#!/usr/bin/env bash
# Build the [tanin] binary repo from our own packages.
#   ./build-tanin-repo.sh            # build what's possible, refresh the DB
#   TANIN_REPO_DIR=/path ./...       # output elsewhere (default ~/projects/tanin-repo)
#
# Coverage:
#   - own simple packages (file installs / metapackage): built here, no sudo.
#   - taninux: needs python-build/installer/hatchling -> built only if present.
#   - AUR rebuilds (eww, tiramisu, waypaper): NOT in official repos; build them
#     separately (paru/makepkg) and drop the .pkg.tar.zst into the repo dir.
#     (cliphist + cage are in extra -> no rebuild needed.)
set -uo pipefail
HERE="$(cd "$(dirname "$0")" && pwd)"
OUT="${TANIN_REPO_DIR:-$HOME/projects/tanin-repo}"
DB="$OUT/tanin.db.tar.zst"
LOGDIR="$OUT/logs"
mkdir -p "$OUT" "$LOGDIR"

# Fail closed: never build/publish unsigned packages. Run packaging/gen-signing-key.sh
# once, then `export GPGKEY=<fingerprint>` (or put it in your shell rc) before building.
GPGKEY="${GPGKEY:-}"
if [ -z "$GPGKEY" ]; then
  echo "!! GPGKEY is not set — refusing to build unsigned packages." >&2
  echo "   Run packaging/gen-signing-key.sh once (if you haven't), then:" >&2
  echo "     export GPGKEY=<packager key fingerprint>" >&2
  exit 1
fi
export GPGKEY

# tanin-icons builds from the installed Adwaita theme -> needs librsvg + python.
OWN_SIMPLE=(tanin-greet tanin-libadwaita tanin-setup tanin-eww tanin-icons tanin-desktop)
OWN_BUILD=(taninux)
AUR_REBUILD=(eww-git tiramisu-git waypaper calamares librewolf-bin
             arch-update timeshift-autosnap xdg-terminal-exec paru)

# makepkg output goes to a per-package log (console stays quiet); inspect the log
# for warnings even on success. Log path is echoed so it's easy to find.
build() {
  local p="$1" log="$LOGDIR/$p.log"
  echo "==> building $p (log: $log)"
  ( cd "$HERE/$p" && makepkg -d -f --sign --noconfirm ) >"$log" 2>&1 \
    && cp "$HERE/$p/"*.pkg.tar.zst "$OUT/" 2>/dev/null \
    && echo "   ok" || { echo "   FAILED ($p) — see $log"; return 1; }
}

for p in "${OWN_SIMPLE[@]}"; do build "$p"; done

for p in "${OWN_BUILD[@]}"; do
  if pacman -Q python-build python-installer python-hatchling >/dev/null 2>&1; then
    build "$p"
  else
    echo "** skip $p — needs: sudo pacman -S python-build python-installer python-hatchling"
  fi
done

echo "** build logs (incl. makepkg warnings) in: $LOGDIR"
echo "** AUR rebuilds TODO (not in official repos): ${AUR_REBUILD[*]}"
echo "   build each with paru/makepkg and copy the .pkg.tar.zst into $OUT, then re-run."

# refresh the DB — packages are signed above (makepkg --sign, key=$GPGKEY);
# sign the DB too so pacman.conf can require Required DatabaseOptional.
shopt -s nullglob
pkgs=("$OUT"/*.pkg.tar.zst)
if (( ${#pkgs[@]} )); then
  ( cd "$OUT" && repo-add -s -k "$GPGKEY" -q "$DB" ./*.pkg.tar.zst >/dev/null 2>&1 )
  echo "== [tanin] repo refreshed at $OUT =="
  ls -1 "$OUT" | grep -E '\.pkg\.tar\.zst$|tanin\.db'
else
  echo "no packages built yet."
fi