#!/usr/bin/env bash
set -euo pipefail

ROOT=$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")/.." && pwd)
OUT_INPUT=${1:-"$ROOT/dist/release"}
OUT=$(realpath -m -- "$OUT_INPUT")
VERSION=${RELEASE_VERSION:-local-development}

case "$OUT" in
  "$ROOT"/*) ;;
  *)
    echo "release output must stay below project root: $OUT" >&2
    exit 1
    ;;
esac

rm -rf -- "$OUT"
mkdir -p -- "$OUT"

cd -- "$ROOT"
go mod verify
go build -trimpath -buildvcs=false -o "$OUT/sip-go-agent" ./cmd/sip-go-agent
cp -- go.mod go.sum "$OUT/"
(
  cd -- "$OUT"
  sha256sum sip-go-agent go.mod go.sum > SHA256SUMS
)

source_ref=$(git -C "$ROOT" rev-parse HEAD 2>/dev/null || printf 'unavailable')
source_dirty=false
if [[ -n "$(git -C "$ROOT" status --porcelain --untracked-files=all -- . 2>/dev/null)" ]]; then
  source_dirty=true
fi

go_version=$(go version)
python3 - "$OUT/manifest.json" "$VERSION" "$source_ref" "$source_dirty" "$go_version" "$OUT" <<'PY'
import hashlib
import json
import pathlib
import sys

manifest_path, version, source_ref, source_dirty, go_version, out = sys.argv[1:]
root = pathlib.Path(out)
def sha256(name):
    return hashlib.sha256((root / name).read_bytes()).hexdigest()

manifest = {
    "manifest_version": 1,
    "scope": "local-development",
    "version": version,
    "source_ref": source_ref,
    "source_dirty": source_dirty == "true",
    "go_version": go_version,
    "binary": {"path": "sip-go-agent", "sha256": sha256("sip-go-agent")},
    "module_files": {
        "go.mod": sha256("go.mod"),
        "go.sum": sha256("go.sum"),
    },
    "security": {
        "credentials_embedded": False,
        "production_approval": False,
    },
}
pathlib.Path(manifest_path).write_text(json.dumps(manifest, indent=2, sort_keys=True) + "\n")
PY

printf 'release manifest: %s\n' "$OUT/manifest.json"