pipeline {
    agent any

    parameters {
        string(
            name: 'SKILLWITNESS_VERSION',
            defaultValue: '',
            description: 'Required pinned released version'
        )
        string(name: 'SKILLWITNESS_PROFILE', defaultValue: 'company-strict')
        string(name: 'SKILLWITNESS_TARGET', defaultValue: './skills')
        string(
            name: 'SKILLWITNESS_POLICY',
            defaultValue: './policies/example-org/approved-tools.yaml'
        )
    }

    environment {
        VALIDATOR_VENV = '.skillwitness-venv'
    }

    stages {
        stage('Install validator') {
            steps {
                sh '''
                    set -eu
                    test -n "$SKILLWITNESS_VERSION"
                    python3.12 -m venv "$VALIDATOR_VENV"
                    "$VALIDATOR_VENV/bin/python" -m pip install \
                        "skillwitness==$SKILLWITNESS_VERSION"
                '''
            }
        }

        stage('Run skill risk policy gate') {
            steps {
                sh '''
                    set +e
                    "$VALIDATOR_VENV/bin/skillwitness" \
                        scan "$SKILLWITNESS_TARGET" \
                        --profile "$SKILLWITNESS_PROFILE" \
                        --approved-tools "$SKILLWITNESS_POLICY" \
                        --format markdown \
                        --output skillwitness-report.md \
                        --evidence-output skillwitness-evidence.jsonl
                    markdown_status=$?
                    "$VALIDATOR_VENV/bin/skillwitness" \
                        scan "$SKILLWITNESS_TARGET" \
                        --profile "$SKILLWITNESS_PROFILE" \
                        --approved-tools "$SKILLWITNESS_POLICY" \
                        --format sarif \
                        --output skillwitness-report.sarif
                    sarif_status=$?
                    set -e
                    if [ "$markdown_status" -ne 0 ]; then
                        exit "$markdown_status"
                    fi
                    exit "$sarif_status"
                '''
            }
        }
    }

    post {
        always {
            archiveArtifacts(
                artifacts: 'skillwitness-report.md,skillwitness-report.sarif,skillwitness-evidence.jsonl',
                allowEmptyArchive: true,
                fingerprint: true
            )
        }
    }
}
