pipeline {
    agent any

    environment {
        // settings.py demands SECRET_KEY unless DEBUG is exactly "True".
        // A throwaway value lets CI run with DEBUG unset — that is, False, as
        // in production — instead of falling back to the insecure dev key.
        DEBUG = 'True'
        SECRET_KEY = 'ci-only-value-never-used-in-production'
        DJANGO_SETTINGS_MODULE = 'expenses_manager.settings'
        PYTHONUNBUFFERED = '1'
    }

    options {
        buildDiscarder(logRotator(numToKeepStr: '30'))
        timeout(time: 20, unit: 'MINUTES')
    }

    stages {
        stage('Setup Python') {
            steps {
                sh '''
                    cd expenses_manager
                    python --version
                    python -m venv venv
                    venv/bin/pip install --upgrade pip
                    venv/bin/pip install -r requirements.txt
                '''
            }
        }

        // Catches models changed without generating the migration. Exactly the
        // failure mode that reached production as a 500 on 2026-09-29.
        stage('Check migrations') {
            steps {
                sh '''
                    cd expenses_manager
                    venv/bin/python manage.py makemigrations --check --dry-run
                '''
            }
        }

        stage('Run tests') {
            steps {
                sh '''
                    cd expenses_manager
                    venv/bin/pytest --cov --junitxml=junit.xml
                '''
            }
        }
    }

    post {
        always {
            // allowEmptyResults: false is deliberate. A build where pytest died
            // before collecting anything produces no XML, and that must fail
            // rather than pass quietly — as happened for months in 2026.
            junit allowEmptyResults: false, testResults: 'expenses_manager/junit.xml'
        }
        failure {
            notifyTelegram("❌ FALLO")
        }
        fixed {
            notifyTelegram("✅ Recuperado")
        }
    }
}

// Sends a one-line build summary to Telegram. Credentials are read from the
// Jenkins store so the token never lives in the repository.
void notifyTelegram(String status) {
    withCredentials([
        string(credentialsId: 'telegram-bot-token', variable: 'TG_TOKEN'),
        string(credentialsId: 'telegram-chat-id', variable: 'TG_CHAT')
    ]) {
        sh """
            curl -s -X POST "https://api.telegram.org/bot\${TG_TOKEN}/sendMessage" \
                --data-urlencode "chat_id=\${TG_CHAT}" \
                --data-urlencode "text=${status} ${env.JOB_NAME} #${env.BUILD_NUMBER}
Rama: ${env.BRANCH_NAME ?: 'main'}
${env.BUILD_URL}" > /dev/null
        """
    }
}