pipeline {
    agent any
    options {
        skipStagesAfterUnstable()
        parallelsAlwaysFailFast()
        timestamps()
        timeout(time: 180, unit: 'MINUTES')
        durabilityHint('MAX_SURVIVABILITY')
        disableConcurrentBuilds()
        quietPeriod(10)
        buildDiscarder(logRotator(
            daysToKeepStr: '5',
            numToKeepStr: '10',
            artifactDaysToKeepStr: '3',
            artifactNumToKeepStr: '3'
        ))
    }
    parameters {
        choice(name: 'BRANCH', choices: ['develop','main','release/v1.0'], description: 'Git分支')
        string(name: 'BRANCH_FREE', defaultValue: '', description: '自定义分支(覆盖上方选择,如release/v1.1)')
        choice(name: 'ENVIRONMENT', choices: ['aliyun-dev','staging','production','local-dev'], description: '部署环境')
        booleanParam(name: 'BUILD_BACKEND', defaultValue: true, description: '构建后端Java')
        booleanParam(name: 'BUILD_FRONTEND', defaultValue: false, description: '构建前端(暂未使用)')
        booleanParam(name: 'BUILD_IMAGES', defaultValue: true, description: '构建Podman镜像')
        booleanParam(name: 'PUSH_IMAGES', defaultValue: false, description: '推送镜像到私有仓')
        booleanParam(name: 'DEPLOY', defaultValue: true, description: '执行部署')
        booleanParam(name: 'USE_SHARED_LIB', defaultValue: false, description: 'Jenkins共享库(暂未配置)')
        booleanParam(name: 'SKIP_TESTS', defaultValue: true, description: '跳过Maven测试')
        booleanParam(name: 'ENABLE_SONAR', defaultValue: false, description: '启用SonarQube')
        booleanParam(name: 'DRY_RUN', defaultValue: false, description: '只构建不部署')
        booleanParam(name: 'FORCE_BUILD', defaultValue: false, description: '忽略版本号强制重构建')
        booleanParam(name: 'ENABLE_ROLLBACK', defaultValue: true, description: '部署失败自动回滚')
        booleanParam(name: 'FIRST_DEPLOY', defaultValue: false, description: '首次部署(跳过已有版本备份)')
        booleanParam(name: 'SKIP_SECURITY_CHECK', defaultValue: false, description: '跳过安全扫描(紧急修复)')
        booleanParam(name: 'SKIP_PORT_CHECK', defaultValue: false, description: '跳过端口占用检测')
        string(name: 'BASE_VERSION', defaultValue: '1.1.0', description: '版本基线(如1.1.0, 无tag时fallback至此)')
        string(name: 'COMPOSE_FILE', defaultValue: 'podman-compose.aliyun-dev.yml', description: '宿主机Compose文件')
        string(name: 'IMAGE_REGISTRY', defaultValue: '8.140.221.49:5000/fzx', description: '镜像仓库')
        string(name: 'DEPLOY_DIR', defaultValue: '/opt/fzx/deploy', description: '宿主机部署目录')
        string(name: 'SSH_USER', defaultValue: 'root', description: 'SSH用户名')
        text(name: 'DEPLOY_SERVICES_OVERRIDE', defaultValue: '', description: '指定部署服务(逗号分隔,空=全部)')
        string(name: 'DINGTALK_WEBHOOK', defaultValue: '', description: '钉钉通知')
        booleanParam(name: 'CANARY_DEPLOY', defaultValue: false, description: '启用灰度发布模式')
        string(name: 'CANARY_SERVICES', defaultValue: '', description: '灰度发布服务列表(逗号分隔)')
        string(name: 'CANARY_WEIGHT', defaultValue: '10', description: '灰度流量权重(1-99)')
    }
    triggers {
        GenericTrigger(
            genericVariables: [
                [key: 'ref', value: '$.ref'],
                [key: 'branch', value: '$.changes[0].ref.displayId', defaultValue: ''],
                [key: 'pusher', value: '$.pusher.username', defaultValue: 'codeup'],
                [key: 'commits', value: '$.total_commits_count', defaultValue: '0']
            ],
            causeString: 'Codeup推送:$ref by $pusher $commits commits',
            token: 'codeup-webhook-secret',
            printContributedVariables: false,
            printPostContent: false,
            regexpFilterText: '$ref',
            regexpFilterExpression: '^refs/heads/(develop|release/.*|main)$'
        )
    }
    environment {
        PATH = '/opt/java/openjdk/bin:/var/jenkins_home/tools/maven/apache-maven-3.9.6/bin:/usr/local/bin:/usr/bin:/bin'
        M2_HOME = '/var/jenkins_home/tools/maven/apache-maven-3.9.6'
        PYTHONUNBUFFERED = '1'
        CODEUP_WEBHOOK_TOKEN = 'fzx-platform-deploy-token'
        WORKSPACE_DIR="${WORKSPACE}"
        SSH_KEY='/var/jenkins_home/.ssh/id_rsa'
        SSH_HOST='8.140.221.49'
        COMPOSE_PATH="${WORKSPACE}/infrastructure/compose/${params.COMPOSE_FILE}"
        SCRIPTS_DIR="${WORKSPACE}/infrastructure/scripts"
        VERSION_ENV_FILE="${WORKSPACE}/.jenkins/VERSION.env"
        SECURITY_REPORT_JSON="${WORKSPACE}/target/security-report.json"
        BUILD_TIMESTAMP="${new Date().getTime()}"
        SKIP_BUILD_STAGES="${(!params.BUILD_BACKEND && !params.BUILD_FRONTEND).toString()}"
        IS_DRY_RUN="${params.DRY_RUN.toString()}"
        MAVEN_OPTS='-Xms512m -Xmx1536m -XX:MaxMetaspaceSize=384m'
        DEPLOYMENT_NAME='fzx-bdsh-stack'
        NAMESPACE='fzxbdsh-dev'
        LABEL_BUILD_TRIGGER='ci'
        LABEL_ENVIRONMENT="env-${params.ENVIRONMENT}"
        IMAGE_REGISTRY="${params.IMAGE_REGISTRY}"
        ENVIRONMENT="${params.ENVIRONMENT}"
        BASE_VERSION="${params.BASE_VERSION}"
        COMPOSE_FILE_PARAM="${params.COMPOSE_FILE}"
        DEPLOY_DIR_PARAM="${params.DEPLOY_DIR}"
        ENABLE_SONAR="${params.ENABLE_SONAR}"
        SKIP_TESTS="${params.SKIP_TESTS}"
        SKIP_SECURITY_CHECK="${params.SKIP_SECURITY_CHECK}"
        FORCE_BUILD="${params.FORCE_BUILD}"
        PUSH_IMAGES="${params.PUSH_IMAGES}"
        BUILD_IMAGES="${params.BUILD_IMAGES}"
        DEPLOY="${params.DEPLOY}"
        SKIP_IMAGE_CHECK="${params.PUSH_IMAGES == false ? 'true' : 'false'}"
        MIN_JAR_SIZE_KB='10000'
        DEPLOY_SERVICES_DEFAULT='api-gateway,auth-service,user-service,map-service,order-service,merchant-service,platform-service,product-service,rider-service,upload-service,marketing-service,search-service,sms-service'
        CANARY_DEPLOY="${params.CANARY_DEPLOY}"
        CANARY_SERVICES="${params.CANARY_SERVICES}"
        CANARY_WEIGHT="${params.CANARY_WEIGHT}"
    }

