pipeline {
  agent any
  environment {
    METASOLVE_BASE_URL = 'https://app.metasolve.ca'
    METASOLVE_OUT_DIR = 'out/metasolve-vaas'
  }
  stages {
    stage('Local security checks') {
      steps {
        sh 'python -m pip install --disable-pip-version-check bandit cyclonedx-bom'
        sh 'mkdir -p out/security && bandit -r . -f json -o out/security/bandit.json'
        sh 'cyclonedx-py environment -o out/security/sbom.cdx.json'
      }
    }
    stage('MetaSolve evidence gate') {
      steps {
        withCredentials([string(credentialsId: 'metasolve-api-key', variable: 'METASOLVE_API_KEY')]) {
          sh '''python scripts/ci/metasolve_vaas_verify.py \
            --sbom-path out/security/sbom.cdx.json \
            --policy-id ORG-SECURE-RELEASE \
            --policy-version 1.0 \
            --clause-id APPSEC-GATE \
            --policy-approval-status Approved \
            --environment staging \
            --fail-on blocked'''
        }
      }
    }
    stage('Deploy') {
      when { branch 'main' }
      input { message 'Reviewer confirms the bound artifact and release evidence?' }
      steps { sh 'echo Deploy the reviewed immutable artifact here' }
    }
  }
  post {
    always { archiveArtifacts artifacts: 'out/**/*', allowEmptyArchive: true, fingerprint: true }
  }
}