#!/usr/bin/env bash
# Build and upload the Terraform provider to the registry S3 bucket.
#
# GPG signing key requirements:
# - A private key is required for signing SHA256SUMS.
# - The private key must be available at:
#   ${ROOT_DIR}/secrets/private_key.asc
# - The private key is intentionally ignored by git.
#
# If the key is missing, generate it with a no-passphrase batch run, then
# export it to the expected location. Example (email only, no passphrase):
#   GPG_DIR=${ROOT_DIR}/secrets
#   GNUPGHOME=$(mktemp -d)
#   cat > /tmp/gpg_batch <<'EOF'
#   %no-protection
#   Key-Type: RSA
#   Key-Length: 3072
#   Subkey-Type: RSA
#   Subkey-Length: 3072
#   Name-Real: tazet@narod.ru
#   Name-Email: tazet@narod.ru
#   Expire-Date: 0
#   EOF
#   gpg --batch --homedir "$GNUPGHOME" --gen-key /tmp/gpg_batch
#   gpg --batch --homedir "$GNUPGHOME" --armor --export-secret-keys > "$GPG_DIR/private_key.asc"
#   gpg --batch --homedir "$GNUPGHOME" --armor --export > "$GPG_DIR/public_key.asc"
#   rm -rf "$GNUPGHOME" /tmp/gpg_batch
set -euo pipefail

SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
ROOT_DIR="${ROOT_DIR:-$(cd "${SCRIPT_DIR}/.." && pwd)}"
PROVIDER_DIR="${PROVIDER_DIR:-${ROOT_DIR}/universal_rebuild}"
BUILD_DIR="${BUILD_DIR:-${ROOT_DIR}/artifacts/provider_build}"
GPG_KEY_FILE="${GPG_KEY_FILE:-${ROOT_DIR}/secrets/private_key.asc}"

VERSION="${1:-2.0.2}"
REGISTRY_HOSTNAME="${REGISTRY_HOSTNAME:-terra.k8c.ru}"
NAMESPACE="${NAMESPACE:-nubes}"
PROVIDER_NAME="${PROVIDER_NAME:-nubes}"
S3_BUCKET="${S3_BUCKET:-terraform-registry}"

S3_ENDPOINT="${S3_ENDPOINT:-}"
S3_ACCESS_KEY="${S3_ACCESS_KEY:-}"
S3_SECRET_KEY="${S3_SECRET_KEY:-}"

if [[ -z "$S3_ENDPOINT" || -z "$S3_ACCESS_KEY" || -z "$S3_SECRET_KEY" ]]; then
  echo "Error: S3_ENDPOINT/S3_ACCESS_KEY/S3_SECRET_KEY must be set" >&2
  echo "Hint: see ${ROOT_DIR}/secrets/.s3cfg_registry" >&2
  exit 2
fi

if [[ ! -f "$GPG_KEY_FILE" ]]; then
  echo "Error: GPG key file not found at $GPG_KEY_FILE" >&2
  exit 2
fi

if [[ ! -d "$PROVIDER_DIR" ]]; then
  echo "Error: provider source dir not found: $PROVIDER_DIR" >&2
  exit 2
fi

s3_endpoint_url="$S3_ENDPOINT"
if [[ "$s3_endpoint_url" != http* ]]; then
  s3_endpoint_url="https://${s3_endpoint_url}"
fi

rm -rf "$BUILD_DIR"
mkdir -p "$BUILD_DIR"

build_and_zip() {
  local os="$1"
  local arch="$2"
  local binary="terraform-provider-nubes_v${VERSION}"

  if [[ "$os" == "windows" ]]; then
    binary+=".exe"
  fi

  echo "Building for ${os}/${arch}..."
  (cd "$PROVIDER_DIR" && CGO_ENABLED=0 GOOS="$os" GOARCH="$arch" go build -ldflags "-X main.version=${VERSION}" -o "${BUILD_DIR}/${binary}" .)

  (cd "$BUILD_DIR" && python3 -m zipfile -c "terraform-provider-nubes_${VERSION}_${os}_${arch}.zip" "$binary")
  rm -f "${BUILD_DIR:?}/${binary}"
}

build_and_zip linux amd64
build_and_zip windows amd64
build_and_zip darwin amd64

( cd "$BUILD_DIR" && sha256sum *.zip > "terraform-provider-nubes_${VERSION}_SHA256SUMS" )

GNUPGHOME="$(mktemp -d)"
export GNUPGHOME
trap 'rm -rf "$GNUPGHOME"' EXIT

gpg --batch --import "$GPG_KEY_FILE" >/dev/null
key_id=$(gpg --list-keys --with-colons | awk -F: '/^pub/{print $5; exit}')
if [[ -z "$key_id" ]]; then
  echo "Error: failed to read key id from $GPG_KEY_FILE" >&2
  exit 2
fi

gpg --batch --yes --detach-sign --default-key "$key_id" \
  --output "${BUILD_DIR}/terraform-provider-nubes_${VERSION}_SHA256SUMS.sig" \
  "${BUILD_DIR}/terraform-provider-nubes_${VERSION}_SHA256SUMS"

mc alias set registry "$s3_endpoint_url" "$S3_ACCESS_KEY" "$S3_SECRET_KEY" --api S3v4
S3_PATH="registry/${S3_BUCKET}/${REGISTRY_HOSTNAME}/${NAMESPACE}/${PROVIDER_NAME}/${VERSION}/"

echo "Uploading to: ${S3_PATH}"
mc cp "${BUILD_DIR}"/*.zip "$S3_PATH"
mc cp "${BUILD_DIR}/terraform-provider-nubes_${VERSION}_SHA256SUMS" "$S3_PATH"
mc cp "${BUILD_DIR}/terraform-provider-nubes_${VERSION}_SHA256SUMS.sig" "$S3_PATH"

echo "Done. Version ${VERSION} uploaded."