    stages {
        stage('Preflight & Checkout') {
            steps {
                echo "🚀 ========== 启动流水线 #${BUILD_NUMBER} [${params.ENVIRONMENT}] =========="
                script {
                    env.CHECKOUT_BRANCH = (params.BRANCH_FREE?.trim()) ? params.BRANCH_FREE.trim() : params.BRANCH
                    env.BRANCH_NAME = env.CHECKOUT_BRANCH
                }
                checkout(changelog: false, poll: false,
                    scm: [$class: 'GitSCM', branches: [[name: "*/${env.CHECKOUT_BRANCH}"]],
                        doGenerateSubmoduleConfigurations: false, extensions: [
                            [$class: 'CloneOption', honorRefspec: true, noTags: false, reference: '', shallow: true, depth: 30, timeout: 15],
                            [$class: 'PruneStaleBranch'],
                            [$class: 'CleanBeforeCheckout']
                        ], submoduleCfg: [],
                        userRemoteConfigs: [[refspec: '+refs/heads/develop:refs/remotes/origin/develop +refs/heads/main:refs/remotes/origin/main +refs/heads/release/*:refs/remotes/origin/release/* +refs/pull-requests/*/from:refs/remotes/origin/pr/* +refs/tags/*:refs/tags/*',
                            url: 'git@codeup.aliyun.com:69c68bacfa2a62bc85952a67/FzxBdsh.git']]
                    ])
                echo "✅ Git分支checkout完成：${env.CHECKOUT_BRANCH}"
            }
        }

