#!/usr/bin/env bash
set -Eeuo pipefail

VERSION="${1:?version required, e.g. V2R1C4}"
TARGET_OID="${2:?target_oid required}"
EVIDENCE_CLOSURE_OID="${3:?evidence_closure_oid required}"
APPROVAL_PLAN_ID="${4:?approval_plan_id required}"
WORKSPACE="${AIOS_GITOPS_WORKSPACE:-/data/aios-gitops/workspace}"
TAG_REMOTE="${AIOS_GITOPS_GITEA_REMOTE:-gitea}"
BRANCH_REMOTE="${AIOS_GITOPS_BRANCH_REMOTE:-gitea}"

case "$VERSION" in
  V[0-9]*R[0-9]*C[0-9]*) ;;
  *) echo "ERROR: version must match VxRxCx" >&2; exit 64 ;;
esac

for value in "$TARGET_OID" "$EVIDENCE_CLOSURE_OID"; do
  [[ "$value" =~ ^[0-9a-f]{40}$ ]] || {
    echo "ERROR: target and evidence OIDs must be full lowercase 40-character OIDs" >&2
    exit 64
  }
done

[[ -n "$APPROVAL_PLAN_ID" ]] || {
  echo "ERROR: approval_plan_id is required" >&2
  exit 64
}

cd "$WORKSPACE"
BRANCH="$(git symbolic-ref --quiet --short HEAD)" || {
  echo "ERROR: release must run on an isolated branch, not detached HEAD" >&2
  exit 65
}
case "$BRANCH" in
  main|master) echo "ERROR: direct main/master release writes are forbidden" >&2; exit 65 ;;
esac

python3 "$WORKSPACE/active-runtime/app/gitea_tag_publication.py" publish \
  --workspace "$WORKSPACE" \
  --remote "$TAG_REMOTE" \
  --version "$VERSION" \
  --target-oid "$TARGET_OID" \
  --evidence-closure-oid "$EVIDENCE_CLOSURE_OID" \
  --approval-plan-id "$APPROVAL_PLAN_ID"

git add -- "baseline/current.json" "versions/$VERSION.json"
if ! git diff --cached --quiet; then
  git commit -m "release($VERSION): record Gitea-confirmed baseline"
fi

# No force, no main push, and no ignored failure.
git push "$BRANCH_REMOTE" "HEAD:refs/heads/$BRANCH"
echo "RELEASE_BASELINE_UPDATED $VERSION branch=$BRANCH"