#!/usr/bin/env bash
# SPDX-License-Identifier: AGPL-3.0-or-later
# Copyright (c) 2025-2026 Cristian Cezar Moisés

set -Eeuo pipefail
export LC_ALL=C

root=$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")/.." && pwd -P)
cd -- "$root"

pass_count=0
fail_count=0
skip_count=0
pass() { pass_count=$((pass_count + 1)); printf 'PASS: %s\n' "$*"; }
fail() { fail_count=$((fail_count + 1)); printf 'FAIL: %s\n' "$*" >&2; }
skip() { skip_count=$((skip_count + 1)); printf 'SKIP: %s\n' "$*"; }

has_exact_line_crlf_safe() {
    local expected=$1 path=$2 line
    while IFS= read -r line || [[ -n $line ]]; do
        line=${line%$'\r'}
        if [[ $line == "$expected" ]]; then
            return 0
        fi
    done < "$path"
    return 1
}

version=$(sed -n 's/^#define ZUPT_VERSION_STRING "\([^"]*\)".*/\1/p' include/zupt.h)
[[ -n $version ]] || { printf 'FAIL: cannot determine upstream version\n' >&2; exit 1; }

for script in packaging/build-deb.sh packaging/build-rpm.sh \
    packaging/build-appimage.sh packaging/build-gui-appimage.sh \
    packaging/build-gui-deb.sh packaging/build-gui-rpm.sh \
    gui/packaging/appimage/build-appimage.sh packaging/build-dmg.sh \
    scripts/check-source-only.sh scripts/export-opensuse-package.sh \
    scripts/test-installed-zupt.sh packaging/opensuse/source-audit.sh; do
    if bash -n "$script"; then pass "$script shell syntax"; else fail "$script shell syntax"; fi
done

if ! command -v make >/dev/null 2>&1; then
    skip 'make unavailable for Debian rules syntax'
elif make -n -f packaging/debian/rules override_dh_auto_build >/dev/null; then
    pass 'Debian rules make syntax'
else
    fail 'Debian rules make syntax'
fi

check_recipe_version() {
    local recipe=$1 recipe_version=$2
    if [[ $recipe_version == "$version" ]]; then
        pass "$recipe version is $version"
    else
        fail "$recipe version is '$recipe_version' (expected $version)"
    fi
}

check_recipe_version AUR \
    "$(sed -n 's/^pkgver=//p' packaging/aur/PKGBUILD)"
check_recipe_version Debian \
    "$(sed -n '1s/^zupt (\([^-]*\)-.*/\1/p' packaging/debian/changelog)"
check_recipe_version Fedora \
    "$(awk '/^Version:/{print $2; exit}' packaging/rpm/zupt.spec)"
check_recipe_version Homebrew \
    "$(sed -n 's/^[[:space:]]*version "\([^"]*\)".*/\1/p' packaging/homebrew/zupt.rb)"
check_recipe_version Nix \
    "$(sed -n 's/^[[:space:]]*version = "\([^"]*\)";.*/\1/p' packaging/nix/flake.nix | head -1)"
check_recipe_version Guix \
    "$(sed -n 's/^(define %zupt-version "\([^"]*\)")/\1/p' packaging/guix/zupt.scm)"
check_recipe_version openSUSE \
    "$(awk '/^Version:/{print $2; exit}' packaging/opensuse/zupt.spec)"
check_recipe_version GUI-Deb-Control \
    "$(awk '/^Version:/{print $2; exit}' gui/packaging/deb/control)"

if grep -Fqx "VERSION=\${VERSION:-$version}" install.sh && \
   has_exact_line_crlf_safe \
       "if not defined VERSION set \"VERSION=$version\"" \
       gui/packaging/windows/build-windows.bat && \
   grep -Fqx "Depends: python3 (>= 3.9), python3-pyqt6 | python3-pyside6.qtwidgets, zupt (= $version)" \
       gui/packaging/deb/control; then
    pass 'installer and static GUI package defaults match the upstream version'
else
    fail 'installer or static GUI package defaults do not match the upstream version'
fi

