#!/usr/bin/env bash
# Build and publish one Linux architecture: Agent/Probe binary archives to
# Gitea Generic Packages and the matching Backend OCI image to Zot.
set -euo pipefail

arch="${1:?usage: release-linux.sh <amd64|arm64>}"
root="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
version="${CI_COMMIT_TAG#v}"
[[ "${CI_COMMIT_TAG:-}" =~ ^v[0-9]+\.[0-9]+\.[0-9]+(-[0-9A-Za-z.-]+)?$ ]] || {
  echo "release must run from a vMAJOR.MINOR.PATCH tag" >&2
  exit 2
}

[[ -n "${GITEA_TOKEN:-}" ]] || { echo "GITEA_TOKEN is required" >&2; exit 2; }
[[ -n "${ZOT_USERNAME:-}" && -n "${ZOT_PASSWORD:-}" ]] || { echo "Zot credentials are required" >&2; exit 2; }

gitea_base="${GITEA_BASE:-http://192.168.2.162:3100}"
gitea_host="${gitea_base#https://}"
gitea_host="${gitea_host#http://}"
gitea_host="${gitea_host%%/*}"
gitea_host="${gitea_host%%:*}"
registry="${ZOT_REGISTRY:-192.168.2.162:5000}"
image="${registry}/monitor/monitor-backend"
output="$root/.release/linux-$arch"
build_root="$root/.release/build/linux-$arch"
stage_root="$root/.release/stage/linux-$arch"
rid="linux-x64"
objcopy="llvm-objcopy"
if [[ "$arch" == arm64 ]]; then
  rid="linux-arm64"
  objcopy="aarch64-linux-gnu-objcopy"
elif [[ "$arch" != amd64 ]]; then
  echo "unsupported architecture: $arch" >&2
  exit 2
fi

project_version="$(sed -n 's#.*<Version>\(.*\)</Version>.*#\1#p' "$root/backend/Directory.Build.props" | head -1)"
if [[ "$version" != "$project_version" ]]; then
  echo "tag version $version does not match project version $project_version" >&2
  exit 1
fi

mkdir -p "$output" "$build_root" "$stage_root"

publish_aot() {
  local name="$1" project="$2" destination="$3"
  local openapi_args=()
  # The API document is generated from the host executable. During an x64 to
  # arm64 cross-publish, that build-time tool cannot run the target binary;
  # the checked-in OpenAPI document is already available for this release.
  if [[ "$rid" == linux-arm64 && "$name" == backend ]]; then
    openapi_args=(-p:OpenApiGenerateDocuments=false)
  fi
  (cd "$root/backend" && dotnet publish "$project" \
    -c Release -r "$rid" --self-contained true \
    -p:PublishAot=true -p:StripSymbols=true -p:DebugType=none \
    -p:ObjCopyName="$objcopy" \
    "${openapi_args[@]}" \
    --artifacts-path "$build_root/$name" \
    -o "$destination")
}

publish_aot agent agent/src/Monitor.Agent "$output/agent"
publish_aot probe probe/src/Monitor.Probe "$output/probe"
publish_aot fleet-enroll fleet/tools/fleet-enroll "$output/fleet-enroll"
publish_aot backend src/Monitor.Backend "$output/backend"

package_node() {
  local role="$1" stage="$stage_root/$1"
  mkdir -p "$stage/systemd"
  cp "$output/$role/monitor-$role" "$stage/monitor-$role"
  cp "$root/packaging/install.sh" "$stage/install.sh"
  cp "$root/LICENSE" "$stage/LICENSE"
  cp "$root/backend/$role/README.md" "$stage/README.md"
  cp "$root/packaging/systemd/monitor-$role.service" "$stage/systemd/monitor-$role.service"
  if [[ "$role" == agent ]]; then
    cp "$output/fleet-enroll/fleet-enroll" "$stage/fleet-enroll"
  else
    mkdir -p "$stage/openwrt"
    cp "$root/packaging/openwrt/monitor-probe.init" "$stage/openwrt/"
    cp "$root/packaging/openwrt/monitor.keep" "$stage/openwrt/"
  fi

  local archive="$output/monitor-$role-v$version-linux-$arch.tar.gz"
  tar -C "$stage" -czf "$archive" .
  (cd "$output" && sha256sum "$(basename "$archive")" > "$(basename "$archive").sha256")
  upload_package "$archive"
  upload_package "$archive.sha256"
}

netrc="$(mktemp)"
chmod 600 "$netrc"
printf 'machine %s login justme password %s\n' "$gitea_host" "$GITEA_TOKEN" > "$netrc"
cleanup() { rm -f "$netrc"; }
trap cleanup EXIT

upload_package() {
  local file="$1" name
  name="$(basename "$file")"
  local status
  status="$(curl --silent --show-error --retry 3 --netrc-file "$netrc" \
    --upload-file "$file" \
    --output /dev/null --write-out '%{http_code}' \
    "$gitea_base/api/packages/justme/generic/monitor-node/$version/$name")"
  case "$status" in
    2*) echo "uploaded Gitea package $name" ;;
    409) echo "Gitea package $name already exists; reusing the existing release file" ;;
    *) echo "Gitea package upload failed for $name (HTTP $status)" >&2; return 1 ;;
  esac
}

package_node agent
package_node probe

# The .NET runtime-deps image is a multi-arch OCI base. The Containerfile does
# not execute target-platform commands, so Buildah can assemble either image.
container_context="$root/.release/container/linux-$arch"
mkdir -p "$container_context/app" "$container_context/data"
cp -a "$output/backend/." "$container_context/app/"
: > "$container_context/data/.keep"

export REGISTRY_AUTH_FILE="$root/.release/auth/zot-linux-$arch.json"
mkdir -p "$(dirname "$REGISTRY_AUTH_FILE")"
buildah login --tls-verify=false --username "$ZOT_USERNAME" --password-stdin "$registry" <<< "$ZOT_PASSWORD" >/dev/null
local_image="localhost/monitor-backend:$version-$arch"
buildah bud --tls-verify=false --arch "$arch" \
  --build-arg "APP_VERSION=$version" \
  -f "$root/packaging/container/Backend.Containerfile" \
  -t "$local_image" "$container_context" >/dev/null
buildah push --tls-verify=false "$local_image" "docker://$image:$version-$arch" >/dev/null
echo "pushed Zot image $image:$version-$arch"