#!/usr/bin/env bash
# Release the independently versioned imgproxy runtime. Never run this from a
# feature branch; it is intentionally separate from the Portal runtime bundle.
set -euo pipefail

ROOT="$(cd "$(dirname "$0")/.." && pwd)"
HOST="${STUDIO_HOST:-john@58.38.22.103}"
REMOTE_ROOT="${STUDIO_REMOTE_ROOT:-/Users/john/Project}"
DOCKER_BIN="${DOCKER_BIN:-/opt/homebrew/bin/docker}"
RUNTIME_BASE="$REMOTE_ROOT/imgproxy-runtime"
INCOMING="$REMOTE_ROOT/incoming/imgproxy-runtime"
RELEASE_ID="$(date +%Y%m%d-%H%M%S)-$(git -C "$ROOT" rev-parse --short HEAD)"
TMP="$(mktemp -d "${TMPDIR:-/tmp}/imgproxy-runtime-release.XXXXXX")"
cleanup() { rm -rf "$TMP"; }
trap cleanup EXIT

git -C "$ROOT" fetch origin main --quiet
branch="$(git -C "$ROOT" branch --show-current)"
[[ "$branch" == release/* ]] || { echo 'imgproxy production release must run from a release/* branch' >&2; exit 1; }
[[ -z "$(git -C "$ROOT" status --porcelain)" ]] || { echo 'worktree must be clean' >&2; exit 1; }
[[ "$(git -C "$ROOT" rev-parse HEAD)" == "$(git -C "$ROOT" rev-parse origin/main)" ]] || { echo 'main must match origin/main' >&2; exit 1; }
bash "$ROOT/scripts/check-release-ready.sh"

bash "$ROOT/scripts/build-imgproxy-runtime-image.sh"
IMAGE_DIR="$ROOT/.runtime/imgproxy"
for file in imgproxy-runtime-image.tar.gz imgproxy-runtime-image.tar.gz.sha256 image-tag.txt; do
  [[ -f "$IMAGE_DIR/$file" ]] || { echo "missing image artifact: $file" >&2; exit 1; }
done

mkdir -p "$TMP/runtime"
cp "$IMAGE_DIR"/* "$TMP/runtime/"
cp "$ROOT/scripts/install-imgproxy-runtime-prod.sh" "$ROOT/scripts/imgproxy-compat-proxy.mjs" "$TMP/runtime/"
chmod 755 "$TMP/runtime/install-imgproxy-runtime-prod.sh"
tar -C "$TMP" -czf "$TMP/imgproxy-runtime-$RELEASE_ID.tar.gz" runtime
(cd "$TMP" && shasum -a 256 "imgproxy-runtime-$RELEASE_ID.tar.gz" > "imgproxy-runtime-$RELEASE_ID.tar.gz.sha256")

ssh -o BatchMode=yes "$HOST" "mkdir -p '$INCOMING'"
scp -q "$TMP/imgproxy-runtime-$RELEASE_ID.tar.gz" "$TMP/imgproxy-runtime-$RELEASE_ID.tar.gz.sha256" "$HOST:$INCOMING/"
ssh -o BatchMode=yes "$HOST" "RELEASE_ID='$RELEASE_ID' RUNTIME_BASE='$RUNTIME_BASE' INCOMING='$INCOMING' bash -s" <<'REMOTE'
set -euo pipefail
archive="$INCOMING/imgproxy-runtime-$RELEASE_ID.tar.gz"
sha="$archive.sha256"
cd "$INCOMING"
shasum -a 256 -c "$sha"
release_dir="$RUNTIME_BASE/releases/$RELEASE_ID"
mkdir -p "$release_dir" "$RUNTIME_BASE/backups"
cp "$HOME/Library/LaunchAgents/cn.tkmind.imgproxy-compat.plist" "$RUNTIME_BASE/backups/imgproxy-compat-$RELEASE_ID.plist" 2>/dev/null || true
tar -xzf "$archive" -C "$release_dir" --strip-components=1
cd "$release_dir"
shasum -a 256 -c imgproxy-runtime-image.tar.gz.sha256
gunzip -c imgproxy-runtime-image.tar.gz | "$DOCKER_BIN" load
image_tag="$(cat image-tag.txt)"
IMGPROXY_RUNTIME_DIR="$release_dir" IMGPROXY_IMAGE_TAG="$image_tag" bash ./install-imgproxy-runtime-prod.sh
ln -sfn "$release_dir" "$RUNTIME_BASE/current"
curl -fsS --max-time 5 http://127.0.0.1:20082/health >/dev/null
curl -fsS --max-time 5 http://10.10.0.2:20081/health >/dev/null
REMOTE

curl -kfsS --max-time 15 https://img.tkmind.cn/health >/dev/null
printf 'imgproxy release verified: %s\n' "$RELEASE_ID"