#!/usr/bin/env bash
#
# ci-publish.sh — publish one target from a Woodpecker step in .woodpecker/release.yaml.
#
# Usage:
#   ./scripts/ci-publish.sh windows|rpm|deb|fdroid
#
# Does what a fresh container lacks and a dev machine already has, then runs that
# target's publish script. The repos and keys are the same directories a dev
# machine publishes to, mounted at the same path, so either can publish next.
#
# Environment:
#   MTGC_RELEASE_DIR  the mounted release directory (default /nfs/hal9000/mtgc)
#   MTGC_CI_CACHE     the build cache volume (default /cache)
#
set -euo pipefail

usage() {
    sed -n '3,14p' "$0" | sed 's/^# \{0,1\}//'
    exit "${1:-0}"
}

info() { printf '\033[1;34m==>\033[0m %s\n' "$*"; }
err()  { printf '\033[1;31m[err]\033[0m %s\n' "$*" >&2; }

RELEASE_DIR="${MTGC_RELEASE_DIR:-/nfs/hal9000/mtgc}"
CACHE="${MTGC_CI_CACHE:-/cache}"

[ $# -eq 1 ] || usage 1
case "$1" in
    windows) subdir=win ;;
    rpm) subdir=rpm ;;
    deb) subdir=deb ;;
    fdroid) subdir=repo ;;
    -h | --help) usage ;;
    *) usage 1 ;;
esac
target="$1"

repo_root="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
cd "$repo_root"

# --- 1. Checks --------------------------------------------------------------
#
# The version is the commit count, so a shallow clone would call this release
# 0.1.1. The publish script would refuse that, but not with a helpful message.

if [ "$(git rev-parse --is-shallow-repository)" != false ]; then
    err "this is a shallow clone; the commit count needs the full history"
    exit 1
fi

# --- 2. Build directories ---------------------------------------------------
#
# The publish scripts name target/ directly, so link it rather than setting
# CARGO_TARGET_DIR. It lives on the cache volume, which outlasts the pipeline
# and has the room: the workspace volume is 10G.

mkdir -p "$CACHE/target" "$HOME"
ln -sfn "$CACHE/target" target

cargo fetch --locked
if [ ! -d node_modules ]; then
    npm ci
fi

# --- 3. Keys ----------------------------------------------------------------
#
# gpg wants its home to be private, and the agent wants a socket there; neither
# works on the NFS copy. /tmp goes away with the step's pod.

case "$target" in
    rpm | deb)
        gnupg="$(mktemp -d)"
        cp -r "$RELEASE_DIR/keys/gnupg/." "$gnupg/"
        chmod -R go-rwx "$gnupg"
        export MTGC_RPM_GNUPGHOME="$gnupg" MTGC_DEB_GNUPGHOME="$gnupg"
        ;;
    fdroid)
        source scripts/android-env.sh >/dev/null
        android="src-tauri/gen/android"
        # RustPlugin reads the SDK and NDK from here; a clone doesn't have it.
        printf 'sdk.dir=%s\nndk.dir=%s\n' "$ANDROID_HOME" "$NDK_HOME" >"$android/local.properties"
        (
            umask 077
            sed "s|^storeFile=.*|storeFile=$RELEASE_DIR/keys/android-release.jks|" \
                "$RELEASE_DIR/keys/keystore.properties" >"$android/keystore.properties"
        )
        ;;
esac

# --- 4. Publish -------------------------------------------------------------

info "publishing $target to $RELEASE_DIR/$subdir"
exec "scripts/$target-publish.sh" --skip-published "$RELEASE_DIR/$subdir"