if grep -En 'REPLACE_AFTER|REPLACE_WITH|sha256sums=\(.SKIP.|base32 .REPLACE' \
    packaging/aur/PKGBUILD packaging/homebrew/zupt.rb packaging/guix/zupt.scm; then
    if git tag --points-at HEAD 2>/dev/null | grep -Fxq "v$version"; then
        fail 'tagged release recipes contain an unpinned source checksum'
    else
        pass 'release recipe checksums are explicitly pending final archive generation'
    fi
else
    pass 'release recipe source checksums are pinned'
fi

if [[ -x packaging/debian/rules ]]; then
    pass 'Debian rules is executable'
else
    fail 'Debian rules is not executable'
fi
if command -v dpkg-parsechangelog >/dev/null 2>&1; then
    if dpkg-parsechangelog -l packaging/debian/changelog >/dev/null; then
        pass 'Debian changelog parses'
    else
        fail 'Debian changelog does not parse'
    fi
else
    skip 'dpkg-parsechangelog unavailable'
fi

if command -v ruby >/dev/null 2>&1; then
    if ruby -c packaging/homebrew/zupt.rb >/dev/null; then
        pass 'Homebrew formula Ruby syntax'
    else
        fail 'Homebrew formula Ruby syntax'
    fi
else
    skip 'Ruby unavailable for Homebrew syntax'
fi

if command -v nix-instantiate >/dev/null 2>&1; then
    if nix-instantiate --parse packaging/nix/flake.nix >/dev/null; then
        pass 'Nix flake syntax'
    else
        fail 'Nix flake syntax'
    fi
else
    skip 'nix-instantiate unavailable for flake syntax'
fi

if command -v guile >/dev/null 2>&1; then
    if guile -c '(use-modules (guix gexp)) (call-with-input-file "packaging/guix/zupt.scm" (lambda (p) (let loop ((x (read p))) (unless (eof-object? x) (loop (read p))))))'; then
        pass 'Guix recipe reader syntax'
    else
        fail 'Guix recipe reader syntax'
    fi
else
    skip 'Guile unavailable for Guix syntax'
fi

if command -v xmllint >/dev/null 2>&1; then
    if xmllint --noout packaging/opensuse/_service; then
        pass 'openSUSE service XML'
    else
        fail 'openSUSE service XML'
    fi
elif python3 -c 'import xml.etree.ElementTree as E; E.parse("packaging/opensuse/_service")' 2>/dev/null; then
    pass 'openSUSE service XML (Python parser)'
else
    fail 'openSUSE service XML'
fi

service=packaging/opensuse/_service
spec=packaging/opensuse/zupt.spec
if grep -Fq '<service name="obs_scm"' "$service" && \
   grep -Fq '<param name="url">https://github.com/cristiancmoises/zupt.git</param>' "$service" && \
   grep -Fq "<param name=\"revision\">refs/tags/v$version</param>" "$service" && \
   grep -Fq '<param name="submodules">disable</param>' "$service" && \
   grep -Fq '<param name="lfs">disable</param>' "$service" && \
   grep -Fq '<service name="tar" mode="buildtime"' "$service" && \
   grep -Fq '<service name="recompress" mode="buildtime"' "$service"; then
    pass 'openSUSE services use canonical immutable source-only input'
else
    fail 'openSUSE services do not use the required immutable source-only input'
fi

if grep -Fq 'APPIMAGE_RUNTIME_COMPLIANCE_FILE' packaging/build-appimage.sh && \
   grep -Fq 'APPIMAGE_RUNTIME_COMPLIANCE_FILE' packaging/build-gui-appimage.sh && \
   grep -Fq 'AppImage-runtime-compliance.txt' packaging/build-appimage.sh && \
   grep -Fq 'AppImage-runtime-compliance.txt' packaging/build-gui-appimage.sh; then
    pass 'AppImage helpers require and bundle external compliance evidence'
else
    fail 'AppImage helper compliance policy is incomplete'
fi

if ! grep -Eiq 'release-appimage|appimagetool|APPIMAGE_RUNTIME_FILE|[.]AppImage' \
        .github/workflows/ci.yml .github/workflows/cross-platform.yml \
        .github/workflows/promote-release.yml; then
    pass 'release workflows do not build or promote AppImage assets'
else
    fail 'a release workflow still builds or promotes an AppImage asset'
fi

