name: Security-Driven Release

on:
  schedule:
    # Weekly security scan and release check on Mondays at 3 AM UTC
    - cron: '0 3 * * 1'
  workflow_dispatch:
    inputs:
      force_release:
        description: 'Force release even if no security changes detected'
        required: false
        default: false
        type: boolean
      custom_notes:
        description: 'Custom release notes'
        required: false
        type: string

permissions:
  contents: write          # Required for repository access, checkout, and badge updates
  actions: write          # Required for triggering other workflows
  security-events: write  # Required for security report uploads and processing

env:
  PYTHON_VERSION: '3.12'

jobs:
  security-change-analysis:
    name: Security Change Analysis
    runs-on: ubuntu-latest
    
    outputs:
      should_release: ${{ steps.release_decision.outputs.should_release }}
      release_type: ${{ steps.release_decision.outputs.release_type }}
      release_notes: ${{ steps.release_decision.outputs.release_notes }}
      justification: ${{ steps.release_decision.outputs.justification }}
      changes_detected: ${{ steps.release_decision.outputs.changes_detected }}
    
    steps:
      - name: Checkout code
        uses: actions/checkout@v4
        with:
          fetch-depth: 0  # Need full history for comparison
      
      - name: Set up Python
        uses: actions/setup-python@v5
        with:
          python-version: ${{ env.PYTHON_VERSION }}
      
      - name: Install UV
        run: |
          curl -LsSf https://astral.sh/uv/install.sh | sh
          echo "$HOME/.cargo/bin" >> $GITHUB_PATH
          source $HOME/.cargo/env
      
      - name: Install dependencies
        run: |
          export PATH="$HOME/.cargo/bin:$PATH"
          uv sync --group dev --group security
      
      - name: Run current security scan
        run: |
          export PATH="$HOME/.cargo/bin:$PATH"
          echo "🔍 Running current security scan..."
          
          # Ensure reports directory exists
          mkdir -p security/reports/latest
          
          # Run dependency security scan
          uv add --dev pip-audit
          uv run pip-audit --format=json --output=security/reports/latest/pip-audit.json || echo "Dependency scan completed"
          
          # Run code security analysis
          uv add --dev bandit
          uv run bandit -r src/ -f json -o security/reports/latest/bandit.json || echo "Code analysis completed"
          
          # Run secret detection (simplified for workflow)
          echo '[]' > security/reports/latest/secrets-scan.json
          
          echo "✅ Security scan completed"
      
      - name: Update security findings
        run: |
          export PATH="$HOME/.cargo/bin:$PATH"
          echo "📋 Updating security findings document..."
          
          # Update findings document
          uv run python security/scripts/update-findings.py --verbose
          
          echo "✅ Security findings updated"
      
      - name: Execute integrated security-driven workflow
        id: release_decision
        run: |
          export PATH="$HOME/.cargo/bin:$PATH"
          echo "🤔 Executing integrated security-driven workflow..."
          
          # Prepare command arguments
          WORKFLOW_ARGS="security-workflow"
          
          if [ "${{ github.event.inputs.force_release }}" = "true" ]; then
            WORKFLOW_ARGS="$WORKFLOW_ARGS --force"
          fi
          
          if [ -n "${{ github.event.inputs.custom_notes }}" ]; then
            WORKFLOW_ARGS="$WORKFLOW_ARGS --notes='${{ github.event.inputs.custom_notes }}'"
          fi
          
          # Execute integrated workflow
          echo "Running: uv run python scripts/integration_orchestrator.py $WORKFLOW_ARGS"
          WORKFLOW_RESULT=$(uv run python scripts/integration_orchestrator.py $WORKFLOW_ARGS)
          
          echo "Workflow result:"
          echo "$WORKFLOW_RESULT"
          
          # Parse JSON result and set GitHub outputs
          echo "$WORKFLOW_RESULT" > workflow_result.json
          
          # Extract workflow outputs from the result
          SHOULD_RELEASE=$(echo "$WORKFLOW_RESULT" | jq -r '.workflow_outputs.should_release // "false"')
          RELEASE_TYPE=$(echo "$WORKFLOW_RESULT" | jq -r '.workflow_outputs.release_type // "none"')
          RELEASE_NOTES=$(echo "$WORKFLOW_RESULT" | jq -r '.workflow_outputs.release_notes // ""')
          JUSTIFICATION=$(echo "$WORKFLOW_RESULT" | jq -r '.workflow_outputs.justification // ""')
          CHANGES_DETECTED=$(echo "$WORKFLOW_RESULT" | jq -r '.workflow_outputs.changes_detected // "false"')
          
          # Set GitHub outputs
          echo "should_release=$SHOULD_RELEASE" >> $GITHUB_OUTPUT
          echo "release_type=$RELEASE_TYPE" >> $GITHUB_OUTPUT
          echo "justification=$JUSTIFICATION" >> $GITHUB_OUTPUT
          echo "changes_detected=$CHANGES_DETECTED" >> $GITHUB_OUTPUT
          
          # Handle multi-line release notes
          echo "release_notes<<EOF" >> $GITHUB_OUTPUT
          echo "$RELEASE_NOTES" >> $GITHUB_OUTPUT
          echo "EOF" >> $GITHUB_OUTPUT
          
          echo "✅ Integrated workflow completed successfully"
        env:
          FORCE_RELEASE: ${{ github.event.inputs.force_release }}
          CUSTOM_NOTES: ${{ github.event.inputs.custom_notes }}
      
