#!/usr/bin/env bash
# Start release builds only after this exact commit passed push verification.
set -euo pipefail

[[ "${CI_COMMIT_TAG:-}" =~ ^v[0-9]+\.[0-9]+\.[0-9]+(-[0-9A-Za-z.-]+)?$ ]] || {
  echo "release preflight must run from a vMAJOR.MINOR.PATCH tag" >&2
  exit 2
}
[[ -n "${CI_COMMIT_SHA:-}" ]] || { echo "CI_COMMIT_SHA is required" >&2; exit 2; }
[[ -n "${GITEA_TOKEN:-}" ]] || { echo "GITEA_TOKEN is required" >&2; exit 2; }

gitea_base="${GITEA_BASE:-http://192.168.2.162:3100}"
gitea_base="${gitea_base%/}"
gitea_host="${gitea_base#https://}"
gitea_host="${gitea_host#http://}"
gitea_host="${gitea_host%%/*}"
gitea_host="${gitea_host%%:*}"
tmp="$(mktemp -d)"
netrc="$tmp/netrc"
statuses_json="$tmp/statuses.json"
chmod 700 "$tmp"
printf 'machine %s login justme password %s\n' "$gitea_host" "$GITEA_TOKEN" > "$netrc"
chmod 600 "$netrc"
trap 'rm -rf "$tmp"' EXIT

verification=""
for attempt in $(seq 1 36); do
  curl --fail-with-body --silent --show-error --retry 3 --netrc-file "$netrc" \
    "$gitea_base/api/v1/repos/justme/MyMonitor/commits/$CI_COMMIT_SHA/statuses" \
    -o "$statuses_json"
  verification="$(jq -r '[.[] | select(.context == "ci/woodpecker/push/verify")] | sort_by(.created_at) | last | .status // ""' "$statuses_json")"
  case "$verification" in
    success)
      echo "push verification passed for ${CI_COMMIT_SHA:0:7}"
      exit 0
      ;;
    failure|error)
      echo "source commit push verification is $verification" >&2
      exit 1
      ;;
    *)
      if [[ "$attempt" == 36 ]]; then
        echo "timed out waiting for push verification (last status: ${verification:-missing})" >&2
        exit 1
      fi
      sleep 10
      ;;
  esac
done