#!/usr/bin/env bash
set -Eeuo pipefail

SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
REPO_ROOT="$(cd "${SCRIPT_DIR}/.." && pwd)"
export PYTHONPATH="${REPO_ROOT}/src${PYTHONPATH:+:${PYTHONPATH}}"

run_step() {
  local label="$1"
  shift
  printf '[check] %s\n' "${label}"
  "$@"
}

secret_scan() {
  python3 - "${REPO_ROOT}" <<'PY'
import re
import sys
from pathlib import Path

root = Path(sys.argv[1])
rom_suffixes = (".iso", ".gcm", ".wbfs", ".nkit.iso")
secret_pattern = re.compile(
    r"BEGIN [A-Z ]+PRIVATE KEY|Authorization:\s*Bearer\s+[A-Za-z0-9._~-]{20,}"
)
findings: list[str] = []
for path in root.rglob("*"):
    if not path.is_file() or any(part in {".git", "__pycache__", "artifacts"} for part in path.parts):
        continue
    relative = path.relative_to(root)
    if path.name.lower().endswith(rom_suffixes):
        findings.append(f"ROM file: {relative}")
        continue
    if relative in {Path("templates/couchd.token.example"), Path("scripts/check.sh")}:
        continue
    try:
        text = path.read_text(encoding="utf-8")
    except (UnicodeDecodeError, OSError):
        continue
    if secret_pattern.search(text):
        findings.append(f"possible secret: {relative}")
if findings:
    print("\n".join(findings))
    raise SystemExit(1)
PY
}

run_step "unit tests" python3 -m unittest discover -v
run_step "setup shell tests" bash "${REPO_ROOT}/tests/test_setup_modes.sh"
run_step "shell syntax" bash -n "${REPO_ROOT}/setup.sh" "${REPO_ROOT}"/scripts/*.sh
run_step "python compile" python3 -m py_compile "${REPO_ROOT}"/src/couchd/*.py "${REPO_ROOT}"/tests/*.py
if command -v node >/dev/null 2>&1; then
  run_step "dashboard JS syntax" node --check "${REPO_ROOT}/dashboard/app.js"
else
  printf '[check] dashboard JS syntax skipped: node not installed\n'
fi
if git -C "${REPO_ROOT}" rev-parse --is-inside-work-tree >/dev/null 2>&1; then
  run_step "git diff check" git -C "${REPO_ROOT}" diff --check
else
  printf '[check] git diff check skipped: deployed tree has no .git directory\n'
fi
run_step "secret and ROM scan" secret_scan