#!/usr/bin/env bash

set -euo pipefail

if [ "$#" -ne 1 ]; then
  echo "Usage: $0 OUTPUT_DIRECTORY" >&2
  exit 2
fi

ROOT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
OUTPUT_DIR="$1"

if [ -e "$OUTPUT_DIR" ]; then
  echo "Output path already exists: $OUTPUT_DIR" >&2
  exit 1
fi
if ! git -C "$ROOT_DIR" -c core.fileMode=false diff --ignore-space-at-eol --quiet \
  || ! git -C "$ROOT_DIR" -c core.fileMode=false diff --cached --quiet; then
  echo "Commit or stash repository changes before creating a public export." >&2
  exit 1
fi

mkdir -p "$OUTPUT_DIR"
git -C "$ROOT_DIR" archive --format=tar HEAD | tar -xf - -C "$OUTPUT_DIR"

# Production deployment is private operational policy, not public source.
rm -f "$OUTPUT_DIR/.gitea/workflows/unraid-deploy.yml"

for forbidden in \
  '.env' '*.pem' '*.key' '*.p12' '*.pfx' '*.db' '*.sqlite' '*.sqlite3' \
  'secret.key' 'id_rsa' 'id_ed25519'; do
  if find "$OUTPUT_DIR" -type f -name "$forbidden" -print -quit | grep -q .; then
    echo "Forbidden file found in public export: $forbidden" >&2
    exit 1
  fi
done

if grep -RIlE --exclude='export-public-source.sh' \
  '192\.168\.10\.150|NuklearRabbit|C:\\Users\\Jens' "$OUTPUT_DIR" >/dev/null; then
  echo "Private deployment marker found in public export." >&2
  exit 1
fi
if find "$OUTPUT_DIR" -type f -size +10M -print -quit | grep -q .; then
  echo "Unexpected file larger than 10 MiB found in public export." >&2
  exit 1
fi

git -C "$OUTPUT_DIR" init -q
git -C "$OUTPUT_DIR" add .
git -C "$OUTPUT_DIR" -c user.name='DevRunbook release export' \
  -c user.email='release-export@invalid.example' \
  commit -q -m "Publish DevRunbook source"

(
  cd "$OUTPUT_DIR"
  git ls-files -z | sort -z | xargs -0 sha256sum > PUBLIC-SOURCE-MANIFEST.sha256
)
git -C "$OUTPUT_DIR" add PUBLIC-SOURCE-MANIFEST.sha256
git -C "$OUTPUT_DIR" -c user.name='DevRunbook release export' \
  -c user.email='release-export@invalid.example' \
  commit -q --amend --no-edit
git -C "$OUTPUT_DIR" tag public-release-baseline

echo "Public source export created at $OUTPUT_DIR"
echo "Commit: $(git -C "$OUTPUT_DIR" rev-parse HEAD)"