#!/usr/bin/env bash
set -euo pipefail
: "${SSHPASS:?DEPLOY_PASSWORD is required}"
: "${DEPLOY_KNOWN_HOSTS:?DEPLOY_KNOWN_HOSTS is required}"
[[ "$DEPLOY_HOST" =~ ^[a-zA-Z0-9.-]+$ && "$DEPLOY_USER" =~ ^[a-zA-Z0-9_-]+$ ]] || exit 2
[[ "$COMMIT_SHA" =~ ^[0-9a-f]{40}$ && "$REMOTE_DIR" =~ ^/[a-zA-Z0-9_/-]+$ && "$REMOTE_DIR" != / && "$REMOTE_DIR" != *..* ]] || exit 2
known_hosts="$(mktemp)"
archive="$(mktemp)"
trap 'rm -f "$known_hosts" "$archive"' EXIT
printf '%s\n' "$DEPLOY_KNOWN_HOSTS" > "$known_hosts"
chmod 600 "$known_hosts"
options=(-o StrictHostKeyChecking=yes -o "UserKnownHostsFile=$known_hosts" -o ConnectTimeout=15)
target="$DEPLOY_USER@$DEPLOY_HOST"
case "${1:-}" in
  verify)
    build="$REMOTE_DIR/builds/$COMMIT_SHA"
    tar --exclude=.git --exclude=node_modules --exclude=.env --exclude=logs --exclude=bin -czf "$archive" .
    sshpass -e ssh "${options[@]}" "$target" "umask 077; mkdir -p '$build'"
    sshpass -e scp "${options[@]}" "$archive" "$target:$build/source.tar.gz"
    sshpass -e ssh "${options[@]}" "$target" "cd '$build'; tar -xzf source.tar.gz; rm source.tar.gz; bash deploy/remote-build.sh '$REMOTE_DIR' '$COMMIT_SHA'"
    ;;
  deploy)
    sshpass -e ssh "${options[@]}" "$target" "bash '$REMOTE_DIR/releases/$COMMIT_SHA/release.sh' '$REMOTE_DIR' '$COMMIT_SHA'"
    ;;
  *) exit 2 ;;
esac