name: Feature PR — Validate and Deploy to DEV

on:
  pull_request:
    branches:
      - development

jobs:
  validate-sml:
    name: Validate SML
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Validate SML YAML schema
        run: |
          # Replace with your preferred SML/YAML validation tool
          yamllint ./models

  deploy-dev:
    name: Deploy to DEV AtScale
    needs: validate-sml
    runs-on: ubuntu-latest
    environment: dev
    steps:
      - uses: actions/checkout@v4

      - name: Deploy model to DEV
        env:
          ATSCALE_HOST: ${{ secrets.ATSCALE_HOST }}
          ATSCALE_API_TOKEN: ${{ secrets.ATSCALE_API_TOKEN }}
          ATSCALE_ORG: ${{ secrets.ATSCALE_ORG }}
        run: |
          # Authenticate and deploy via AtScale REST API
          TOKEN=$(curl -s -X POST "https://${ATSCALE_HOST}/v1/token" \
            -H "Authorization: Bearer ${ATSCALE_API_TOKEN}" \
            -H "Content-Type: application/json" | jq -r '.token')
          curl -s -X POST "https://${ATSCALE_HOST}/wapi/p/catalogs" \
            -H "Authorization: Bearer ${TOKEN}" \
            -H "Content-Type: application/json" \
            -d "{\"org\": \"${ATSCALE_ORG}\", \"smlRoot\": \"./models\"}"

      - name: Post DEV link to PR
        uses: actions/github-script@v7
        with:
          script: |
            github.rest.issues.createComment({
              issue_number: context.issue.number,
              owner: context.repo.owner,
              repo: context.repo.repo,
              body: `✅ **DEV deploy complete.** Review at: https://${{ secrets.ATSCALE_HOST }}/ui`
            })

name: Deploy to UAT

on:
  push:
    branches:
      - development

jobs:
  deploy-uat:
    name: Deploy to UAT AtScale
    runs-on: ubuntu-latest
    environment: uat
    steps:
      - uses: actions/checkout@v4

      - name: Deploy model to UAT
        env:
          ATSCALE_HOST: ${{ secrets.ATSCALE_HOST }}
          ATSCALE_API_TOKEN: ${{ secrets.ATSCALE_API_TOKEN }}
          ATSCALE_ORG: ${{ secrets.ATSCALE_ORG }}
        run: |
          TOKEN=$(curl -s -X POST "https://${ATSCALE_HOST}/v1/token" \
            -H "Authorization: Bearer ${ATSCALE_API_TOKEN}" \
            -H "Content-Type: application/json" | jq -r '.token')
          curl -s -X POST "https://${ATSCALE_HOST}/wapi/p/catalogs" \
            -H "Authorization: Bearer ${TOKEN}" \
            -H "Content-Type: application/json" \
            -d "{\"org\": \"${ATSCALE_ORG}\", \"smlRoot\": \"./models\"}"

  smoke-test-uat:
    name: Smoke Test UAT
    needs: deploy-uat
    runs-on: ubuntu-latest
    environment: uat
    steps:
      - uses: actions/checkout@v4

      - name: Run MDX smoke tests
        env:
          ATSCALE_HOST: ${{ secrets.ATSCALE_HOST }}
          ATSCALE_API_TOKEN: ${{ secrets.ATSCALE_API_TOKEN }}
        run: |
          # Execute a known MDX query against UAT and assert non-empty results
          # Replace with your own test queries and assertion logic
          TOKEN=$(curl -s -X POST "https://${ATSCALE_HOST}/v1/token" \
            -H "Authorization: Bearer ${ATSCALE_API_TOKEN}" \
            -H "Content-Type: application/json" | jq -r '.token')
          curl -s -X POST "https://${ATSCALE_HOST}/xmla" \
            -H "Authorization: Bearer ${TOKEN}" \
            -H "Content-Type: text/xml" \
            -d '<Execute xmlns="urn:schemas-microsoft-com:xml-analysis"><Command><Statement>SELECT [Measures].[Total Revenue] ON 0 FROM [Sales]</Statement></Command><Properties/></Execute>'

name: Deploy to PROD

on:
  push:
    branches:
      - main

jobs:
  deploy-prod:
    name: Deploy to PROD AtScale
    runs-on: ubuntu-latest
    environment: prod          # GitHub Environment with required reviewer protection
    steps:
      - uses: actions/checkout@v4

      - name: Deploy model to PROD
        env:
          ATSCALE_HOST: ${{ secrets.ATSCALE_HOST }}
          ATSCALE_API_TOKEN: ${{ secrets.ATSCALE_API_TOKEN }}
          ATSCALE_ORG: ${{ secrets.ATSCALE_ORG }}
        run: |
          TOKEN=$(curl -s -X POST "https://${ATSCALE_HOST}/v1/token" \
            -H "Authorization: Bearer ${ATSCALE_API_TOKEN}" \
            -H "Content-Type: application/json" | jq -r '.token')
          curl -s -X POST "https://${ATSCALE_HOST}/wapi/p/catalogs" \
            -H "Authorization: Bearer ${TOKEN}" \
            -H "Content-Type: application/json" \
            -d "{\"org\": \"${ATSCALE_ORG}\", \"smlRoot\": \"./models\"}"

  smoke-test-prod:
    name: Smoke Test PROD
    needs: deploy-prod
    runs-on: ubuntu-latest
    environment: prod
    steps:
      - uses: actions/checkout@v4

