#!/bin/sh
# ci-run.sh — CoreCI pipeline runner for orca.
# Called by .coreci.yml jobs via: sh scripts/ci-run.sh <job-name>
#
# CoreCI's ValidateShellCommand forbids shell metacharacters (&|;`><$())
# in the invoke: string. This script wraps the complex logic so the
# invoke: field is just "sh scripts/ci-run.sh <job-name>".
#
# Environment variables (provided by CoreCI's CI context + PassThroughEnv):
#   CI_COMMIT_BRANCH — tag name on tag pushes (from GITHUB_REF_NAME)
#   CI_COMMIT_SHA    — commit SHA
#   GITEA_TOKEN      — Gitea API token (from Gitea Actions secret PAT_TOKEN)
#
# NOTE: uses #!/bin/sh — do NOT use bash-only features (pipefail, [[ ]], etc.)
# The Gitea Actions runner uses dash as /bin/sh.

set -u

JOB="${1:-}"
if [ -z "$JOB" ]; then
  echo "usage: sh scripts/ci-run.sh <job-name>" >&2
  exit 1
fi

# CoreCI's shell-isolated executor (buildIsolatedEnv) does NOT forward
# Go toolchain env vars (GOROOT, GOPATH, GOCACHE, GOMODCACHE are in the
# systemVars deny-list). Re-derive them from the `go` binary on PATH so
# Go commands work in the shell-isolated executor.
echo "ci-run: PATH=$PATH" >&2
echo "ci-run: which go=$(command -v go 2>/dev/null || echo 'not found')" >&2
if command -v go >/dev/null 2>&1; then
  export GOROOT="${GOROOT:-$(go env GOROOT 2>/dev/null || echo "")}"
  export GOPATH="${GOPATH:-$(go env GOPATH 2>/dev/null || echo "$HOME/go")}"
  export GOCACHE="${GOCACHE:-$(go env GOCACHE 2>/dev/null || echo "$HOME/.cache/go-build")}"
  export GOMODCACHE="${GOMODCACHE:-$(go env GOMODCACHE 2>/dev/null || echo "$HOME/go/pkg/mod")}"
  echo "ci-run: GOROOT=$GOROOT GOPATH=$GOPATH GOCACHE=$GOCACHE GOMODCACHE=$GOMODCACHE" >&2
fi

info() { echo "ci-run: $*"; }
err()  { echo "ci-run: error: $*" >&2; exit 1; }

case "$JOB" in
  # ── validate ──────────────────────────────────────────────────────
  go-vet)
    go version
    gofmt -l .
    go vet ./...
    ;;

  verify-reqs)
    make verify-reqs
    ;;

  gosec)
    go install github.com/securego/gosec/v2/cmd/gosec@v2.18.2
    gosec -fmt text -quiet ./...
    ;;

  govulncheck)
    go install golang.org/x/vuln/cmd/govulncheck@v1.1.3
    govulncheck -mode binary ./...
    ;;

  gitleaks)
    curl -fsSL https://github.com/gitleaks/gitleaks/releases/latest/download/gitleaks-linux-amd64.tar.gz -o /tmp/gitleaks.tar.gz
    tar -xzf /tmp/gitleaks.tar.gz -C /tmp gitleaks
    mv /tmp/gitleaks /usr/local/bin/gitleaks 2>/dev/null || cp /tmp/gitleaks ./gitleaks
    chmod +x ./gitleaks 2>/dev/null || true
    if [ -x ./gitleaks ]; then
      ./gitleaks detect --source . --config .gitleaks.toml --baseline-path .gitleaks-baseline.json --no-banner
    else
      gitleaks detect --source . --config .gitleaks.toml --baseline-path .gitleaks-baseline.json --no-banner
    fi
    ;;

  # ── build ──────────────────────────────────────────────────────────
  build)
    info "building orca binary..."
    VERSION="${CI_COMMIT_BRANCH:-dev}"
    GIT_COMMIT="${CI_COMMIT_SHA:-unknown}"
    BUILD_TIME="$(date -u +%Y-%m-%dT%H:%M:%SZ)"
    info "VERSION=$VERSION GIT_COMMIT=$GIT_COMMIT BUILD_TIME=$BUILD_TIME"
    LDFLAGS="-s -w \
      -X git.cloudinit.dev/coreci/orca/internal/cli.version=${VERSION} \
      -X git.cloudinit.dev/coreci/orca/internal/cli.gitCommit=${GIT_COMMIT} \
      -X git.cloudinit.dev/coreci/orca/internal/cli.buildTime=${BUILD_TIME}"
    mkdir -p bin
    info "running: go build -trimpath -ldflags=... -o bin/orca ./cmd/orca"
    go build -trimpath -ldflags="${LDFLAGS}" -o bin/orca ./cmd/orca 2>&1 || err "go build failed with exit $?"
    file bin/orca 2>/dev/null || echo "file command not available"
    ./bin/orca version 2>&1 || echo "orca version failed"
    ;;

  # ── test (REQ-031: -race) ─────────────────────────────────────────
  test)
    go test -race -coverprofile=coverage.out ./...
    go tool cover -func=coverage.out | tail -1
    ;;

  *)
    err "unknown job: ${JOB}"
    ;;
esac