# modules/iam_roles/main.tf

# Example definition for the role attached to the EC2 instances hosting the runners.
# If using EKS/IRSA, the trust policy (assume_role_policy) would reference the EKS OIDC provider instead.
resource "aws_iam_role" "gitlab_runner_instance_role" {
  name = "GitLabRunnerInstanceRole"

  # Trust Policy: Allows assumption by the EC2 service principal
  assume_role_policy = jsonencode({
    Version = "2012-10-17",
    Statement = [
      {
        Effect    = "Allow",
        Principal = { Service = "ec2.amazonaws.com" },
        Action    = "sts:AssumeRole"
      }
    ]
  })
}

# The Instance Profile attaches the role to the EC2 instances
resource "aws_iam_instance_profile" "gitlab_runner_profile" {
  name = "GitLabRunnerInstanceProfile"
  role = aws_iam_role.gitlab_runner_instance_role.name
}

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": "bedrock:InvokeAgent",
            // The Resource ARN must be updated with the actual Agent Alias ARN after creation.
            "Resource": "arn:aws:bedrock:REGION:ACCOUNT_ID:agent-alias/AGENT_ID/ALIAS_ID"
        }
        // Other baseline runner permissions (ECR, CloudWatch, etc.) would also be included here.
    ]
}

# templates/bedrock-debugger.yml
spec:
  inputs:
    bedrock_agent_id:
      description: "The ID of the Amazon Bedrock agent to invoke for debugging."
      type: string
    bedrock_agent_alias_id:
      description: "The ID of the Bedrock agent alias to use."
      type: string
      default: "TSTALIASID"
    aws_region:
      description: "The AWS region where the Bedrock agent is deployed."
      type: string
    # A token is required to post the analysis back to GitLab.
    # It must be provided by the consuming project as a masked variable.
    gitlab_api_token:
       description: "GitLab API Token with 'api' scope to post results."
       type: string
---
# Job definition follows...

# templates/bedrock-debugger.yml (continued)
bedrock_debugger:
  stage: .post
  # We use a base image that includes awscli, jq (for parsing the response), and curl (for GitLab API).
  # The GitLab aws-base image is suitable.
  image:
    name: registry.gitlab.com/gitlab-org/cloud-deploy/aws-base:latest
    entrypoint: ["/bin/bash", "-c"]
  rules:
    # Only run this job if a previous job in the pipeline has failed
    - when: on_failure
  # The id_tokens block used for OIDC is no longer required.
  script:
    # Script to invoke agent and process response (details in 2.3)

# Part of the 'script:' block in bedrock_debugger job
set -e # Exit immediately if a command fails
echo "Configuring AWS environment..."

# Set the region for the AWS CLI based on the component input.
export AWS_DEFAULT_REGION="$[[ inputs.aws_region ]]"
export AWS_REGION="$[[ inputs.aws_region ]]"

# Verify the identity being used (should be the Runner Instance Role).
# This confirms the runner is correctly configured and authentication is working.
echo "Verifying AWS Caller Identity..."
aws sts get-caller-identity

# In gitlab-interaction-service/handler.py
import gitlab
# Assume 'gl' is the initialized GitLab client

def get_job_logs(gl, project_id, job_id):
    """Fetches the raw log for a specific GitLab job."""
    try:
        project = gl.projects.get(project_id)
        job = project.jobs.get(job_id)
        # The trace() method returns the log as bytes, which must be decoded.
        return job.trace().decode('utf-8')
    except gitlab.exceptions.GitlabError as e:
        # Return the error message so the agent can reason about the failure
        return f"Error fetching GitLab job log: {e.error_message}"

# In gitlab-interaction-service/handler.py
import base64

def get_file_content(gl, project_id, file_path, commit_sha):
    """Reads a file from the repository at a specific commit."""
    try:
        project = gl.projects.get(project_id)
        # The 'ref' parameter specifies the commit SHA
        f = project.files.get(file_path=file_path, ref=commit_sha)
        # Content is Base64 encoded by the API, so it must be decoded
        return base64.b64decode(f.content).decode('utf-8')
    except gitlab.exceptions.GitlabError as e:
        return f"Error reading repository file {file_path} at commit {commit_sha}: {e.error_message}"

# In gitlab-interaction-service/handler.py
def create_remediation_mr(gl, project_id, source_branch, new_branch_name, commit_message, file_path, new_content, mr_title, assignee_email):
    """Orchestrates creating a branch, committing a fix, and opening an MR."""
    try:
        project = gl.projects.get(project_id)

        # 1. Create a new branch from the source branch
        project.branches.create({'branch': new_branch_name, 'ref': source_branch})

        # 2. Create a commit with the updated file on the new branch
        commit_data = {
            'branch': new_branch_name,
            'commit_message': commit_message,
            'actions': [
                {
                    'action': 'update', # Assuming the file exists; use 'create' if new
                    'file_path': file_path,
                    'content': new_content
                }
            ]
        }
        project.commits.create(commit_data)

        # 3. Attempt to find the user ID for assignment
        assignee_id = None
        if assignee_email:
            # Use search as exact email lookup might be restricted by user privacy settings
            users = gl.users.list(search=assignee_email)
            if users:
                assignee_id = users[0].id

        # 4. Create the Merge Request
        mr_data = {
            'source_branch': new_branch_name,
            'target_branch': source_branch,
            'title': mr_title,
            'description': f"Automated fix proposed by Bedrock CI/CD Analyst.\n\nDetails: {commit_message}",
            'remove_source_branch': True
        }
        if assignee_id:
            mr_data['assignee_id'] = assignee_id

        mr = project.mergerequests.create(mr_data)
        return {"status": "success", "mr_url": mr.web_url}

    except gitlab.exceptions.GitlabError as e:
        return {"status": "error", "message": str(e)}