#!/usr/bin/env bash
# Complete the [tanin] repo — the steps that need sudo + network:
#   1) build taninux (installs its python build deps)
#   2) rebuild the AUR-only deps into the repo: eww, tiramisu, waypaper
#      (cliphist + cage are in extra -> not rebuilt)
#   3) refresh the DB
# Run as YOUR user (NOT root); it will sudo where needed:
#   ./finish-tanin-repo.sh
set -uo pipefail
HERE="$(cd "$(dirname "$0")" && pwd)"
OUT="${TANIN_REPO_DIR:-$HOME/projects/tanin-repo}"
mkdir -p "$OUT"

# Fail closed: never build/publish unsigned packages. Run packaging/gen-signing-key.sh
# once, then `export GPGKEY=<fingerprint>` before running this script.
GPGKEY="${GPGKEY:-}"
if [ -z "$GPGKEY" ]; then
  echo "!! GPGKEY is not set — refusing to build unsigned packages." >&2
  echo "   Run packaging/gen-signing-key.sh once (if you haven't), then:" >&2
  echo "     export GPGKEY=<packager key fingerprint>" >&2
  exit 1
fi
export GPGKEY

echo "==> taninux (+ build deps)"
sudo pacman -S --needed --noconfirm python-build python-installer python-hatchling
( cd "$HERE/taninux" && makepkg -sf --sign --noconfirm ) \
  && cp "$HERE/taninux/"*.pkg.tar.zst "$OUT/" && echo "   ok" || echo "   FAILED (taninux)"

AUR_PKGS="eww-git tiramisu-git waypaper calamares librewolf-bin arch-update timeshift-autosnap xdg-terminal-exec paru"
echo "==> AUR rebuilds: $AUR_PKGS"
tmp="$(mktemp -d)"
for p in $AUR_PKGS; do
  echo "  -- $p"
  if git clone --depth=1 "https://aur.archlinux.org/$p.git" "$tmp/$p" >/dev/null 2>&1 \
     && ( cd "$tmp/$p" && makepkg -sf --sign --noconfirm ); then
    cp "$tmp/$p/"*.pkg.tar.zst "$OUT/" && echo "     ok"
  else
    echo "     FAILED ($p)"
  fi
done
rm -rf "$tmp"

echo "==> refresh DB (signed with $GPGKEY)"
( cd "$OUT" && repo-add -s -k "$GPGKEY" -q "$OUT/tanin.db.tar.zst" "$OUT"/*.pkg.tar.zst )
echo "== [tanin] now contains =="
ls -1 "$OUT" | grep -E '\.pkg\.tar\.zst$|tanin\.db$'
echo
echo "Next: host it. Gitea (1.26) has an Arch registry on git.openbureau.ch —"
echo "Claude can upload these with the existing token, or use a static dir behind taninux.kgva.ch."