        stage('宿主机环境预检') {
            when { expression { params.DEPLOY && !params.DRY_RUN } }
            steps {
                echo "🛡️ 宿主机环境预检 - 校验SSH连接、Python3、cryptography依赖"
                script {
                    def sshCmd = "ssh -i ${env.SSH_KEY} -o StrictHostKeyChecking=no -o ConnectTimeout=10 ${params.SSH_USER}@${env.SSH_HOST}"
                    
                    echo "  1. 校验SSH连通性..."
                    def sshResult = sh(script: "${sshCmd} 'echo SSH_OK'", returnStatus: true)
                    if (sshResult != 0) {
                        error("❌ SSH连接失败，请检查密钥和网络配置")
                    }
                    echo "     ✅ SSH连通正常"
                    
                    echo "  2. 校验Python3可用性..."
                    def pythonResult = sh(script: "${sshCmd} 'python3 --version'", returnStatus: true)
                    if (pythonResult != 0) {
                        error("❌ 宿主机未安装Python3，请执行基础设施初始化脚本")
                    }
                    echo "     ✅ Python3可用"
                    
                    echo "  3. 校验cryptography库(宿主机)..."
                    def cryptoResult = sh(script: "${sshCmd} 'python3 -c \"from cryptography.hazmat.primitives.ciphers import Cipher, algorithms, modes; print(\\\"CRYPTO_OK\\\")\"'", returnStatus: true)
                    if (cryptoResult != 0) {
                        error("❌ 宿主机缺少cryptography库，请执行: python3 -m pip install cryptography")
                    }
                    echo "     ✅ cryptography库可用"
                    
                    echo "  4. 校验podman..."
                    def podmanResult = sh(script: "${sshCmd} 'podman --version'", returnStatus: true)
                    if (podmanResult != 0) {
                        echo "     ⚠️ podman未安装或不可用"
                    } else {
                        echo "     ✅ podman可用"
                    }
                    
                    echo "  5. 校验Jenkins容器cryptography依赖..."
                    def jenkinsCryptoResult = sh(script: "python3 -c \"from cryptography.hazmat.primitives.ciphers import Cipher; print('JENKINS_CRYPTO_OK')\"", returnStatus: true)
                    if (jenkinsCryptoResult != 0) {
                        error("❌ Jenkins容器缺少cryptography库，请在宿主机执行: podman exec -u root fzx-aliyun-jenkins pip3 install cryptography --break-system-packages")
                    }
                    echo "     ✅ Jenkins容器cryptography库可用"
                    
                    echo "✅ 宿主机环境预检通过"
                }
            }
        }

        stage('版本生成') {
            steps {
                withEnv(["WORKSPACE=${env.WORKSPACE}","BRANCH_NAME=${env.BRANCH_NAME}","BRANCH=${env.CHECKOUT_BRANCH}",
                         "BUILD_NUMBER=${env.BUILD_NUMBER}","ENVIRONMENT=${env.ENVIRONMENT}",
                         "BUILD_TIMESTAMP=${env.BUILD_TIMESTAMP}","VERSION_ENV_FILE=${env.VERSION_ENV_FILE}"]) {
                    sh "cd \"${WORKSPACE}\" && python3 -u \"${WORKSPACE}/infrastructure/scripts/pipeline-engine.py\" --stage version-gen"
                    loadVersionEnv()
                }
            }
        }

        stage('安全扫描') {
            when { expression { !params.SKIP_SECURITY_CHECK } }
            steps {
                withEnv(["WORKSPACE=${env.WORKSPACE}","MIN_JAR_SIZE_KB=${env.MIN_JAR_SIZE_KB}",
                         "SECURITY_REPORT_JSON=${env.SECURITY_REPORT_JSON}"]) {
                    sh "cd \"${WORKSPACE}\" && python3 -u \"${WORKSPACE}/infrastructure/scripts/pipeline-engine.py\" --stage security-check"
                }
            }
        }

