#!/usr/bin/env bash

set -euo pipefail

workspace="${GITHUB_WORKSPACE:?GITHUB_WORKSPACE is required}"
repository="${GITHUB_REPOSITORY:?GITHUB_REPOSITORY is required}"
server_url="${GITHUB_SERVER_URL:?GITHUB_SERVER_URL is required}"
event_path="${GITHUB_EVENT_PATH:?GITHUB_EVENT_PATH is required}"
fetch_depth="${GENARRATIVE_GITEA_FETCH_DEPTH:-1}"
repository_url="${GENARRATIVE_GITEA_REPOSITORY_URL:-${server_url%/}/${repository}.git}"

if [[ ! "${fetch_depth}" =~ ^[0-9]+$ ]]; then
  echo "GENARRATIVE_GITEA_FETCH_DEPTH must be a non-negative integer: ${fetch_depth}" >&2
  exit 2
fi
if [[ -z "${workspace}" || "${workspace}" == '/' ]]; then
  echo "refusing to clean unsafe workspace: ${workspace}" >&2
  exit 2
fi

readarray -t event_checkout < <(
  node - "${event_path}" <<'NODE'
const fs = require('node:fs');

const event = JSON.parse(fs.readFileSync(process.argv[2], 'utf8'));
const targetSha = event.pull_request?.head?.sha ?? event.after ?? process.env.GITHUB_SHA ?? '';
const baseRef = event.pull_request?.base?.ref ?? process.env.GITHUB_BASE_REF ?? 'master';
process.stdout.write(`${targetSha}\n${baseRef}\n`);
NODE
)
target_sha="${event_checkout[0]:-}"
base_ref="${event_checkout[1]:-master}"

if [[ ! "${target_sha}" =~ ^[0-9a-fA-F]{40,64}$ ]]; then
  echo "event did not provide a valid checkout commit: ${target_sha}" >&2
  exit 1
fi
git check-ref-format --branch "${base_ref}" >/dev/null

mkdir -p "${workspace}"
find "${workspace}" -mindepth 1 -maxdepth 1 -exec rm -rf -- {} +
git config --global --add safe.directory "${workspace}"
git -c init.defaultBranch=master init "${workspace}"
git -C "${workspace}" remote add origin "${repository_url}"
git -C "${workspace}" config gc.auto 0
git -C "${workspace}" config advice.detachedHead false

fetch_args=(
  -c protocol.version=2
  fetch
  --no-tags
  --prune
  --no-recurse-submodules
)
if [[ "${fetch_depth}" -gt 0 ]]; then
  fetch_args+=(--depth="${fetch_depth}")
fi
fetch_refspecs=(
  "+${target_sha}:refs/remotes/ci/head"
)
if [[ "${fetch_depth}" -eq 0 ]]; then
  fetch_refspecs+=(
    "+refs/heads/${base_ref}:refs/remotes/origin/${base_ref}"
  )
fi

auth_header=''
if [[ -n "${GENARRATIVE_GITEA_TOKEN:-}" ]]; then
  auth_header="AUTHORIZATION: basic $(
    printf 'x-access-token:%s' "${GENARRATIVE_GITEA_TOKEN}" | base64 -w 0
  )"
fi

for attempt in $(seq 1 5); do
  if [[ -n "${auth_header}" ]]; then
    if GIT_CONFIG_COUNT=1 \
      GIT_CONFIG_KEY_0="http.${repository_url%/}.extraheader" \
      GIT_CONFIG_VALUE_0="${auth_header}" \
      git -C "${workspace}" "${fetch_args[@]}" origin "${fetch_refspecs[@]}"; then
      break
    fi
  elif git -C "${workspace}" "${fetch_args[@]}" origin "${fetch_refspecs[@]}"; then
    break
  fi
  if [[ "${attempt}" -eq 5 ]]; then
    echo 'Gitea checkout fetch failed after 5 attempts.' >&2
    exit 1
  fi
  sleep $((attempt * 2))
done

git -C "${workspace}" checkout --force refs/remotes/ci/head
git -C "${workspace}" clean -ffdx
test "$(git -C "${workspace}" rev-parse HEAD)" = "${target_sha,,}"
printf 'checked_out_commit=%s\n' "${target_sha,,}"