#!/usr/bin/env bash
set -Eeuo pipefail

readonly ARMBIAN_DIR="$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")/.." && pwd -P)"

bash -n \
	"${ARMBIAN_DIR}/build-image.sh" \
	"${ARMBIAN_DIR}/userpatches/config-rk1-media.conf" \
	"${ARMBIAN_DIR}/userpatches/customize-image.sh" \
	"${ARMBIAN_DIR}/userpatches/extensions/rkbin-tools.sh" \
	"${ARMBIAN_DIR}/userpatches/overlay/rootfs/usr/local/sbin/rk1-media-first-boot"

# shellcheck source=../userpatches/source-lock.env
source "${ARMBIAN_DIR}/userpatches/source-lock.env"
for revision in \
	"${RK1_MEDIA_ARMBIAN_BUILD_COMMIT}" \
	"${RK1_MEDIA_KERNEL_COMMIT}" \
	"${RK1_MEDIA_UBOOT_COMMIT}" \
	"${RK1_MEDIA_RKBIN_COMMIT}" \
	"${RK1_MEDIA_FIRMWARE_COMMIT}"; do
	[[ "${revision}" =~ ^[0-9a-f]{40}$ ]] || { echo "Invalid pinned revision: ${revision}" >&2; exit 1; }
done

jq -e --arg revision "${RK1_MEDIA_FIRMWARE_COMMIT}" \
	'. == [{"source":"https://github.com/armbian/firmware","branch":"master","sha1":$revision}]' \
	"${ARMBIAN_DIR}/framework-overrides/config/sources/git_sources.json" >/dev/null

[[ ! -e "${ARMBIAN_DIR}/userpatches/overlay/build-input/authorized_keys" ]] || {
	echo "A staged administrator key must not be committed to userpatches/overlay/build-input" >&2
	exit 1
}

if command -v apt-config >/dev/null; then
	apt_dump="$(apt-config -c "${ARMBIAN_DIR}/userpatches/overlay/rootfs/etc/apt/apt.conf.d/52rk1-media-unattended-upgrades" dump)"
	[[ "$(grep -c '^Unattended-Upgrade::Origins-Pattern:: ' <<< "${apt_dump}")" == "1" ]] || {
		echo "Unattended upgrades must contain exactly one allowed origin" >&2
		exit 1
	}
	grep -q 'codename=${distro_codename}-security' <<< "${apt_dump}" || {
		echo "Debian security origin is missing from unattended-upgrades policy" >&2
		exit 1
	}
fi

if command -v shellcheck >/dev/null; then
	shellcheck --exclude=SC1091,SC2154 \
		"${ARMBIAN_DIR}/build-image.sh" \
		"${ARMBIAN_DIR}/userpatches/config-rk1-media.conf" \
		"${ARMBIAN_DIR}/userpatches/customize-image.sh" \
		"${ARMBIAN_DIR}/userpatches/extensions/rkbin-tools.sh" \
		"${ARMBIAN_DIR}/userpatches/overlay/rootfs/usr/local/sbin/rk1-media-first-boot"
fi

echo "Armbian scaffolding checks passed."