        stage('Maven构建') {
            when { expression { params.BUILD_BACKEND && env.SKIP_BUILD_STAGES != 'true' } }
            steps {
                withEnv(["WORKSPACE=${env.WORKSPACE}","M2_HOME=${env.M2_HOME}",
                         "SKIP_TESTS=${params.SKIP_TESTS}","ENABLE_SONAR=${params.ENABLE_SONAR}",
                         "MAVEN_THREADS=3","MAVEN_OPTS=${env.MAVEN_OPTS}"]) {
                    sh "cd \"${WORKSPACE}\" && python3 -u \"${WORKSPACE}/infrastructure/scripts/pipeline-engine.py\" --stage maven-build"
                }
            }
        }

        stage('Pre-Deploy Gate') {
            when { expression { params.DEPLOY && !params.DRY_RUN && env.SKIP_BUILD_STAGES != 'true' } }
            steps {
                echo "🛡️ 大厂标准：部署前4层防呆校验"
                script {
                    env.DEPLOY_SERVICES = params.DEPLOY_SERVICES_OVERRIDE?.trim() ?
                        params.DEPLOY_SERVICES_OVERRIDE : env.DEPLOY_SERVICES_DEFAULT
                }
                withEnv(["WORKSPACE=${env.WORKSPACE}","MIN_JAR_SIZE_KB=${env.MIN_JAR_SIZE_KB}",
                         "BUILD_RESULT=${currentBuild.result ?: 'SUCCESS'}",
                         "IMAGE_REGISTRY=${env.IMAGE_REGISTRY}","VERSION=${env.VERSION}","FULL_VERSION=${env.FULL_VERSION}","OCI_TAG=${env.OCI_TAG}",
                         "COMMIT_HASH=${env.COMMIT_HASH}","BRANCH_NAME=${env.BRANCH_NAME}",
                         "SKIP_IMAGE_CHECK=${env.SKIP_IMAGE_CHECK}","PUSH_IMAGES=${params.PUSH_IMAGES}",
                         "DEPLOY_SERVICES=${env.DEPLOY_SERVICES}","DEPLOY_SERVICES_DEFAULT=${env.DEPLOY_SERVICES_DEFAULT}"]) {
                    sh "cd \"${WORKSPACE}\" && python3 -u \"${WORKSPACE}/infrastructure/scripts/pipeline-engine.py\" --stage predeploy-gate"
                }
            }
        }

        stage('磁盘空间预检') {
            when { expression { params.BUILD_IMAGES && env.SKIP_BUILD_STAGES != 'true' } }
            steps {
                echo "💾 磁盘空间预检：检测宿主机磁盘空间，当使用率超过阈值时自动清理冗余数据"
                withEnv(["WORKSPACE=${env.WORKSPACE}","DISK_USAGE_THRESHOLD=${env.DISK_USAGE_THRESHOLD ?: '80'}",
                         "DISK_WARNING_THRESHOLD=${env.DISK_WARNING_THRESHOLD ?: '70'}",
                         "DISK_MIN_FREE_GB=${env.DISK_MIN_FREE_GB ?: '10'}"]) {
                    sh "cd \"${WORKSPACE}\" && python3 -u \"${WORKSPACE}/infrastructure/scripts/pipeline-engine.py\" --stage disk-space-check"
                }
            }
        }

        stage('构建镜像') {
            when { expression { params.BUILD_IMAGES && env.SKIP_BUILD_STAGES != 'true' } }
            steps {
                script {
                    env.DEPLOY_SERVICES = params.DEPLOY_SERVICES_OVERRIDE?.trim() ?
                        params.DEPLOY_SERVICES_OVERRIDE : env.DEPLOY_SERVICES_DEFAULT
                }
                withEnv(["WORKSPACE=${env.WORKSPACE}","JOB_NAME=${env.JOB_NAME}","IMAGE_REGISTRY=${env.IMAGE_REGISTRY}",
                         "ENVIRONMENT=${env.ENVIRONMENT}","VERSION=${env.VERSION}",
                         "FULL_VERSION=${env.FULL_VERSION}","OCI_TAG=${env.OCI_TAG}","COMMIT_HASH=${env.COMMIT_HASH}",
                         "DEPLOY_SERVICES=${env.DEPLOY_SERVICES}","DEPLOY_SERVICES_DEFAULT=${env.DEPLOY_SERVICES_DEFAULT}",
                         "HOST_WORKSPACE=${env.WORKSPACE}"]) {
                    sh "cd \"${WORKSPACE}\" && python3 -u \"${WORKSPACE}/infrastructure/scripts/pipeline-engine.py\" --stage build-images"
                }
            }
        }

