#!/usr/bin/env bash
set -euo pipefail

# Build the minimal TSL playbook bundle and publish its *expanded* contents to
# the tsl-playbook branch. The branch tree mirrors the bundle root directly
# (AGENTS.md, docs/, skills/) — there is no wrapping tsl-playbook/ directory.
#
# Only the paths produced by the bundle are managed. Any other file that lives
# on the branch (e.g. a hand-written README.md) is preserved across syncs.

REPO_DIR="${REPO_DIR:-$(pwd)}"
TARGET_BRANCH="${TARGET_BRANCH:-tsl-playbook}"
BUILD_SCRIPT="${BUILD_SCRIPT:-scripts/build_tsl_playbook.py}"
COMMIT_AUTHOR_NAME="${COMMIT_AUTHOR_NAME:-ci[bot]}"
COMMIT_AUTHOR_EMAIL="${COMMIT_AUTHOR_EMAIL:-ci-bot@local}"

cd "$REPO_DIR"

git config user.name "$COMMIT_AUTHOR_NAME"
git config user.email "$COMMIT_AUTHOR_EMAIL"

source_sha="$(git rev-parse HEAD)"
source_short="$(git rev-parse --short HEAD)"

# Build the bundle into a temp dir *outside* the repo so that resetting the
# target branch's working tree can never clobber the freshly built artifact.
build_dir="$(mktemp -d)"
cleanup() {
  rm -rf "$build_dir"
}
trap cleanup EXIT

bundle="$build_dir/tsl-playbook"
python3 "$BUILD_SCRIPT" --output "$bundle"

# These are the only paths this workflow owns on the branch. Everything else is
# left alone, including hand-written files such as README.md.
generated_paths=(AGENTS.md docs skills)
for path in "${generated_paths[@]}"; do
  if [ ! -e "$bundle/$path" ]; then
    echo "ERROR: bundle is missing expected path: $path" >&2
    exit 1
  fi
done

# Check out (or create) the target branch.
if git show-ref --verify --quiet "refs/remotes/origin/$TARGET_BRANCH"; then
  git fetch origin "$TARGET_BRANCH"
  git checkout -B "$TARGET_BRANCH" "origin/$TARGET_BRANCH"
else
  # A brand-new orphan branch inherits main's index. Clear the index without
  # deleting source files from the working tree; only generated_paths are staged.
  git checkout --orphan "$TARGET_BRANCH"
  git rm -rf --cached --quiet . >/dev/null 2>&1 || true
fi

# Remove only generated paths before copying the freshly built bundle.
rm -rf "${generated_paths[@]}"

# Copy bundle contents (including dotfiles) to the repo root.
cp -R "$bundle"/. "$REPO_DIR"/

git add -A "${generated_paths[@]}"

if git diff --cached --quiet; then
  echo "No tsl-playbook changes to publish."
  exit 0
fi

git commit -m ":package: deps(tsl): sync tsl-playbook from ${source_short}

Source-Commit: ${source_sha}"

TOKEN="${WORKFLOW:-}"
if [ -n "$TOKEN" ] && [ -n "${GITHUB_SERVER_URL:-}" ] && [ -n "${GITHUB_REPOSITORY:-}" ]; then
  git remote set-url origin "https://oauth2:${TOKEN}@${GITHUB_SERVER_URL#https://}/${GITHUB_REPOSITORY}.git"
fi

git push origin "$TARGET_BRANCH"
echo "✅ Published tsl-playbook @ ${source_short}"