stages: [security, evidence, deploy]

variables:
  METASOLVE_BASE_URL: https://app.metasolve.ca
  METASOLVE_OUT_DIR: out/metasolve-vaas

security:
  stage: security
  image: python:3.12-slim
  script:
    - python -m pip install --disable-pip-version-check bandit cyclonedx-bom
    - mkdir -p out/security
    - bandit -r . -f json -o out/security/bandit.json
    - cyclonedx-py environment -o out/security/sbom.cdx.json
  artifacts:
    when: always
    paths: [out/security/]

metasolve_evidence:
  stage: evidence
  image: python:3.12-slim
  needs: [security]
  script:
    - python scripts/ci/metasolve_vaas_verify.py --sbom-path out/security/sbom.cdx.json --policy-id ORG-SECURE-RELEASE --policy-version 1.0 --clause-id APPSEC-GATE --policy-approval-status Approved --environment staging --fail-on blocked
  artifacts:
    when: always
    paths: [out/metasolve-vaas/]
  rules:
    - if: '$CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH'

deploy:
  stage: deploy
  when: manual
  script: ["echo Deploy only the immutable artifact bound to reviewed evidence"]
  needs: [metasolve_evidence]
# Store METASOLVE_API_KEY as a masked, protected CI variable.