        stage('加密验证') {
            when {
                allOf {
                    expression { params.DEPLOY && !params.DRY_RUN }
                    expression { (currentBuild.result ?: 'SUCCESS') == 'SUCCESS' }
                }
            }
            steps {
                withCredentials([
                    string(credentialsId: 'env-encrypt-key', variable: 'ENV_ENCRYPT_KEY_ENV', defaultValue: '')
                ]) {
                    withEnv([
                        'COMPOSE_FILE=' + params.COMPOSE_FILE,
                        'ENV_ENCRYPT_KEY=' + (env.ENV_ENCRYPT_KEY_ENV ?: ''),
                        'WORKSPACE=' + env.WORKSPACE
                    ]) {
                        sh '''cd "$WORKSPACE" && python3 -u "$WORKSPACE/infrastructure/scripts/pipeline-engine.py" --stage encrypt-verify'''
                    }
                }
            }
        }

        stage('部署到阿里云开发环境') {
            when {
                allOf {
                    expression { params.DEPLOY && !params.DRY_RUN }
                    expression { (currentBuild.result ?: 'SUCCESS') == 'SUCCESS' }
                    expression { env.SKIP_BUILD_STAGES != 'true' || params.FORCE_BUILD }
                }
            }
            steps {
                script {
                    env.DEPLOYED_VERSION = env.OCI_TAG ?: (env.VERSION ?: 'latest').replace('+','_').replace('/','_')
                }
                withCredentials([
                    string(credentialsId: 'env-encrypt-key', variable: 'ENV_ENCRYPT_KEY_ENV', defaultValue: '')
                ]) {
                    withEnv([
                        'WORKSPACE=' + env.WORKSPACE,
                        'COMPOSE_FILE=' + params.COMPOSE_FILE, 'DEPLOY_DIR=' + params.DEPLOY_DIR,
                        'ENABLE_ROLLBACK=' + params.ENABLE_ROLLBACK.toString(), 'FIRST_DEPLOY=' + params.FIRST_DEPLOY.toString(),
                        'DEPLOY_SERVICES=' + (params.DEPLOY_SERVICES_OVERRIDE?.trim() ? params.DEPLOY_SERVICES_OVERRIDE : env.DEPLOY_SERVICES_DEFAULT),
                        'VERSION=' + env.VERSION, 'OCI_TAG=' + env.OCI_TAG, 'IMAGE_REGISTRY=' + env.IMAGE_REGISTRY, 'ENVIRONMENT=' + env.ENVIRONMENT,
                        'ENV_ENCRYPT_KEY=' + (env.ENV_ENCRYPT_KEY_ENV ?: ''),
                        'SKIP_REGISTRY_LOGIN=' + (env.SKIP_REGISTRY_LOGIN ?: '0'),
                        'SKIP_PORT_CHECK=' + (params.SKIP_PORT_CHECK ?: '0')
                    ]) {
                        sh '''cd "$WORKSPACE" && python3 -u "$WORKSPACE/infrastructure/scripts/pipeline-engine.py" --stage deploy'''
                    }
                }
            }
        }

        stage('健康检查') {
            when {
                allOf {
                    expression { params.DEPLOY && !params.DRY_RUN }
                    expression { (currentBuild.result ?: 'SUCCESS') == 'SUCCESS' }
                }
            }
            steps {
                withEnv(['WORKSPACE=' + env.WORKSPACE,'COMPOSE_FILE=' + params.COMPOSE_FILE,'DEPLOY_DIR=' + params.DEPLOY_DIR,
                         'ENABLE_ROLLBACK=' + params.ENABLE_ROLLBACK,
                         'DEPLOYED_VERSION=' + env.DEPLOYED_VERSION,'OCI_TAG=' + env.OCI_TAG,'VERSION=' + env.VERSION]) {
                    sh "cd \"${WORKSPACE}\" && python3 -u \"${WORKSPACE}/infrastructure/scripts/pipeline-engine.py\" --stage health-check"
                }
            }
        }

