// Pushes the current checked-out commit to a pre-authorized Chanpaca remote.
// Credentials must come from Git Credential Manager or CI's GIT_ASKPASS; they
// are never embedded in a URL, command argument, or repository file.
import { spawnSync } from 'node:child_process'

function requireEnvironment(name) {
  const value = process.env[name]?.trim()
  if (!value) throw new Error(`${name} is required`)
  return value
}

const user = requireEnvironment('GIT_USERNAME')
const repo = requireEnvironment('GIT_REPO_NAME')
const server = (process.env.GIT_SERVER_URL?.trim() || 'https://git.chanpaca.net')
  .replace(/\/$/, '')
const remoteUrl = `${server}/${encodeURIComponent(user)}/${encodeURIComponent(repo)}.git`

function run(args) {
  const result = spawnSync('git', args, {
    stdio: 'inherit',
    shell: false,
    env: process.env,
  })
  if (result.status !== 0) throw new Error(`git ${args[0]} failed`)
}

const remoteCheck = spawnSync('git', ['remote', 'get-url', 'chanpaca'], {
  encoding: 'utf8',
  shell: false,
})
if (remoteCheck.status === 0) {
  run(['remote', 'set-url', 'chanpaca', remoteUrl])
} else {
  run(['remote', 'add', 'chanpaca', remoteUrl])
}

// The caller owns staging and commit creation. Force push is intentionally not
// supported by this helper.
run(['push', '-u', 'chanpaca', 'HEAD:main'])
if (process.argv.includes('--tags')) run(['push', 'chanpaca', '--tags'])