stages: [validate, security, image, plan, change, apply, drift]

.plan:
  # ... bisheriger Inhalt, am Ende des script-Blocks ergänzen:
  script:
    - *tf_init
    - terraform plan -lock=false -out=tfplan
    - terraform show -no-color tfplan > plan.txt
    - terraform show -json tfplan > plan-full.json
    - python3 ../ci/classify_change.py plan-full.json "$STACK"
    # ... jq-Zusammenfassung für das MR-Widget wie bisher
  artifacts:
    paths: ["$STACK/tfplan", "$STACK/plan.txt", "$STACK/change-record.md"]
    reports:
      terraform: "$STACK/plan.json"
      dotenv: "$STACK/change.env"
    expire_in: 1 week

change:gate:
  stage: change
  needs: ["plan:base", "plan:workload"]
  script:
    - echo "Change-Typ base=$CHANGE_TYPE_BASE workload=$CHANGE_TYPE_WORKLOAD"
    - |
      if [ "$CHANGE_TYPE_BASE" = "normal" ] || [ "$CHANGE_TYPE_WORKLOAD" = "normal" ]; then
        case ",$CI_MERGE_REQUEST_LABELS," in
          *,change-approved,*)
            echo "Normal Change: Genehmigung liegt vor." ;;
          *)
            echo "Normal Change: Label 'change-approved' fehlt – Genehmigung erforderlich."
            exit 1 ;;
        esac
      else
        echo "Standard Change: MR-Freigabe genügt."
      fi
  rules:
    - if: $CI_PIPELINE_SOURCE == "merge_request_event"