        stage('灰度发布') {
            when {
                allOf {
                    expression { params.CANARY_DEPLOY && params.DEPLOY && !params.DRY_RUN }
                    expression { (currentBuild.result ?: 'SUCCESS') == 'SUCCESS' }
                    expression { params.CANARY_SERVICES?.trim() }
                }
            }
            steps {
                echo "🚀 开始灰度发布"
                echo "=" * 60
                echo "   灰度服务: ${params.CANARY_SERVICES}"
                echo "   流量权重: ${params.CANARY_WEIGHT}%"
                echo "=" * 60

                withCredentials([string(credentialsId: 'env-encrypt-key', variable: 'ENV_ENCRYPT_KEY_ENV')]) {
                    withEnv([
                        'WORKSPACE=' + env.WORKSPACE,
                        'COMPOSE_FILE=' + params.COMPOSE_FILE,
                        'DEPLOY_DIR=' + params.DEPLOY_DIR,
                        'CANARY_SERVICES=' + params.CANARY_SERVICES,
                        'CANARY_WEIGHT=' + params.CANARY_WEIGHT,
                        'VERSION=' + env.VERSION,
                        'OCI_TAG=' + env.OCI_TAG,
                        'IMAGE_REGISTRY=' + env.IMAGE_REGISTRY,
                        'ENVIRONMENT=' + env.ENVIRONMENT,
                        'ENV_ENCRYPT_KEY=' + env.ENV_ENCRYPT_KEY_ENV
                    ]) {
                        sh '''cd "$WORKSPACE" && python3 -u "$WORKSPACE/infrastructure/scripts/pipeline-engine.py" --stage canary-deploy'''
                    }
                }
            }
        }
    }

    post {
        always {
            echo "🧹 后处理：保留构建记录，后续构建自动执行CleanBeforeCheckout清理"
        }
        success {
            script {
                node() {
                    withEnv(['BUILD_DURATION=' + currentBuild.durationString.replace(' and counting', ''),
                             'BUILD_NUMBER=' + env.BUILD_NUMBER,'VERSION=' + (env.VERSION?:''),
                             'BUILD_USER_ID=' + (env.BUILD_USER_ID?:'自动化'),
                             'ENVIRONMENT=' + env.ENVIRONMENT,
                             'DINGTALK_WEBHOOK=' + params.DINGTALK_WEBHOOK,
                             'WORKSPACE=' + env.WORKSPACE]) {
                        sh "cd \"${env.WORKSPACE}\" && python3 -u \"${env.WORKSPACE}/infrastructure/scripts/pipeline-engine.py\" --stage notify-success || true"
                    }
                }
            }
            emailext(
                subject: "✅ [构建成功] FZX Platform 构建 #${BUILD_NUMBER} (${params.ENVIRONMENT})",
                body: """
📋 构建信息：
项目: FZX Platform
构建号: #${BUILD_NUMBER}
分支: ${env.CHECKOUT_BRANCH}
环境: ${params.ENVIRONMENT}
版本: ${env.VERSION?:''}
耗时: ${currentBuild.durationString.replace(' and counting', '')}
触发者: ${env.BUILD_USER_ID?:'自动化'}

✅ 构建结果：成功

📌 变更内容：
${currentBuild.changeSets.collect { cs ->
    cs.items.collect { item ->
        "  - ${item.author}: ${item.msg}"
    }.join('\n')
}.join('\n')}
                """,
                to: 'dev@fengzhongxing.com',
                from: 'jenkins@fengzhongxing.com',
                replyTo: 'dev@fengzhongxing.com',
                recipientProviders: [[$class: 'DevelopersRecipientProvider'], [$class: 'RequesterRecipientProvider']]
            )
        }
        unstable {
            script {
                node() {
                    echo "⚠️ 流水线UNSTABLE，检查报告"
                    archiveArtifacts artifacts: '**/target/site/**,target/*.json', allowEmptyArchive: true, onlyIfSuccessful: false
                }
            }
        }
        failure {
            script {
                node() {
                    echo "🚨 流水线失败，执行构建产物清理..."
                    
