pipeline {
    agent any

    environment {
        DOCKER_HUB_USERNAME = 'aimodocker'
        DOCKER_AUTH = credentials('aimodocker')
        IMAGE_NAME = 'i-rcfa'
        SERVICE_NAME = 'ahm-app'
        SECURITY_PREFIX = 'security'
        DOCKER_BUILDKIT = '1'
    }

    stages {
        stage('Checkout & Setup') {
            steps {
                script {
                    checkout scm
                    env.GIT_COMMIT_HASH = sh(script: 'git rev-parse --short HEAD', returnStdout: true).trim()

                    def branch = env.BRANCH_NAME ?: 'unknown'
                    echo "Current Branch: ${branch}"

                    if (branch == 'main') {
                        env.IMAGE_TAG = env.GIT_COMMIT_HASH
                        env.SECONDARY_TAG = 'latest'
                    } else if (branch == 'ircfa_security') {
                        env.IMAGE_TAG = "${env.SECURITY_PREFIX}-${env.GIT_COMMIT_HASH}"
                        env.SECONDARY_TAG = "${env.SECURITY_PREFIX}-latest"
                    } else {
                        env.IMAGE_TAG = "temp-${env.GIT_COMMIT_HASH}"
                        env.SECONDARY_TAG = ""
                    }

                    echo "Primary Tag: ${env.IMAGE_TAG}"
                    echo "Secondary Tag: ${env.SECONDARY_TAG}"
                }
            }
        }

        stage('Docker Login') {
            steps {
                sh "echo ${DOCKER_AUTH_PSW} | docker login -u ${DOCKER_AUTH_USR} --password-stdin"
            }
        }

        stage('Build & Tag') {
            steps {
                script {
                    def fullImageName = "${env.DOCKER_HUB_USERNAME}/${env.IMAGE_NAME}"
                    def cacheTag = env.SECONDARY_TAG ?: "latest"

                    echo "Pulling latest image for caching..."
                    sh "docker pull ${fullImageName}:${cacheTag} || true"

                    sh "docker build --build-arg BUILDKIT_INLINE_CACHE=1 --cache-from ${fullImageName}:${cacheTag} -t ${fullImageName}:${env.IMAGE_TAG} ."

                    if (env.SECONDARY_TAG) {
                        sh "docker tag ${fullImageName}:${env.IMAGE_TAG} ${fullImageName}:${env.SECONDARY_TAG}"
                    }
                }
            }
        }

        stage('Push to Docker Hub') {
            steps {
                script {
                    def fullImageName = "${env.DOCKER_HUB_USERNAME}/${env.IMAGE_NAME}"
                    sh "docker push ${fullImageName}:${env.IMAGE_TAG}"

                    if (env.SECONDARY_TAG) {
                        sh "docker push ${fullImageName}:${env.SECONDARY_TAG}"
                    }
                }
            }
        }
    }

    post {
        always {
            script {
                sh 'docker logout'
                def fullImageName = "${env.DOCKER_HUB_USERNAME}/${env.IMAGE_NAME}"
                sh "docker rmi ${fullImageName}:${env.IMAGE_TAG} || true"
                if (env.SECONDARY_TAG) {
                    sh "docker rmi ${fullImageName}:${env.SECONDARY_TAG} || true"
                }
            }
        }
        success {
            echo "Successfully processed ${env.BRANCH_NAME} — ${env.IMAGE_TAG}."
        }
    }
}