#!/usr/bin/env bash
# Monorepo release script for test-collector-python: build the package,
# check it with twine, check tag/version consistency, then publish — but
# only in the publish step, which sets RELEASE_PUBLISH=true in its own
# container (see pipeline.release.yml); the pre-confirmation build step runs
# this same script as a side-effect-free rehearsal, even on tag builds.
# Everything before the upload runs in rehearsals too, so dry-runs exercise
# this code.
#
# Injected by `ctg gather` from the ctg repo's overlay/ directory during the
# dry-run era; post-cutover this file is maintained here, in the monorepo.

set -euo pipefail

cd "$(dirname "$0")/../.." # this project's root, wherever the checkout cwd is

PROJECT="test-collector-python"
TAG_PATTERN="^${PROJECT}/v([0-9]+\.[0-9]+\.[0-9]+((a|b|rc)[0-9]+)?)$"

echo "--- Determining version"
PACKAGE_VERSION="$(python3 -c "import tomllib; print(tomllib.load(open('pyproject.toml', 'rb'))['project']['version'])")"
if [ -n "${BUILDKITE_TAG:-}" ]; then
  if [[ ! "${BUILDKITE_TAG}" =~ ${TAG_PATTERN} ]]; then
    echo "BUILDKITE_TAG '${BUILDKITE_TAG}' does not match ${PROJECT}/vX.Y.Z with optional aN, bN or rcN suffix; refusing" >&2
    exit 1
  fi
  VERSION="${BASH_REMATCH[1]}"
  if [ "${VERSION}" != "${PACKAGE_VERSION}" ]; then
    echo "tag says ${VERSION} but pyproject.toml says ${PACKAGE_VERSION}; refusing" >&2
    exit 1
  fi
  echo "version ${VERSION} (tag ${BUILDKITE_TAG} matches pyproject.toml)"
else
  VERSION="${PACKAGE_VERSION}"
  echo "version ${VERSION} (from pyproject.toml; no tag)"
fi

echo "--- Updating release trust stores (CVE-2026-111943)"
# Both release jobs use python:3.13 (Debian). Bootstrap patched uv using
# refreshed system CAs, without using pip's potentially stale vendored CAs.
apt-get update
apt-get install --yes --only-upgrade ca-certificates
curl -LsSf https://astral.sh/uv/0.13.4/install.sh | sh
source "$HOME/.local/bin/env"
uv pip install --system --python python3 --upgrade "pip>=26.2.2" "certifi>=2026.10.19"

echo "--- Building package"
uv build

echo "--- Checking package"
# twine via uvx (latest), not the project's locked dev-dependency: uv build
# uses an isolated, current build backend (hatchling), whose metadata can be
# newer than the locked twine/packaging understand — e.g. Metadata-Version
# 2.5 vs twine 6.1.0, which failed bktest-release build #8.
# Constrain certifi in this isolated environment too, including cached tools.
uvx --with "certifi>=2026.10.19" twine check dist/*

if [ "${RELEASE_PUBLISH:-}" != "true" ]; then
  echo "--- Rehearsal only"
  echo "RELEASE_PUBLISH is not 'true': stopping before 'twine upload dist/*'."
  exit 0
fi

echo "--- Publishing to PyPI"
if [ -z "${BUILDKITE_TAG:-}" ]; then
  echo "RELEASE_PUBLISH=true without a ${PROJECT}/vX.Y.Z tag (optionally aN, bN or rcN); refusing" >&2
  exit 1
fi
if [ -z "${TWINE_PASSWORD:-}" ]; then
  echo "TWINE_PASSWORD not set (AWS OIDC/SSM plugins missing or failed)" >&2
  exit 1
fi
uvx --with "certifi>=2026.10.19" twine upload --skip-existing dist/*
