name: Quality gate

on:
  push:
    branches:
      - '**'
  pull_request:
    branches:
      - '**'
    types: [ opened, synchronize, reopened ]

jobs:
  sonar:
    name: SonarQube Analysis
    runs-on: ubuntu-latest
    permissions:
      contents: read # Necessário para checkout
      # Adicione outras permissões se o token do app precisar delas,
      # mas 'write-all' é muito amplo e geralmente não necessário para o token do workflow em si.
      # As permissões para o token do app são definidas na configuração do GitHub App.

    steps:
      - name: ⬇️ Checkout Code
        uses: actions/checkout@v4
        with:
          fetch-depth: 0 # Necessário para SonarQube analysis
          persist-credentials: false # Importante: Evita que o token padrão do checkout interfira

      - name: Generate App Token
        id: generate-app-token
        uses: actions/create-github-app-token@v1
        with:
          app-id: ${{ secrets.APP_ID }}
          private-key: ${{ secrets.APP_PRIVATE_KEY }}
          owner: 'Aignosi' # O proprietário (usuário ou organização) dos repositórios
          repositories: 'sientia-dataops-library,sientia-mlops-library' # Repositórios que o token do app precisa acessar

      - name: Prepare requirements.txt
        id: prepare-requirements
        run: |
          if [ ! -f requirements.txt ]; then
            echo "requirements.txt not found!"
            # Decide how to handle: exit 1, or create an empty one, or use a default
            # For now, let's assume it might be optional or created elsewhere if not present.
            # If it's mandatory, uncomment the line below:
            exit 1
            echo "PROCESSED_REQUIREMENTS_FILE=requirements.txt" >> $GITHUB_OUTPUT # Fallback or handle error
          else
            # Converte URLs SSH (git@github.com: ou git+ssh://git@github.com/) para HTTPS genéricas
            # Exemplo: git+ssh://git@github.com/Aignosi/repo.git -> git+https://github.com/Aignosi/repo.git
            # Exemplo: git@github.com:Aignosi/repo.git -> git+https://github.com/Aignosi/repo.git
            sed -e "s|git+ssh://git@github.com/|git+https://github.com/|g" \
                -e "s|git@github.com:|git+https://github.com/|g" \
                requirements.txt > requirements_prepared.txt
            echo "PROCESSED_REQUIREMENTS_FILE=requirements_prepared.txt" >> $GITHUB_OUTPUT
            echo "--- Original requirements.txt ---"
            cat requirements.txt
            echo "--- Prepared requirements_prepared.txt ---"
            cat requirements_prepared.txt
          fi

      - name: Configure Git to use App Token
        env:
          # Este é o token gerado pelo GitHub App, com permissões para os repositórios de dependência
          GH_APP_TOKEN: ${{ steps.generate-app-token.outputs.token }}
        run: |
          # Configura o Git para usar o token do app para todas as URLs HTTPS do github.com
          # Isso garante que o pip, ao clonar dependências, usará este token.
          git config --global url."https://oauth2:${GH_APP_TOKEN}@github.com/".insteadOf "https://github.com/"
          echo "Git authentication configured to use the App Token for github.com"
          
          # (Opcional) Para depuração: Verifique se o token pode listar o repositório remoto
          GIT_TERMINAL_PROMPT=0 git ls-remote https://github.com/Aignosi/sientia-dataops-library.git HEAD || echo "Failed to ls-remote sientia-dataops-library"
          GIT_TERMINAL_PROMPT=0 git ls-remote https://github.com/Aignosi/sientia-mlops-library.git HEAD || echo "Failed to ls-remote sientia-mlops-library"

      - name: 🔧 Setup Python
        uses: actions/setup-python@v4
        with:
          python-version: "3.11"

      - name: 🗄️ Cache Python dependencies
        uses: actions/cache@v3
        with:
          path: ~/.cache/pip
          key: ${{ runner.os }}-pip-${{ hashFiles(steps.prepare-requirements.outputs.PROCESSED_REQUIREMENTS_FILE) }}
          restore-keys: |
            ${{ runner.os }}-pip-

      - name: 📦 Install Dependencies
        run: |
          python -m pip install --upgrade pip
          echo "Installing dependencies from ${{ steps.prepare-requirements.outputs.PROCESSED_REQUIREMENTS_FILE }}"
          pip install -r ${{ steps.prepare-requirements.outputs.PROCESSED_REQUIREMENTS_FILE }}
          pip install pytest pytest-cov
      
      - name: ⬇️ Setup Node.js 18
        uses: actions/setup-node@v4
        with:
          node-version: 18

      - name: 📥 Setup SonarScanner
        uses: warchant/setup-sonar-scanner@v7

      - name: 🧪 Run Tests with Pytest
        run: |
          pytest tests --junitxml=pytest.xml --cov=scouter --cov-report=xml --cov-report=term

      - name: 📊 Run SonarQube Analysis
        env:
          SONAR_PROJECT_KEY: ${{ secrets.SONAR_PROJECT_KEY }}
          SONAR_HOST_URL: ${{ secrets.SONAR_HOST_URL }}
          SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }} # Este é o token do SonarQube
        run: |
          sonar-scanner \
            -Dsonar.projectKey=$SONAR_PROJECT_KEY \
            -Dsonar.sources=scouter \
            -Dsonar.tests=tests \
            -Dsonar.python.coverage.reportPaths=coverage.xml \
            -Dsonar.python.xunit.reportPath=pytest.xml \
            -Dsonar.host.url=$SONAR_HOST_URL \
            -Dsonar.token=$SONAR_TOKEN \
            -Dsonar.python.version=3.11 \
            -Dsonar.projectVersion=1.0.0