latest image for cache
                            echo "📥 Pulling latest image for build cache..."
                            docker pull ${GHCR_URL}/${IMAGE_NAME}:latest || echo "No cache image available, will build from scratch"

                        # Memory-adaptive build strategy
                        AVAILABLE_MB=$(free -m | awk 'NR==2{printf "%d", $7}')
                        echo "💾 Available memory: ${AVAILABLE_MB}MB"

                        if [ "$AVAILABLE_MB" -gt "1200" ]; then
                            echo "💪 Using optimal build settings..."
                            MEMORY_LIMIT="1024m"
                            SWAP_LIMIT="1536m"
                        elif [ "$AVAILABLE_MB" -gt "800" ]; then
                            echo "⚖️ Using balanced build settings..."
                            MEMORY_LIMIT="800m"
                            SWAP_LIMIT="1200m"
                        else
                            echo "🐌 Using minimal build settings..."
                            MEMORY_LIMIT="600m"
                            SWAP_LIMIT="800m"
                        fi

                        # Build Web Docker image
                        echo "📦 Building Serelo Web Docker image..."
                        docker build \\
                            --progress=plain \\
                            --cache-from ${GHCR_URL}/${IMAGE_NAME}:latest \\
                            --build-arg BUILDKIT_INLINE_CACHE=1 \\
                            --build-arg VITE_API_URL="${VITE_API_URL}" \\
                            --build-arg VITE_PAYSTACK_PUBLIC_KEY="${VITE_PAYSTACK_PUBLIC_KEY}" \\
                            --memory=$MEMORY_LIMIT \\
                            --memory-swap=$SWAP_LIMIT \\
                            -f frontend/Dockerfile \\
                            -t ${FULL_IMAGE_NAME} \\
                            frontend/

                        echo "✅ Serelo Web Docker image built successfully"
                    '''
                    }
                }
            }
        }

        stage('Container Security Scan') {
            steps {
                catchError(buildResult: 'SUCCESS', stageResult: 'UNSTABLE') {
                    script {
                        echo "🔍 === CONTAINER SECURITY SCAN ==="

                        sh '''
                            set +e
                            echo "Scanning ${FULL_IMAGE_NAME} for vulnerabilities..."

                            docker run --rm \
                                -v /var/run/docker.sock:/var/run/docker.sock \
                                -v /tmp/trivy-cache:/root/.cache \
                                aquasec/trivy:latest image \
                                --cache-dir /tmp/trivy-cache \
                                --exit-code 0 \
                                --severity HIGH,CRITICAL \
                                --format table \
                                ${FULL_IMAGE_NAME} 2>&1 || echo "Security scan encountered issues but continuing..."

                            echo "✅ Security scan completed"
                        '''
                    }
                }
            }
            post {
                always {
                    sh 'rm -rf /tmp/trivy-cache 2>/dev/null || true'
                }
            }
        }

        stage('Push to Registry') {
            steps {
                withCredentials([
                    string(credentialsId: 'GHCR_USERNAME', variable: 'GHCR_USER'),
                    string(credentialsId: 'GHCR_TOKEN', variable: 'GHCR_PAT')
                ]) {
                    script {
                        echo "📤 === WEB PUSH TO REGISTRY ==="

                        sh '''
                            set -e

                            echo "📤 Pushing Serelo Web Docker image..."
                            echo "${GHCR_PAT}" | docker login ghcr.io -u "${GHCR_USER}" --password-stdin
                            docker push ${FULL_IMAGE_NAME}

                            echo "🏷️ Tagging and pushing as latest..."
                            docker tag ${FULL_IMAGE_NAME} ${GHCR_URL}/${IMAGE_NAME}:latest
                            docker push ${GHCR_URL}/${IMAGE_NAME}:latest

                            echo "✅ Web image pushed successfully"
                        '''
                    }
                }
            }
        }

        stage('Approve Deploy') {
            steps {
                script {
                    echo "🤔 === DEPLOY CONFIRMATION REQUIRED ==="
                    echo "📋 Ready to deploy: ${env.FULL_IMAGE_NAME}"
                    echo "🎯 Target: Serelo Web Production"

                    input message: '🚀 Deploy Serelo Web to Production?', ok: 'Deploy Now'

                    echo "✅ Deployment approved"
                }
            }
        }

        stage('Deploy to Production') {
            steps {
                withCredentials([
                    string(credentialsId: 'GHCR_USERNAME', variable: 'GHCR_USER'),
                    string(credentialsId: 'GHCR_TOKEN', variable: 'GHCR_PAT')
                ]) {
                    script {
                        echo "🚀 === DEPLOYING SERELO WEB TO PRODUCTION ==="

                        sh '''
                            echo "🔗 Connecting to production server..."
                            ssh -o StrictHostKeyChecking=accept-new ${PROD_SERVER} "
                                set -e
                                echo '🎯 Starting Serelo Web deployment...'