                    def isDeployStage = false
                    try {
                        def failedStageNames = currentBuild.stageStatuses.findAll { it.status == 'FAILED' }*.name
                        isDeployStage = failedStageNames.any { it.contains('部署') || it.contains('deploy') || it.contains('Deploy') }
                    } catch (Exception e) {
                        echo "⚠️ 无法检测失败阶段，使用默认值: ${e.getMessage()}"
                    }
                    
                    echo "🚨 失败阶段检测: ${isDeployStage ? '部署阶段' : '构建阶段'}"
                    
                    withEnv(['BUILD_DURATION=' + currentBuild.durationString.replace(' and counting', ''),
                             'BUILD_NUMBER=' + env.BUILD_NUMBER,'VERSION=' + (env.VERSION?:'未知'),
                             'BUILD_USER_ID=' + (env.BUILD_USER_ID?:'自动化'),
                             'ENVIRONMENT=' + env.ENVIRONMENT,
                             'DINGTALK_WEBHOOK=' + params.DINGTALK_WEBHOOK,
                             'ENABLE_ROLLBACK=' + params.ENABLE_ROLLBACK,
                             'DEPLOYED_VERSION=' + (env.DEPLOYED_VERSION?:''),
                             'SCRIPTS_DIR=' + env.SCRIPTS_DIR,
                             'WORKSPACE=' + env.WORKSPACE,
                             'IMAGE_REGISTRY=' + env.IMAGE_REGISTRY,
                             'OCI_TAG=' + (env.OCI_TAG?:''),
                             'FULL_VERSION=' + (env.FULL_VERSION?:''),
                             'IMAGES_KEEP_VERSIONS=3']) {
                        
                        if (isDeployStage) {
                            echo "🧹 执行部署失败清理（清理旧版本业务镜像，保留最近3个版本用于回滚）"
                            sh "cd \"${env.WORKSPACE}\" && python3 -u \"${env.WORKSPACE}/infrastructure/scripts/pipeline-engine.py\" --stage cleanup-deploy-failure || true"
                        } else {
                            echo "🧹 执行构建失败清理（清理临时产物和dangling镜像）"
                            sh "cd \"${env.WORKSPACE}\" && python3 -u \"${env.WORKSPACE}/infrastructure/scripts/pipeline-engine.py\" --stage cleanup-build-failure || true"
                        }
                        
                        sh "cd \"${env.WORKSPACE}\" && python3 -u \"${env.WORKSPACE}/infrastructure/scripts/pipeline-engine.py\" --stage notify-failure || true"
                    }
                }
            }
            emailext(
                subject: "🚨 [构建失败] FZX Platform 构建 #${BUILD_NUMBER} (${params.ENVIRONMENT})",
                body: """
📋 构建信息：
项目: FZX Platform
构建号: #${BUILD_NUMBER}
分支: ${env.CHECKOUT_BRANCH}
环境: ${params.ENVIRONMENT}
版本: ${env.VERSION?:''}
耗时: ${currentBuild.durationString.replace(' and counting', '')}
触发者: ${env.BUILD_USER_ID?:'自动化'}

🚨 构建结果：失败

❌ 失败阶段：
${currentBuild.stageStatuses.findAll { it.status == 'FAILED' }*.name.join('\n')}

📌 变更内容：
${currentBuild.changeSets.collect { cs ->
    cs.items.collect { item ->
        "  - ${item.author}: ${item.msg}"
    }.join('\n')
}.join('\n')}
                """,
                to: 'dev@fengzhongxing.com',
                from: 'jenkins@fengzhongxing.com',
                replyTo: 'dev@fengzhongxing.com',
                recipientProviders: [[$class: 'DevelopersRecipientProvider'], [$class: 'RequesterRecipientProvider']]
            )
        }
    }
}

def getSshPrefix(env_obj) {
    def k = (env_obj?.SSH_KEY) ?: env?.SSH_KEY ?: '/var/jenkins_home/.ssh/id_rsa'
    def u = (env_obj?.SSH_USER) ?: env?.SSH_USER ?: 'root'
    def h = (env_obj?.SSH_HOST) ?: env?.SSH_HOST ?: '8.140.221.49'
    return "ssh -i ${k} -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -o ConnectTimeout=10 -o BatchMode=yes ${u}@${h}"
}

def loadVersionEnv() {
    def f = "${env.VERSION_ENV_FILE}"
    if (!fileExists(f)) {
        error("❌ version.env文件不存在:${f} - 版本生成阶段失败")
    }
    def lines = readFile(f).readLines()
    for (l in lines) {
        if (!l || l.startsWith('#') || !l.contains('=')) continue
        def parts = l.split('=', 2).toList()
        if (parts.size() >= 2 && parts[0] && parts[1]) { env."${parts[0]}" = parts[1] }
    }
    echo "✅ 加载VERSION: ${env.VERSION} | COMMIT=${env.COMMIT_HASH} | BRANCH=${env.BRANCH_NAME}"
}
