From 342280707eaa0e368fe11ba4f8d12c5ebca6f851 Mon Sep 17 00:00:00 2001
From: devops <devops@swim.local>
Date: Wed, 16 Sep 2026 13:28:20 +0000
Subject: [PATCH] feat: staging + production approval gate

---
 Jenkinsfile | 58 +++++++++++++++++++++++++++++++++++++++++++++--------
 1 file changed, 50 insertions(+), 8 deletions(-)

diff --git a/Jenkinsfile b/Jenkinsfile
index 65a470d..97dfbcd 100644
--- a/Jenkinsfile
+++ b/Jenkinsfile
@@ -168,7 +168,7 @@ assert r['version'] == '${IMAGE_TAG}', 'version galat!'
             }
         }
 
-        stage('Deploy to VM') {
+        stage('Deploy to STAGING') {
             steps {
                 sh '''
                     set +x
@@ -177,19 +177,61 @@ assert r['version'] == '${IMAGE_TAG}', 'version galat!'
                     export ANSIBLE_HOST_KEY_CHECKING=False
                     export IMAGE_TAG=${IMAGE_TAG}
                     ansible-galaxy collection install community.docker --force -q || true
-                    ansible-playbook -i deploy/inventory.ini deploy/deploy.yml
+                    ansible-playbook -i deploy/inventory.ini deploy/deploy.yml -e target=staging
                 '''
             }
         }
 
-        stage('Post-deploy verify') {
+        stage('Verify STAGING') {
             steps {
                 sh '''
-                    APPVM=$(awk -F= "/ansible_host/{print \\$2}" deploy/inventory.ini | tr -d " ")
-                    GOT=$(curl -sf --max-time 10 http://${APPVM}:8000/version | python3 -c "import sys,json;print(json.load(sys.stdin)['version'])")
-                    echo "  expected: ${IMAGE_TAG}  |  live app: ${GOT}"
-                    [ "$GOT" = "${IMAGE_TAG}" ] || { echo "VERSION MISMATCH - deploy fail"; exit 1; }
-                    echo "  DEPLOY VERIFIED"
+                    SVM=$(grep "^staging-vm" deploy/inventory.ini | sed "s/.*ansible_host=//" | tr -d " ")
+                    GOT=$(curl -sf --max-time 10 http://${SVM}:8000/version | python3 -c "import sys,json;print(json.load(sys.stdin)[\'version\'])")
+                    echo "  staging expected: ${IMAGE_TAG}  |  live: ${GOT}"
+                    [ "$GOT" = "${IMAGE_TAG}" ] || { echo "STAGING MISMATCH"; exit 1; }
+                    echo "  STAGING VERIFIED"
+                '''
+            }
+        }
+
+        stage('Production approval') {
+            steps {
+                script {
+                    // Enterprise gate: insaan ki manzoori ke bina production par kuch nahi.
+                    // 15 min me jawab na aaye to build abort - production safe rehta hai.
+                    timeout(time: 15, unit: 'MINUTES') {
+                        env.APPROVED = input(
+                            message: "Staging theek hai. Production par ${env.IMAGE_TAG} deploy karein?",
+                            ok: 'Deploy to Production',
+                            parameters: [choice(name: 'DECISION', choices: ['Deploy', 'Abort'], description: '')]
+                        )
+                    }
+                    if (env.APPROVED != 'Deploy') { error('Production deploy user ne rok diya') }
+                }
+            }
+        }
+
+        stage('Deploy to PRODUCTION') {
+            steps {
+                sh '''
+                    set +x
+                    . ./.vault-registry.env
+                    export REG_USER REG_PASS
+                    export ANSIBLE_HOST_KEY_CHECKING=False
+                    export IMAGE_TAG=${IMAGE_TAG}
+                    ansible-playbook -i deploy/inventory.ini deploy/deploy.yml -e target=production
+                '''
+            }
+        }
+
+        stage('Verify PRODUCTION') {
+            steps {
+                sh '''
+                    PVM=$(grep "^app-vm" deploy/inventory.ini | sed "s/.*ansible_host=//" | tr -d " ")
+                    GOT=$(curl -sf --max-time 10 http://${PVM}:8000/version | python3 -c "import sys,json;print(json.load(sys.stdin)[\'version\'])")
+                    echo "  production expected: ${IMAGE_TAG}  |  live: ${GOT}"
+                    [ "$GOT" = "${IMAGE_TAG}" ] || { echo "PROD MISMATCH"; exit 1; }
+                    echo "  PRODUCTION VERIFIED"
                 '''
             }
         }