#!/bin/bash
# SPDX-License-Identifier: GPL-3.0-or-later
# Build release artifacts: source tarball, checksum file, manifest, optional
# detached signature over SHA256SUMS.
set -euo pipefail

cd "$(dirname "$0")/.."

version="$(python3 - <<'PY'
import tomllib
from pathlib import Path
print(tomllib.loads(Path("pyproject.toml").read_text())["project"]["version"])
PY
)"
project="enodia-sentinel"
prefix="${project}-${version}"
distdir="${DISTDIR:-dist}"
archive="${prefix}.tar.gz"
manifest="RELEASE_MANIFEST.json"
checksums="SHA256SUMS"
signature="SHA256SUMS.asc"
allow_dirty="${RELEASE_ALLOW_DIRTY:-0}"
sign="${RELEASE_SIGN:-0}"
signing_key="${RELEASE_SIGNING_KEY:-}"

if git rev-parse --is-inside-work-tree >/dev/null 2>&1; then
    dirty=0
    git diff --quiet || dirty=1
    git diff --cached --quiet || dirty=1
    if [ -n "$(git ls-files --others --exclude-standard)" ]; then
        dirty=1
    fi
    git_commit="$(git rev-parse --verify HEAD)"
    if [ "$dirty" -ne 0 ] && [ "$allow_dirty" != "1" ]; then
        echo "error: worktree is dirty; commit changes or set RELEASE_ALLOW_DIRTY=1" >&2
        exit 2
    fi
else
    dirty=1
    git_commit=""
fi

mkdir -p "$distdir"
tmp="$(mktemp -d "${TMPDIR:-/tmp}/enodia-release.XXXXXX")"
cleanup() {
    rm -rf "$tmp"
}
trap cleanup EXIT

mkdir -p "$tmp/$prefix"
tar \
    --exclude='./.git' \
    --exclude='./dist' \
    --exclude='./__pycache__' \
    --exclude='*/__pycache__' \
    --exclude='./.pytest_cache' \
    --exclude='./.mypy_cache' \
    --exclude='./.ruff_cache' \
    --exclude='*.pyc' \
    --exclude='*.pkg.tar.zst' \
    -cf - . | tar -xf - -C "$tmp/$prefix"

tar --sort=name --mtime='@0' --owner=0 --group=0 --numeric-owner \
    -czf "$distdir/$archive" -C "$tmp" "$prefix"

generated_at="$(date -u +%Y-%m-%dT%H:%M:%SZ)"
cat > "$distdir/$manifest" <<JSON
{
  "project": "$project",
  "version": "$version",
  "generated_at": "$generated_at",
  "git_commit": "$git_commit",
  "dirty": $dirty,
  "artifacts": [
    "$archive",
    "$checksums"
  ]
}
JSON

(
    cd "$distdir"
    sha256sum "$archive" "$manifest" > "$checksums"
)

if [ "$sign" = "1" ]; then
    command -v gpg >/dev/null 2>&1 || {
        echo "error: RELEASE_SIGN=1 requires gpg" >&2
        exit 127
    }
    gpg_args=(--batch --yes --armor --detach-sign)
    if [ -n "$signing_key" ]; then
        gpg_args+=(--local-user "$signing_key")
    fi
    gpg "${gpg_args[@]}" -o "$distdir/$signature" "$distdir/$checksums"
    echo "Signed $distdir/$signature"
else
    echo "Signing skipped; set RELEASE_SIGN=1 to create $signature"
fi

echo "Wrote $distdir/$archive"
echo "Wrote $distdir/$checksums"
echo "Wrote $distdir/$manifest"