if grep -Fq 'archive declared-size limit exceeded before extraction' scripts/check-source-only.sh && \
   grep -Fq 'global archive declared-size budget exceeded' scripts/check-source-only.sh && \
   grep -Fq 'SOURCE_AUDIT_ARCHIVE_SECONDS' scripts/check-source-only.sh && \
   grep -Fq 'compressed archive declared size is rejected before extraction' tests/test_source_only.sh; then
    pass 'source scanner bounds archive members, expansion and CPU time before extraction'
else
    fail 'source scanner archive resource bounds or regressions are incomplete'
fi

tumbleweed_job=$(sed -n '/^  tumbleweed-rpm:/,/^  gui-rpm-package:/p' \
    .github/workflows/ci.yml)
fedora_gui_job=$(sed -n '/^  gui-rpm-package:/,/^  linux-portable:/p' \
    .github/workflows/ci.yml)
if grep -Fq 'os.chdir(service_dir)' <<<"$tumbleweed_job"; then
    pass 'OBS service executor enters its isolated working directory'
else
    fail 'OBS service executor does not enter its isolated working directory'
fi

# These matches intentionally assert the literal Actions variable in YAML.
# shellcheck disable=SC2016
if grep -Fq 'git config --global --add safe.directory "$GITHUB_WORKSPACE"' \
        <<<"$tumbleweed_job" && \
   grep -Fq 'if rpm -q busybox-gawk >/dev/null 2>&1; then' \
        <<<"$tumbleweed_job" && \
   grep -Fq 'zypper --non-interactive remove busybox-gawk' \
        <<<"$tumbleweed_job" && \
   grep -Fq 'git config --global --add safe.directory "$GITHUB_WORKSPACE"' \
        <<<"$fedora_gui_job"; then
    pass 'RPM container jobs trust the exact workspace and replace busybox-gawk'
else
    fail 'RPM container workspace trust or busybox-gawk replacement is incomplete'
fi

# These are literal shell expressions required inside the promotion workflow.
# shellcheck disable=SC2016
if grep -Fq 'zupt-gui_${VERSION}_all.deb' .github/workflows/promote-release.yml && \
   grep -Fq 'zupt-gui-$VERSION-1.noarch.rpm' .github/workflows/promote-release.yml && \
   grep -Fq 'zupt-gui-$VERSION-1.src.rpm' .github/workflows/promote-release.yml && \
   grep -Fq 'zupt-$VERSION-linux-x86_64.tar.xz' .github/workflows/promote-release.yml && \
   grep -Fq 'zupt-gui-$VERSION-portable.zip' .github/workflows/promote-release.yml && \
   grep -Fq 'zupt >= $VERSION' .github/workflows/promote-release.yml; then
    pass 'release promotion allowlists gated CLI and GUI package formats'
else
    fail 'release promotion is missing a gated package format or dependency check'
fi

if ! grep -Eqi 'git[.]securityops[.]co|forgejo|canonical server|GitHub mirror' \
        .github/workflows/promote-release.yml && \
   grep -Fq 'GitHub is the canonical upstream release' \
        .github/workflows/promote-release.yml; then
    pass 'GitHub is the sole canonical release target'
else
    fail 'release promotion still depends on a non-GitHub canonical forge'
fi

if grep -Fq 'path: out/*.zip' .github/workflows/cross-platform.yml && \
   ! grep -Fq 'out/*.exe' .github/workflows/cross-platform.yml && \
   grep -Fq 'windows_zip_name=' .github/workflows/promote-release.yml && \
   ! grep -Fq 'windows_exe_name=' .github/workflows/promote-release.yml; then
    pass 'Windows release policy promotes the notice-bearing ZIP only'
else
    fail 'Windows workflow still permits a bare EXE release asset'
fi

windows_notices_ok=1
for notice in MINGW-CRT-COPYING.txt COPYING.MinGW-w64-runtime.txt \
    COPYING.MinGW-w64.txt GCC-COPYING3.txt \
    GCC-RUNTIME-LIBRARY-EXCEPTION.txt; do
    grep -Fq "$notice" .github/workflows/cross-platform.yml || \
        windows_notices_ok=0
    grep -Fq "$notice" .github/workflows/promote-release.yml || \
        windows_notices_ok=0
done
if ((windows_notices_ok)); then
    pass 'static Windows bundle preserves MinGW and GCC runtime notices'
else
    fail 'static Windows bundle omits MinGW or GCC runtime notices'
fi

