"""Commit only the infrastructure pin, deploy that commit, revert on failure."""

import json
import os
import re
import subprocess
import tempfile
from pathlib import Path


def run(*args, **kwargs):
    return subprocess.check_output(args, text=True, **kwargs).strip()


def main():
    revision = run("git", "rev-parse", "HEAD")
    repository = os.environ["NIXOS_FLAKE_REPOSITORY"]
    branch = os.environ.get("NIXOS_FLAKE_BRANCH", "main")
    server = os.environ["FORGEJO_SERVER_URL"].rstrip("/")
    if not re.fullmatch(r"[\w.-]+/[\w.-]+", repository):
        raise ValueError("Invalid infrastructure repository")
    with tempfile.TemporaryDirectory(prefix="tensamin-deploy-") as temporary:
        root = Path(temporary)
        askpass = root / "askpass"
        askpass.write_text('#!/bin/sh\ncase "$1" in *Username*) printf "%s\\n" token;; *) printf "%s\\n" "$NIXOS_FLAKE_WRITE_TOKEN";; esac\n')
        askpass.chmod(0o700)
        env = os.environ | {"GIT_ASKPASS": str(askpass), "GIT_TERMINAL_PROMPT": "0"}
        checkout = root / "infrastructure"
        run("git", "clone", "--branch", branch, "--single-branch", f"{server}/{repository}.git", str(checkout), env=env)
        original = run("git", "rev-parse", "HEAD", cwd=checkout)
        # Fail before pushing if the forced command has not adopted the new contract.
        wrapper = (checkout / "garten/tensamin-prod/services/deploy.nix").read_text()
        if "<nixos-flake commit SHA>" not in wrapper:
            raise RuntimeError("Deployment wrapper must accept <nixos-flake commit SHA> before promotion")
        url = f"git+ssh://git@methanium.net/{os.environ['FORGEJO_REPOSITORY']}?ref=main&rev={revision}"
        run("nix", "flake", "lock", "--override-input", "prod-pins", url, cwd=checkout)
        lock = json.loads((checkout / "flake.lock").read_text())
        if lock["nodes"][lock["nodes"]["root"]["inputs"]["prod-pins"]]["locked"]["rev"] != revision:
            raise RuntimeError("Infrastructure pin mismatch")
        run("git", "add", "flake.lock", cwd=checkout)
        identity = ["git", "-c", "user.name=Tensamin releases", "-c", "user.email=releases@tensamin.net"]
        changed = subprocess.run(["git", "diff", "--cached", "--quiet"], cwd=checkout, check=False).returncode
        if changed not in {0, 1}:
            raise RuntimeError("Unable to inspect infrastructure pin changes")
        if changed:
            run(*identity, "commit", "-m", f"tensamin-prod: pin {revision}", cwd=checkout)
        commit = run("git", "rev-parse", "HEAD", cwd=checkout)
        key = root / "deploy-key"
        key.write_text(os.environ["TENSAMIN_PROD_DEPLOY_SSH_KEY"] + "\n")
        key.chmod(0o600)
        known = root / "known_hosts"
        known.write_text(os.environ["TENSAMIN_SSH_KNOWN_HOSTS"] + "\n")
        config = root / "ssh_config"
        host = os.environ["TENSAMIN_PROD_DEPLOY_HOST"]
        port = os.environ.get("TENSAMIN_PROD_DEPLOY_PORT", "22")
        jump_host = os.environ.get("TENSAMIN_PROD_DEPLOY_JUMP_HOST", "")
        jump_port = os.environ.get("TENSAMIN_PROD_DEPLOY_JUMP_PORT", "7930")
        for hostname in [host, jump_host]:
            if hostname and not re.fullmatch(r"[A-Za-z0-9_.:-]+", hostname):
                raise ValueError("Invalid deployment SSH hostname")
        for value in [port, jump_port]:
            if not value.isdecimal() or not 1 <= int(value) <= 65535:
                raise ValueError("Invalid deployment SSH port")
        config.write_text(
            f"Host tensamin-deploy\n  HostName {host}\n  Port {port}\n  User deploy\n"
            + ("  ProxyJump tensamin-deploy-jump\n" if jump_host else "")
            + (f"Host tensamin-deploy-jump\n  HostName {jump_host}\n  Port {jump_port}\n"
               "  User deploy-jump\n" if jump_host else "")
            + f'Host *\n  IdentityFile "{key}"\n  IdentitiesOnly yes\n'
            f'  StrictHostKeyChecking yes\n  UserKnownHostsFile "{known}"\n'
            "  BatchMode yes\n  ConnectTimeout 15\n"
        )
        ssh = ["ssh", "-F", str(config), "-T", "tensamin-deploy"]
        # Prepare and validate SSH before publishing an infrastructure change.
        run("ssh", "-G", "-F", str(config), "tensamin-deploy")
        if changed:
            run("git", "push", "origin", f"HEAD:refs/heads/{branch}", cwd=checkout, env=env)
        try:
            subprocess.run([*ssh, commit], check=True)
            # Publication is inside the transaction, so failed publication restores the pin.
            subprocess.run(["python3", "scripts/release.py", "publish", "--channel", "stable",
                            "--tag", os.environ["RELEASE_TAG"]], check=True)
        except BaseException:
            if not changed:
                raise
            # A normal revert preserves unrelated concurrent infrastructure commits.
            run("git", "fetch", "origin", branch, cwd=checkout, env=env)
            run("git", "reset", "--hard", f"origin/{branch}", cwd=checkout)
            run(*identity, "revert", "--no-edit", commit, cwd=checkout)
            run("git", "push", "origin", f"HEAD:refs/heads/{branch}", cwd=checkout, env=env)
            rollback = run("git", "rev-parse", "HEAD", cwd=checkout)
            subprocess.run([*ssh, rollback], check=True)
            raise
        Path("release-out/deployment.json").write_text(json.dumps({
            "previous_infrastructure": original, "infrastructure": commit, "prod_pins": revision,
        }, indent=2) + "\n")


if __name__ == "__main__":
    main()