#!/usr/bin/env bash

set -euo pipefail

project_dir=$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")" && pwd)
workdir=$(mktemp --directory)
trap 'rm -rf "${workdir}"' EXIT HUP INT TERM

bash -n \
  "${project_dir}/bootstrap-secrets.sh" \
  "${project_dir}/create-ci-kubeconfig.sh" \
  "${project_dir}/deploy.sh" \
  "${project_dir}/install.sh" \
  "${project_dir}/preflight.sh" \
  "${project_dir}/render.sh" \
  "${project_dir}/test.sh"

dependencies=("${project_dir}"/charts/*.tgz)
if (( ${#dependencies[@]} < 2 )); then
  helm dependency build --skip-refresh "${project_dir}"
fi
helm lint "${project_dir}"
helm lint "${project_dir}" --values "${project_dir}/values-arschrock.yaml"
helm template gramps-web "${project_dir}" --namespace gramps-web \
  > "${workdir}/default.yaml"
helm template gramps "${project_dir}" --namespace gramps \
  --values "${project_dir}/values-arschrock.yaml" \
  > "${workdir}/arschrock.yaml"
helm template external "${project_dir}" --namespace gramps \
  --set postgresql.enabled=false \
  --set database.host=postgres.example.internal \
  --set database.auth.existingSecret=external-postgresql \
  --set valkey.enabled=false \
  --set cache.host=valkey.example.internal \
  --set cache.auth.existingSecret=external-valkey \
  > "${workdir}/external.yaml"

grep -Fq 'ghcr.io/gramps-project/grampsweb:latest' "${workdir}/default.yaml"
grep -Fq 'name: GRAMPSWEB_OIDC_ENABLED' "${workdir}/default.yaml"
grep -Fq 'name: postgresql' "${workdir}/arschrock.yaml"
grep -Fq 'name: valkey-primary' "${workdir}/arschrock.yaml"
grep -Fq 'name: grampsweb-celery' "${workdir}/arschrock.yaml"
grep -Fq 'name: gramps-runtime' "${workdir}/arschrock.yaml"
grep -Fq 'path: /ready' "${workdir}/default.yaml"
grep -Fq 'psycopg2.connect' "${workdir}/default.yaml"
grep -Fq 'celery -A gramps_webapi.celery inspect ping' "${workdir}/default.yaml"
if grep -Eq '^kind: StatefulSet$' "${workdir}/external.yaml"; then
  echo "External-service render unexpectedly creates a StatefulSet" >&2
  exit 1
fi

# Block the credential patterns that existed in the legacy raw manifests.
if grep --recursive --extended-regexp --line-number \
  --exclude-dir=.git --exclude-dir=charts --exclude-dir=postgresql \
  --exclude-dir=valkey --exclude=test.sh \
  '(GRAMPSWEB_POSTGRES_PASSWORD:[[:space:]]+[^{$]|OIDC_CLIENT_SECRET:[[:space:]]+[^{$]|AWS_SECRET_ACCESS_KEY:[[:space:]]+[^{$]|password:[[:space:]]+[A-Za-z0-9]{24,})' \
  "${project_dir}"; then
  echo "A likely plaintext credential is present in committable chart sources" >&2
  exit 1
fi

echo "Chart renders successfully with bundled and external data services."