      - name: Run PROD smoke tests
        env:
          ATSCALE_HOST: ${{ secrets.ATSCALE_HOST }}
          ATSCALE_API_TOKEN: ${{ secrets.ATSCALE_API_TOKEN }}
        run: |
          TOKEN=$(curl -s -X POST "https://${ATSCALE_HOST}/v1/token" \
            -H "Authorization: Bearer ${ATSCALE_API_TOKEN}" \
            -H "Content-Type: application/json" | jq -r '.token')
          curl -s -X POST "https://${ATSCALE_HOST}/xmla" \
            -H "Authorization: Bearer ${TOKEN}" \
            -H "Content-Type: text/xml" \
            -d '<Execute xmlns="urn:schemas-microsoft-com:xml-analysis"><Command><Statement>SELECT [Measures].[Total Revenue] ON 0 FROM [Sales]</Statement></Command><Properties/></Execute>'

      - name: Notify on success
        uses: actions/github-script@v7
        with:
          script: |
            const sha = context.sha.substring(0, 7);
            console.log(`PROD deploy of ${sha} complete.`);

name: Release PR — Full Regression

on:
  pull_request:
    branches:
      - main

jobs:
  validate-sml-full:
    name: Full SML Regression
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - name: Validate entire SML tree
        run: |
          # Replace with your preferred SML/YAML validation tool
          yamllint --strict ./models

      - name: Check for breaking changes
        run: |
          # Diff against main to detect renamed or removed measures
          git diff origin/main...HEAD -- ./models | grep -E '^-\s+(name|sql):' | \
            grep -v '^---' || echo "No breaking measure changes detected"

name: Hotfix PR — Validate and Deploy to DEV

on:
  pull_request:
    branches:
      - main
    # Only run this workflow for hotfix branches; release-pr.yml handles development → main
    # GitHub does not support per-branch filtering on source here, so both workflows run
    # on PRs to main. The validate-sml job is harmless to run twice.

jobs:
  validate-sml:
    name: Validate SML
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - name: Validate SML schema
        run: |
          yamllint ./models

      - name: Check for breaking changes against main
        run: |
          git diff origin/main...HEAD -- ./models | grep -E '^-\s+(name|sql):' | \
            grep -v '^---' || echo "No breaking measure changes detected"

  deploy-dev:
    name: Deploy hotfix to DEV for spot-check
    needs: validate-sml
    runs-on: ubuntu-latest
    environment: dev
    steps:
      - uses: actions/checkout@v4

      - name: Deploy hotfix to DEV
        env:
          ATSCALE_HOST: ${{ secrets.ATSCALE_HOST }}
          ATSCALE_API_TOKEN: ${{ secrets.ATSCALE_API_TOKEN }}
          ATSCALE_ORG: ${{ secrets.ATSCALE_ORG }}
        run: |
          TOKEN=$(curl -s -X POST "https://${ATSCALE_HOST}/v1/token" \
            -H "Authorization: Bearer ${ATSCALE_API_TOKEN}" \
            -H "Content-Type: application/json" | jq -r '.token')
          curl -s -X POST "https://${ATSCALE_HOST}/wapi/p/catalogs" \
            -H "Authorization: Bearer ${TOKEN}" \
            -H "Content-Type: application/json" \
            -d "{\"org\": \"${ATSCALE_ORG}\", \"smlRoot\": \"./models\"}"

      - name: Post DEV link to PR
        uses: actions/github-script@v7
        with:
          script: |
            github.rest.issues.createComment({
              issue_number: context.issue.number,
              owner: context.repo.owner,
              repo: context.repo.repo,
              body: `🚨 **Hotfix DEV deploy complete.** Verify the fix at: https://${{ secrets.ATSCALE_HOST }}/ui before approving.`
            })

name: Hotfix — Deploy to UAT (manual)

on:
  workflow_dispatch:
    inputs:
      hotfix_branch:
        description: "Hotfix branch to deploy to UAT (e.g. hotfix/fix-revenue-calc)"
        required: true
        type: string
      reason:
        description: "Brief description of the incident requiring UAT validation"
        required: true
        type: string

jobs:
  deploy-hotfix-uat:
    name: Deploy hotfix to UAT
    runs-on: ubuntu-latest
    environment: uat
    steps:
      - uses: actions/checkout@v4
        with:
          ref: ${{ inputs.hotfix_branch }}

      - name: Warn that UAT is being overwritten
        uses: actions/github-script@v7
        with:
          script: |
            const msg = [
              `⚠️ **UAT is being overwritten by hotfix branch \`${{ inputs.hotfix_branch }}\`**`,
              `**Reason:** ${{ inputs.reason }}`,
              `**Triggered by:** @${{ github.actor }}`,
              `UAT will not reflect in-flight development work until this hotfix merges to \`main\` and \`deploy-uat.yml\` redeploys from \`development\`.`,
              `Do not merge any \`feature/*\` PRs to \`development\` until UAT is restored.`
            ].join('\n\n');
            // Post as a GitHub commit status comment or notify via your team's channel
            console.log(msg);

      - name: Deploy hotfix branch to UAT
        env:
          ATSCALE_HOST: ${{ secrets.ATSCALE_HOST }}
          ATSCALE_API_TOKEN: ${{ secrets.ATSCALE_API_TOKEN }}
          ATSCALE_ORG: ${{ secrets.ATSCALE_ORG }}
        run: |
          TOKEN=$(curl -s -X POST "https://${ATSCALE_HOST}/v1/token" \
            -H "Authorization: Bearer ${ATSCALE_API_TOKEN}" \
            -H "Content-Type: application/json" | jq -r '.token')
          curl -s -X POST "https://${ATSCALE_HOST}/wapi/p/catalogs" \
            -H "Authorization: Bearer ${TOKEN}" \
            -H "Content-Type: application/json" \
            -d "{\"org\": \"${ATSCALE_ORG}\", \"smlRoot\": \"./models\"}"