#!/bin/sh
set -eu

revision="${1:-}"
version="${2:-}"
source_date_epoch="${3:-}"

fail() {
  printf 'release verification failed: %s\n' "$1" >&2
  exit 1
}

echo "$revision" | grep -Eq '^[0-9a-f]{40}$' || fail 'revision must be a full lowercase Git commit SHA'
echo "$version" | grep -Eq '^[A-Za-z0-9][A-Za-z0-9._+-]{0,99}$' || fail 'version contains unsafe characters'
echo "$source_date_epoch" | grep -Eq '^[0-9]{1,12}$' || fail 'SOURCE_DATE_EPOCH must be an integer'

head_revision="$(git rev-parse HEAD)"
test "$revision" = "$head_revision" || fail "revision does not match HEAD (${head_revision})"
test "$source_date_epoch" = "$(git show -s --format=%ct HEAD)" || fail 'SOURCE_DATE_EPOCH does not match the commit time'
test -z "$(git status --porcelain --untracked-files=all)" || fail 'release checkout is not clean'

tracked_paths="$(git ls-files)"
if printf '%s\n' "$tracked_paths" | grep -Eq '(^|/)(\.env($|\.)|master\.key$|id_(rsa|dsa|ecdsa|ed25519)$|node_modules/|vendor/bundle/|public/packs(-test)?/)|\.(key|pem|p12|pfx|sqlite3)(-|$)'; then
  fail 'a secret-like or generated dependency path is tracked'
fi

for required in Dockerfile Gemfile Gemfile.lock package.json yarn.lock LICENSE LICENSE_ADDITIONAL_TERMS README.md bin/setup .github/workflows/docker.yml; do
  git cat-file -e "${revision}:${required}" 2>/dev/null || fail "required source file is missing: ${required}"
done

printf 'release source verified: revision=%s version=%s epoch=%s\n' "$revision" "$version" "$source_date_epoch"