                                # Login to registry
                                echo '🔐 Logging into container registry...'
                                echo '${GHCR_PAT}' | docker login ghcr.io -u '${GHCR_USER}' --password-stdin

                                # Pull new image
                                echo '📥 Pulling new Serelo Web image...'
                                docker pull ${FULL_IMAGE_NAME}

                                # Stop and remove old container
                                echo '🔄 Stopping old container...'
                                docker stop serelo-web-prod 2>/dev/null || echo 'No running container to stop'
                                docker rm serelo-web-prod 2>/dev/null || echo 'No container to remove'

                                # Start new container
                                echo '🚀 Starting new Serelo Web container...'
                                docker run -d --name serelo-web-prod \\
                                    -p 127.0.0.1:3001:80 \\
                                    --restart unless-stopped \\
                                    --network serelo-net \\
                                    ${FULL_IMAGE_NAME}

                                # Verify container is running
                                echo '✅ Verifying container...'
                                sleep 5
                                if docker ps --filter name=serelo-web-prod --format '{{.Status}}' | grep -q 'Up'; then
                                    echo '✅ Container verified running'
                                else
                                    echo '❌ Container failed to start'
                                    docker logs serelo-web-prod --tail 20 2>/dev/null || echo 'No logs available'
                                    exit 1
                                fi

                                echo '✅ Serelo Web deployment completed'
                            "
                        '''

                        echo "✅ Serelo Web deployed successfully"
                    }
                }
            }
        }

        stage('Post-Deploy Verification') {
            steps {
                script {
                    echo "🔍 === POST-DEPLOY VERIFICATION ==="

                    sh '''
                        echo "🔍 Verifying Serelo Web deployment..."
                        ssh -o StrictHostKeyChecking=accept-new ${PROD_SERVER} "
                            echo '=== Container Status ==='
                            docker ps --filter name=serelo-web

                            echo '=== Web Logs (last 10 lines) ==='
                            docker logs --tail 10 serelo-web-prod

                            echo '=== Health Check ==='
                            sleep 3
                            curl -f http://localhost:3001/health || echo 'Health check failed'
                        "
                    '''

                    echo "✅ Post-deploy verification completed"
                }
            }
        }
    }

    post {
        always {
            script {
                echo "🧹 === POST-BUILD CLEANUP ==="

                sh '''
                    set +e
                    echo "🐳 Docker cleanup..."

                    # Remove build image
                    docker rmi ${FULL_IMAGE_NAME} 2>/dev/null || echo "Build image already removed"
                    docker rmi ${GHCR_URL}/${IMAGE_NAME}:latest 2>/dev/null || echo "Latest tag already removed"

                    # Remove base images pulled during build/test
                    docker rmi node:20-alpine 2>/dev/null || echo "node:20-alpine already removed"

                    # Remove Trivy cache
                    rm -rf /tmp/trivy-cache 2>/dev/null || true

                    # Prune all unused images older than 1h (safe - running containers retain their refs)
                    docker image prune -a --filter "until=1h" -f 2>/dev/null || echo "Image prune completed"
                    docker container prune -f 2>/dev/null || echo "Container prune completed"
                    docker builder prune -f 2>/dev/null || echo "Builder prune completed"

                    echo "📊 Final status:"
                    free -h
                    df -h /
                '''
            }
        }
        success {
            script {
                echo "🎉 === BUILD SUCCESS ==="
                echo "✅ Serelo Web deployed successfully"
                echo "📋 Image: ${env.FULL_IMAGE_NAME}"
            }
        }
        failure {
            script {
                echo "💥 === BUILD FAILED ==="
                echo "❌ Serelo Web build or deployment failed"
            }
        }
    }
}