if grep -Eiq 'AppImage.*(not|excluded|outside)' SECURITY.md && \
   grep -Eiq 'AppImage.*(not|excluded|outside)' THREAT_MODEL.md && \
   grep -Eiq 'AppImage.*(not|excluded|outside)' AUDIT.md && \
   grep -Eiq 'AppImage.*(not|excluded|outside)' doc/zupt.1; then
    pass 'current security and user documentation records release exclusions'
else
    fail 'current documentation still permits an AppImage or bare EXE claim'
fi

handoff_legal_ok=1
for legal_file in LICENSE LICENSE-AGPL-3.0 LICENSE-GPL-3.0 LICENSE-COMMERCIAL \
    LICENSE-BSD-2-Clause LICENSE-BSD-3-Clause LICENSE-CC0-1.0 \
    NOTICE THIRD-PARTY-NOTICES.md; do
    grep -Fq "$legal_file" scripts/export-opensuse-package.sh || \
        handoff_legal_ok=0
done
if ((handoff_legal_ok)) && \
   grep -Fq 'handoff legal file is missing or empty' scripts/export-opensuse-package.sh; then
    pass 'openSUSE handoff includes and checks complete public legal payload'
else
    fail 'openSUSE handoff omits or does not validate a public legal file'
fi

if grep -Fq 'PYTHON-NOTICE.txt' gui/packaging/windows/build-windows.bat && \
   grep -Fq 'PYINSTALLER-NOTICE.txt' gui/packaging/windows/build-windows.bat && \
   grep -Fq 'QT-NOTICE.txt' gui/packaging/windows/build-windows.bat && \
   grep -Fq 'PYSIDE6-NOTICE.txt' gui/packaging/windows/build-windows.bat && \
   grep -Fq 'PYQT6-NOTICE.txt' gui/packaging/windows/build-windows.bat; then
    pass 'downstream Windows GUI helper requires every runtime notice class'
else
    fail 'downstream Windows GUI helper permits incomplete runtime notices'
fi

if grep -Eq '^Name:[[:space:]]+zupt$' "$spec" && \
   grep -Eq '^Source0:[[:space:]]+%\{name\}-%\{version\}\.tar\.gz$' "$spec" && \
   grep -Eq '^License:[[:space:]]+AGPL-3\.0-or-later AND GPL-3\.0-or-later AND BSD-2-Clause AND BSD-3-Clause AND CC0-1\.0$' "$spec" && \
   grep -Eq '^Provides:[[:space:]]+bundled\(vaptvupt-codec\) = 2\.65\.3$' "$spec" && \
   grep -Eq '^Provides:[[:space:]]+vaptvupt = %\{version\}-%\{release\}$' "$spec" && \
   grep -Eq '^Obsoletes:[[:space:]]+vaptvupt < %\{version\}$' "$spec" && \
   grep -Fq 'WITH_SDK=0 WITH_PQBOX=0' "$spec" && \
   grep -Fq 'INSTALL_LEGACY_ALIAS=0' "$spec" && \
   grep -Fq 'INSTALL_LICENSES=0' "$spec" && \
   grep -Fq '%{_bindir}/zupt' "$spec" && \
   ! grep -Fq '%{_bindir}/vaptvupt' "$spec"; then
    pass 'openSUSE spec source, license, features and alias policy'
else
    fail 'openSUSE spec source, license, features or alias policy'
fi

