pipeline {
  agent any

  environment {
    REGISTRY = "registry.example.com/java-api"
    IMAGE_TAG = "${env.BUILD_NUMBER}"
  }

  stages {
    stage('Checkout') {
      steps {
        git 'https://github.com/example/java-api-app.git'
      }
    }

    stage('Build') {
      steps {
        sh 'mvn clean package -DskipTests'
      }
    }

    stage('Unit Test') {
      steps {
        sh 'mvn test'
        junit 'target/surefire-reports/*.xml'
      }
    }

    stage('Code Quality - SonarQube') {
      steps {
        withSonarQubeEnv('SonarQube') {
          sh 'mvn sonar:sonar'
        }
      }
    }

    stage('Generate SBOM') {
      steps {
        sh './scripts/generate-sbom.sh'
        archiveArtifacts artifacts: 'sbom/*.json', fingerprint: true
      }
    }

    stage('Build Docker Image') {
      steps {
        sh 'docker build -t $REGISTRY:$IMAGE_TAG .'
      }
    }

    stage('Image Scan - Trivy') {
      steps {
        sh './scripts/run-trivy.sh $REGISTRY:$IMAGE_TAG'
      }
    }

    stage('Image Scan - Anchore/Snyk') {
      steps {
        sh './scripts/run-anchore.sh $REGISTRY:$IMAGE_TAG'
      }
    }

    stage('Push Image') {
      steps {
        withCredentials([usernamePassword(credentialsId: 'docker-registry-creds', usernameVariable: 'USER', passwordVariable: 'PASS')]) {
          sh "echo $PASS | docker login -u $USER --password-stdin $REGISTRY"
          sh 'docker push $REGISTRY:$IMAGE_TAG'
        }
      }
    }

    stage('API Tests') {
      steps {
        sh 'newman run tests/api/postman_collection.json --reporters cli,junit --reporter-junit-export target/api-test-results.xml'
        junit 'target/api-test-results.xml'
      }
    }
  }

  post {
    always {
      archiveArtifacts artifacts: '**/target/*.jar', fingerprint: true
      publishHTML(target: [reportDir: 'target/site', reportFiles: 'index.html', reportName: 'Project Report'])
    }
  }
}