#!/bin/bash
# Publish the generated PKGBUILD to the AUR.
#
# Runs natively inside an `archlinux:base-devel` container (so makepkg is
# available), matching the pattern already used by agw/pi3-smart-workspace.
#
#   AUR_SSH_PRIVATE_KEY   private key registered with aur.archlinux.org
#   $1                    path to the generated PKGBUILD

set -euo pipefail

PKGBUILD_PATH="${1:?path to PKGBUILD is required}"
: "${AUR_SSH_PRIVATE_KEY:?AUR_SSH_PRIVATE_KEY is required}"
PKGNAME="${PKGNAME:-jasp-desktop-bin}"

mkdir -p ~/.ssh
printf '%s\n' "$AUR_SSH_PRIVATE_KEY" > ~/.ssh/aur
chmod 600 ~/.ssh/aur
ssh-keyscan -H aur.archlinux.org >> ~/.ssh/known_hosts 2>/dev/null || true
cat > ~/.ssh/config <<'EOF'
Host aur.archlinux.org
  User aur
  IdentityFile ~/.ssh/aur
  StrictHostKeyChecking accept-new
EOF

workdir="$(mktemp -d)"

echo ":: cloning AUR repo $PKGNAME"
# A package that does not exist on the AUR yet clones as an empty repo.
git clone "ssh://aur@aur.archlinux.org/${PKGNAME}.git" "$workdir/aur" 2>&1 || true
if [[ ! -d "$workdir/aur/.git" ]]; then
  mkdir -p "$workdir/aur"
  git -C "$workdir/aur" init -b master
  git -C "$workdir/aur" remote add origin "ssh://aur@aur.archlinux.org/${PKGNAME}.git"
fi

cp "$PKGBUILD_PATH" "$workdir/aur/PKGBUILD"

# makepkg refuses to run as root.
if ! id builder &>/dev/null; then
  useradd -m builder
  echo "builder ALL=(ALL) NOPASSWD: ALL" >>/etc/sudoers
fi
# The whole tree, not just aur/: mktemp -d creates $workdir as 0700 root, and
# builder could not even enter it to run makepkg ("cd: Permission denied").
chown -R builder:builder "$workdir"

echo ":: generating .SRCINFO"
# The sha256sum is already correct from gen-pkgbuild.py (taken from the file we
# just uploaded), so there is no need to re-download ~1.5 GB with updpkgsums.
sudo -u builder bash -c "cd '$workdir/aur' && makepkg --printsrcinfo > .SRCINFO"
# Hand the tree back to root: the git commands below run as root, and git
# refuses to work in a repository owned by another user ("dubious ownership").
chown -R root:root "$workdir"

cd "$workdir/aur"
git config user.name "${AUR_GIT_NAME:-Asger Geel Weirsoe}"
git config user.email "${AUR_GIT_EMAIL:-asger@weircon.dk}"
git add PKGBUILD .SRCINFO

if git diff --staged --quiet; then
  echo ":: no changes — nothing to push"
  exit 0
fi

version="$(awk -F= '/^pkgver=/{v=$2} /^pkgrel=/{r=$2} END{print v"-"r}' PKGBUILD)"
git commit -m "Update to ${version}"
# Push HEAD explicitly rather than a branch name: cloning a package that does
# not exist on the AUR yet yields an empty repo whose initial branch depends on
# the runner's init.defaultBranch, which may not be master.
git push -u origin HEAD:master

echo ":: pushed ${PKGNAME} ${version} to the AUR"