      - name: Display release decision
        run: |
          echo "🎯 Release Decision Results:"
          echo "Should Release: ${{ steps.release_decision.outputs.should_release }}"
          echo "Release Type: ${{ steps.release_decision.outputs.release_type }}"
          echo "Justification: ${{ steps.release_decision.outputs.justification }}"
          echo "Changes Detected: ${{ steps.release_decision.outputs.changes_detected }}"
          echo ""
          
          if [ -f "release_analysis.json" ]; then
            echo "📊 Detailed Analysis:"
            cat release_analysis.json | jq '.'
          fi
      
      - name: Upload release analysis
        uses: actions/upload-artifact@v4
        with:
          name: release-analysis
          path: |
            release_analysis.json
            security/findings/SECURITY_FINDINGS.md
          if-no-files-found: warn

  trigger-pypi-release:
    name: Trigger PyPI Release
    runs-on: ubuntu-latest
    needs: security-change-analysis
    if: needs.security-change-analysis.outputs.should_release == 'true'
    
    steps:
      - name: Checkout code
        uses: actions/checkout@v4
      
      - name: Download release analysis
        uses: actions/download-artifact@v4
        with:
          name: release-analysis
      
      - name: Trigger PyPI publishing workflow
        uses: actions/github-script@v7
        with:
          github-token: ${{ secrets.GITHUB_TOKEN }}
          script: |
            const releaseType = '${{ needs.security-change-analysis.outputs.release_type }}';
            const releaseNotes = `${{ needs.security-change-analysis.outputs.release_notes }}`.replace(/\\n/g, '\n').replace(/\\r/g, '\r');
            const justification = '${{ needs.security-change-analysis.outputs.justification }}';
            
            console.log('🚀 Triggering PyPI publishing workflow...');
            console.log(`Release Type: ${releaseType}`);
            console.log(`Justification: ${justification}`);
            
            const response = await github.rest.actions.createWorkflowDispatch({
              owner: context.repo.owner,
              repo: context.repo.repo,
              workflow_id: 'pypi-publish.yml',
              ref: 'main',
              inputs: {
                release_type: releaseType,
                release_notes: `${justification}\n\n${releaseNotes}`,
                dry_run: false
              }
            });
            
            console.log('✅ PyPI publishing workflow triggered successfully');
            console.log(`Workflow dispatch response: ${response.status}`);

  no-release-summary:
    name: No Release Summary
    runs-on: ubuntu-latest
    needs: security-change-analysis
    if: needs.security-change-analysis.outputs.should_release == 'false'
    
    steps:
      - name: Display no-release summary
        run: |
          echo "📋 No Release Required"
          echo "===================="
          echo ""
          echo "Justification: ${{ needs.security-change-analysis.outputs.justification }}"
          echo "Changes Detected: ${{ needs.security-change-analysis.outputs.changes_detected }}"
          echo ""
          echo "✅ Security posture is stable - no release needed"
          echo "📅 Next scheduled check: Next Monday at 3 AM UTC"

  workflow-summary:
    name: Workflow Summary
    runs-on: ubuntu-latest
    needs: [security-change-analysis, trigger-pypi-release, no-release-summary]
    if: always()
    
    steps:
      - name: Checkout code
        uses: actions/checkout@v4
      
      - name: Set up Python
        uses: actions/setup-python@v5
        with:
          python-version: ${{ env.PYTHON_VERSION }}
      
      - name: Install UV
        run: |
          curl -LsSf https://astral.sh/uv/install.sh | sh
          echo "$HOME/.cargo/bin" >> $GITHUB_PATH
          source $HOME/.cargo/env
      
      - name: Install dependencies
        run: |
          export PATH="$HOME/.cargo/bin:$PATH"
          uv sync
      
      - name: Update badges (CI-only)
        if: github.ref == 'refs/heads/main'
        run: |
          export PATH="$HOME/.cargo/bin:$PATH"
          export TESTS_PASSED=true
          export GITHUB_REPOSITORY=${{ github.repository }}
          export PYPI_PACKAGE=mypylogger
          uv run python -m badges --ci-mode
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
      
      - name: Generate workflow summary
        run: |
          echo "# Security-Driven Release Workflow Summary" >> $GITHUB_STEP_SUMMARY
          echo "" >> $GITHUB_STEP_SUMMARY
          
          if [ "${{ needs.security-change-analysis.result }}" = "success" ]; then
            echo "✅ **Security Analysis**: Completed successfully" >> $GITHUB_STEP_SUMMARY
          else
            echo "❌ **Security Analysis**: Failed" >> $GITHUB_STEP_SUMMARY
          fi
          
          echo "**Release Decision**: ${{ needs.security-change-analysis.outputs.should_release }}" >> $GITHUB_STEP_SUMMARY
          echo "**Release Type**: ${{ needs.security-change-analysis.outputs.release_type }}" >> $GITHUB_STEP_SUMMARY
          echo "**Justification**: ${{ needs.security-change-analysis.outputs.justification }}" >> $GITHUB_STEP_SUMMARY
          echo "**Changes Detected**: ${{ needs.security-change-analysis.outputs.changes_detected }}" >> $GITHUB_STEP_SUMMARY
          echo "" >> $GITHUB_STEP_SUMMARY
          
          if [ "${{ needs.security-change-analysis.outputs.should_release }}" = "true" ]; then
            if [ "${{ needs.trigger-pypi-release.result }}" = "success" ]; then
              echo "🚀 **PyPI Release**: Triggered successfully" >> $GITHUB_STEP_SUMMARY
            else
              echo "❌ **PyPI Release**: Failed to trigger" >> $GITHUB_STEP_SUMMARY
            fi
          else
            echo "⏭️ **PyPI Release**: Skipped (no release needed)" >> $GITHUB_STEP_SUMMARY
          fi
          
          echo "" >> $GITHUB_STEP_SUMMARY
          echo "**Next Check**: Next Monday at 3 AM UTC (scheduled)" >> $GITHUB_STEP_SUMMARY