#!/usr/bin/env bash
# 2026-03-07
# build-and-publish.sh — сборка terraform-provider-sless и загрузка в S3.
# Аналог /home/naeel/remote_dev/terraform/registry-server-build/build-provider.sh
# но для провайдера sless (namespace=naeel, provider=sless).
#
# Использование:
#   ./hack/build-and-publish.sh [VERSION]
#   VERSION по умолчанию — из переменной окружения PROVIDER_VERSION или 0.1.0
#
# Требуемые env (или задать через .s3cfg_path):
#   S3_ENDPOINT    — например https://s3.msk-1.ngcloud.ru
#   S3_ACCESS_KEY
#   S3_SECRET_KEY
#   GPG_KEY_FILE   — путь к private_key.asc (default: ../../../terraform/secrets/private_key.asc)
#
# S3 путь: registry/terraform-registry/terra.k8c.ru/naeel/sless/{VERSION}/
set -euo pipefail

SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
PROVIDER_DIR="$(cd "${SCRIPT_DIR}/.." && pwd)"
BUILD_DIR="${PROVIDER_DIR}/build"

REGISTRY_HOSTNAME="terra.k8c.ru"
NAMESPACE="naeel"
PROVIDER_NAME="sless"
S3_BUCKET="terraform-registry"

VERSION="${1:-${PROVIDER_VERSION:-0.1.0}}"

# GPG ключ — используем тот же что и для nubes провайдера
GPG_KEY_FILE="${GPG_KEY_FILE:-${PROVIDER_DIR}/../../../terraform/secrets/private_key.asc}"

# S3 credentials
S3_ENDPOINT="${S3_ENDPOINT:-}"
S3_ACCESS_KEY="${S3_ACCESS_KEY:-}"
S3_SECRET_KEY="${S3_SECRET_KEY:-}"

# Если S3 credentials не заданы — пробуем прочитать из .s3cfg_registry nubes проекта
S3CFG="${S3CFG:-${PROVIDER_DIR}/../../../terraform/secrets/.s3cfg_registry}"
if [[ -z "$S3_ENDPOINT" || -z "$S3_ACCESS_KEY" || -z "$S3_SECRET_KEY" ]]; then
  if [[ -f "$S3CFG" ]]; then
    echo "Загружаем S3 credentials из $S3CFG"
    access_key=$(awk -F'=' '/^\s*access_key\s*=/{gsub(/^[ \t]+|[ \t]+$/,"",$2); print $2; exit}' "$S3CFG")
    secret_key=$(awk -F'=' '/^\s*secret_key\s*=/{gsub(/^[ \t]+|[ \t]+$/,"",$2); print $2; exit}' "$S3CFG")
    host_base=$(awk -F'=' '/^\s*host_base\s*=/{gsub(/^[ \t]+|[ \t]+$/,"",$2); print $2; exit}' "$S3CFG")
    use_https=$(awk -F'=' '/^\s*use_https\s*=/{gsub(/^[ \t]+|[ \t]+$/,"",$2); print tolower($2); exit}' "$S3CFG")

    [[ -z "${S3_ACCESS_KEY:-}" && -n "$access_key" ]] && export S3_ACCESS_KEY="$access_key"
    [[ -z "${S3_SECRET_KEY:-}" && -n "$secret_key" ]] && export S3_SECRET_KEY="$secret_key"
    if [[ -z "${S3_ENDPOINT:-}" && -n "$host_base" ]]; then
      if [[ "$host_base" == http* ]]; then
        export S3_ENDPOINT="$host_base"
      elif [[ "$use_https" == "false" || "$use_https" == "no" ]]; then
        export S3_ENDPOINT="http://${host_base}"
      else
        export S3_ENDPOINT="https://${host_base}"
      fi
    fi
  fi
fi

if [[ -z "${S3_ENDPOINT:-}" || -z "${S3_ACCESS_KEY:-}" || -z "${S3_SECRET_KEY:-}" ]]; then
  echo "Error: требуются S3_ENDPOINT / S3_ACCESS_KEY / S3_SECRET_KEY" >&2
  exit 2
fi

if [[ ! -f "$GPG_KEY_FILE" ]]; then
  echo "Error: GPG ключ не найден: $GPG_KEY_FILE" >&2
  echo "Задайте GPG_KEY_FILE= или скопируйте private_key.asc из terraform/secrets/" >&2
  exit 2
fi

# Добавить https:// если нет схемы
s3_url="$S3_ENDPOINT"
[[ "$s3_url" != http* ]] && s3_url="https://${s3_url}"

echo "=== Сборка terraform-provider-sless v${VERSION} ==="

rm -rf "$BUILD_DIR"
mkdir -p "$BUILD_DIR"

build_and_zip() {
  local os="$1"
  local arch="$2"
  local binary="terraform-provider-sless_v${VERSION}"
  local zip_name="terraform-provider-sless_${VERSION}_${os}_${arch}.zip"

  [[ "$os" == "windows" ]] && binary="${binary}.exe"

  echo "  Building ${os}/${arch}..."
  (cd "$PROVIDER_DIR" && CGO_ENABLED=0 GOOS="$os" GOARCH="$arch" go build -ldflags "-X main.version=${VERSION}" -o "${BUILD_DIR}/${binary}" .)
  (cd "$BUILD_DIR" && python3 -m zipfile -c "$zip_name" "$binary")
  rm -f "${BUILD_DIR:?}/${binary}"
}

build_and_zip linux amd64
build_and_zip darwin amd64

echo "  Вычисляем SHA256SUMS..."
(cd "$BUILD_DIR" && sha256sum *.zip > "terraform-provider-sless_${VERSION}_SHA256SUMS")

echo "  Подписываем GPG..."
GNUPGHOME="$(mktemp -d)"
export GNUPGHOME
trap 'rm -rf "$GNUPGHOME"' EXIT

gpg --batch --import "$GPG_KEY_FILE" >/dev/null 2>&1
key_id=$(gpg --list-keys --with-colons | awk -F: '/^pub/{print $5; exit}')
if [[ -z "$key_id" ]]; then
  echo "Error: не удалось прочитать ключ из $GPG_KEY_FILE" >&2
  exit 2
fi

gpg --batch --yes --detach-sign --default-key "$key_id" \
  --output "${BUILD_DIR}/terraform-provider-sless_${VERSION}_SHA256SUMS.sig" \
  "${BUILD_DIR}/terraform-provider-sless_${VERSION}_SHA256SUMS"

echo "  Загружаем в S3..."
# Алиас mc включается в путь: <alias>/<bucket>/<path>
mc alias set sless-registry "$s3_url" "$S3_ACCESS_KEY" "$S3_SECRET_KEY" --api S3v4 >/dev/null
S3_PATH="sless-registry/${S3_BUCKET}/${REGISTRY_HOSTNAME}/${NAMESPACE}/${PROVIDER_NAME}/${VERSION}/"

mc cp "${BUILD_DIR}"/*.zip "${S3_PATH}"
mc cp "${BUILD_DIR}/terraform-provider-sless_${VERSION}_SHA256SUMS" "${S3_PATH}"
mc cp "${BUILD_DIR}/terraform-provider-sless_${VERSION}_SHA256SUMS.sig" "${S3_PATH}"

echo ""
echo "=== Готово! Версия ${VERSION} опубликована ==="
echo "    Проверить: curl -sk https://terra.k8c.ru/v1/providers/naeel/sless/versions"