# template.yaml — golden path completo
apiVersion: scaffolder.backstage.io/v1beta3
kind: Template
metadata:
  name: golden-path-service
  title: Crear un nuevo servicio (golden path)
  description: |
    Provisiona un servicio completo: repo + CI + catalog + namespace + docs.
    Para equipos que siguen las prácticas de platform engineering.
  tags:
    - recommended
    - production-ready
spec:
  owner: platform/team-x
  type: service

  parameters:
    - title: Información básica
      required:
        - name
        - owner
        - repoUrl
      properties:
        name:
          title: Nombre del servicio
          type: string
          description: |
            kebab-case, sin prefijos del equipo. Ej: payments-svc.
          ui:field: EntityNamePicker
          ui:options:
            # Validar formato
            pattern: '^[a-z][a-z0-9-]{2,40}$'
        description:
          title: Descripción
          type: string
          ui:autofocus: true
        owner:
          title: Equipo owner
          type: string
          ui:field: OwnerPicker
          ui:options:
            catalogFilter:
              kind: Group
        repoUrl:
          title: Repositorio de GitHub
          type: string
          ui:field: RepoUrlPicker
          ui:options:
            allowedHosts:
              - github.com

    - title: Stack técnico
      properties:
        language:
          title: Lenguaje
          type: string
          enum:
            - typescript
            - python
            - go
            - rust
          default: typescript
        database:
          title: Base de datos
          type: string
          enum:
            - postgres
            - mongodb
            - none
          default: postgres
        observability:
          title: Stack de observabilidad
          type: string
          enum:
            - datadog
            - grafana-stack
          default: datadog

    - title: Producción
      required:
        - tier
      properties:
        tier:
          title: Tier del servicio
          type: string
          enum:
            - tier-1  # crítico
            - tier-2  # importante
            - tier-3  # desarrollo
          default: tier-2
        region:
          title: Región de despliegue
          type: string
          enum:
            - eu-west-1
            - us-east-1
            - ap-southeast-1
          default: eu-west-1

  steps:
    # 1. Crear repo
    - id: create-repo
      name: Crear repositorio en GitHub
      action: publish:github
      input:
        repoUrl: ${{ parameters.repoUrl }}
        description: ${{ parameters.description }}
        defaultBranch: main
        repoVisibility: private
        allowAutoMerge: true
        deleteBranchOnMerge: true

    # 2. Esperar a que GitHub cree el repo
    - id: wait
      name: Esperar disponibilidad del repo
      action: catalog:wait
      input:
        repoUrl: ${{ parameters.repoUrl }}
        timeout: 60

    # 3. Push skeleton con código
    - id: push-skeleton
      name: Copiar skeleton al repo
      action: fetch:template
      input:
        url: ./skeleton
        targetPath: ./
        values:
          name: ${{ parameters.name }}
          language: ${{ parameters.language }}
          description: ${{ parameters.description }}
          owner: ${{ parameters.owner }}
          tier: ${{ parameters.tier }}
          region: ${{ parameters.region }}

    # 4. Crear catalog entity
    - id: register-catalog
      name: Registrar en Backstage Catalog
      action: catalog:register
      input:
        repoContentsUrl: ${{ steps.create-repo.output.repoContentsUrl }}
        catalogInfoPath: /catalog-info.yaml

    # 5. Crear namespace de Kubernetes (solo tier 1-2)
    - id: create-namespace
      name: Crear namespace de Kubernetes
      if: ${{ parameters.tier != 'tier-3' }}
      action: kubernetes:apply-yaml
      input:
        manifest: |
          apiVersion: v1
          kind: Namespace
          metadata:
            name: ${{ parameters.name }}
            labels:
              tier: ${{ parameters.tier }}
              team: ${{ parameters.owner }}
              managed-by: backstage
          ---
          apiVersion: v1
          kind: ResourceQuota
          metadata:
            name: default
            namespace: ${{ parameters.name }}
          spec:
            hard:
              requests.cpu: "${{ parameters.tier == 'tier-1' && '4' || '1' }}"
              requests.memory: "${{ parameters.tier == 'tier-1' && '8Gi' || '2Gi' }}"
              pods: "10"

    # 6. Provisionar secrets
    - id: provision-secrets
      name: Provisionar secretos en Vault
      action: vault:write
      input:
        path: secret/data/services/${{ parameters.name }}
        data:
          # Short-lived tokens de CI
          ci_token: ${{ secrets.GITHUB_DEPLOY_TOKEN }}

    # 7. Notificar al equipo
    - id: notify
      name: Notificar al equipo en Slack
      action: slack:notify
      input:
        channel: '#platform-deploys'
        text: |
          :rocket: Nuevo servicio creado
          *Nombre*: ${{ parameters.name }}
          *Owner*: ${{ parameters.owner }}
          *Tier*: ${{ parameters.tier }}
          *Catalog*: https://backstage.internal/catalog/default/component/${{ parameters.name }}

  output:
    links:
      - title: Open GitHub Repo
        url: ${{ steps.create-repo.output.remoteUrl }}
      - title: Open in Backstage
        url: https://backstage.internal/catalog/default/component/${{ parameters.name }}
      - title: Open Kubernetes Namespace
        url: https://k8s.internal/namespaces/${{ parameters.name }}

# Ejecutar solo si se eligió Datadog
- id: setup-datadog
  if: ${{ parameters.observability == 'datadog' }}
  action: datadog:create-dashboard
  input: ...

# Ejecutar solo si la región es Europa
- id: gdpr-compliance
  if: ${{ parameters.region == 'eu-west-1' }}
  action: compliance:gdpr-setup
  input: ...

# Ejecutar solo para tier 1
- id: oncall-rotation
  if: ${{ parameters.tier == 'tier-1' }}
  action: pagerduty:create-rotation
  input: ...

# Dry-run desde la CLI
curl -X POST http://localhost:7007/api/scaffolder/v2/dry-run \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer $TOKEN" \
  -d '{
    "templateRef": "golden-path-service",
    "values": {
      "name": "test-service",
      "owner": "team-payments",
      "language": "typescript"
    }
  }'

// Capturar todos los task.completed del scaffolder
const eventStream = events.subscribe({
  topic: 'scaffolder.task.completed',
  handler: async (event) => {
    await metrics.increment('scaffolder.task.completed', {
      tags: {
        template: event.task.spec.templateInfo.entity.metadata.name,
        success: event.task.status === 'completed',
        duration_seconds: event.task.completedAt - event.task.createdAt,
      },
    });
  },
});

# .github/workflows/test-template.yml
name: Test templates
on:
  pull_request:
    paths:
      - 'templates/**'
jobs:
  test:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - name: Set up Backstage CLI
        run: npm install -g @backstage/cli
      - name: Lint template
        run: |
          for f in templates/**/template.yaml; do
            backstage-cli repo lint --filename "$f"
          done
      - name: Validate YAML
        run: |
          for f in templates/**/template.yaml; do
            yq '.' "$f" > /dev/null
          done
      - name: Dry-run test
        run: |
          # Verificar que el dry-run no falla
          backstage-cli scaffolder dry-run \
            --template ./templates/golden-path-service/template.yaml \
            --values '{"name": "test-svc", "owner": "team-x", "language": "typescript"}'