if grep -Fq 'LICENSE-BSD-3-Clause' packaging/build-deb.sh && \
   grep -Fq 'LICENSE-CC0-1.0' packaging/build-deb.sh && \
   [[ $(grep -Fc 'LICENSE-BSD-3-Clause' packaging/build-dmg.sh) -ge 2 ]] && \
   [[ $(grep -Fc 'LICENSE-CC0-1.0' packaging/build-dmg.sh) -ge 2 ]] && \
   grep -Fq 'LICENSE-BSD-3-Clause' packaging/build-appimage.sh && \
   grep -Fq 'LICENSE-CC0-1.0' packaging/build-appimage.sh && \
   grep -Fq 'LICENSE-BSD-3-Clause' packaging/build-gui-appimage.sh && \
   grep -Fq 'LICENSE-CC0-1.0' packaging/build-gui-appimage.sh && \
   grep -Fq 'LICENSE-BSD-3-Clause' .github/workflows/cross-platform.yml && \
   grep -Fq 'LICENSE-CC0-1.0' .github/workflows/cross-platform.yml && \
   grep -Fq 'LICENSE-BSD-3-Clause' .github/workflows/promote-release.yml && \
   grep -Fq 'LICENSE-CC0-1.0' .github/workflows/promote-release.yml && \
   grep -Fq 'LICENSE-BSD-3-Clause' packaging/debian/zupt.docs && \
   grep -Fq 'LICENSE-CC0-1.0' packaging/debian/zupt.docs; then
    pass 'binary bundle paths preserve BSD-3-Clause and CC0-1.0 texts'
else
    fail 'a binary bundle path omits BSD-3-Clause or CC0-1.0 text'
fi

if grep -Fq 'LICENSE-BSD-3-Clause' gui/packaging/flatpak/dev.zupt.gui.yml && \
   grep -Fq 'LICENSE-CC0-1.0' gui/packaging/flatpak/dev.zupt.gui.yml && \
   grep -Fq 'ZUPT_WINDOWS_RUNTIME_NOTICES_DIR' gui/packaging/windows/build-windows.bat && \
   grep -Fq 'MANIFEST.txt' gui/packaging/windows/build-windows.bat && \
   grep -Fq 'LICENSE-BSD-3-Clause' packaging/windows/zupt-gui.iss && \
   grep -Fq 'LICENSE-CC0-1.0' packaging/windows/zupt-gui.iss && \
   grep -Fq 'RuntimeNoticesDir' packaging/windows/zupt-gui.iss && \
   grep -Fq 'LICENSE-BSD-3-Clause' sdk/Makefile.sdk && \
   grep -Fq 'LICENSE-CC0-1.0' sdk/Makefile.sdk && \
   grep -Fq 'LICENSE-BSD-3-Clause' packaging/homebrew/zupt.rb && \
   grep -Fq 'LICENSE-CC0-1.0' packaging/nix/flake.nix && \
   grep -Fq 'LICENSEDIR' Makefile && \
   grep -Fq 'LICENSE-BSD-3-Clause' Makefile && \
   grep -Fq 'LICENSE-GUI' gui/install.sh; then
    pass 'auxiliary bundles install project and external-runtime notices'
else
    fail 'an auxiliary bundle omits project or external-runtime notices'
fi

if command -v rpmspec >/dev/null 2>&1; then
    if rpmspec -P "$spec" >/dev/null; then
        pass 'openSUSE spec parses with rpmspec'
    else
        fail 'openSUSE spec rpmspec parse'
    fi
else
    skip 'rpmspec unavailable'
fi

if command -v shellcheck >/dev/null 2>&1; then
    shell_files=(
        packaging/build-deb.sh
        packaging/build-rpm.sh
        packaging/build-appimage.sh
        packaging/build-gui-appimage.sh
        packaging/build-gui-deb.sh
        packaging/build-gui-rpm.sh
        gui/packaging/appimage/build-appimage.sh
        packaging/build-dmg.sh
        packaging/opensuse/source-audit.sh
        scripts/check-source-only.sh
        scripts/export-opensuse-package.sh
        scripts/test-installed-zupt.sh
        tests/test_source_only.sh
        tests/test_packaging_syntax.sh
    )
    if shellcheck -x "${shell_files[@]}"; then
        pass 'ShellCheck tracked shell scripts'
    else
        fail 'ShellCheck tracked shell scripts'
    fi
else
    skip 'ShellCheck unavailable'
fi

for workflow in .github/workflows/*.yml; do
    if grep -Eq 'pull_request_target:' "$workflow"; then
        fail "$workflow uses pull_request_target"
    else
        pass "$workflow avoids pull_request_target"
    fi
    if grep -Eqi 'git[[:space:]]+push|credential\.helper[[:space:]]+store' "$workflow"; then
        fail "$workflow contains unsafe publishing command"
    else
        pass "$workflow avoids direct Git credential mutation"
    fi
done

printf 'SUMMARY: PASS=%d FAIL=%d SKIP=%d\n' "$pass_count" "$fail_count" "$skip_count"
((fail_count == 0))