#!/usr/bin/env bash
# Woodpecker plugin "deploy": writes the pushed image with its digest to
# oumta-deploy. ci/deploy-image.sh there decides the environment from the tag
# (-dev. -> dev, -beta. -> beta, anything else -> nothing).
set -euo pipefail

die() { echo "deploy: $*" >&2; exit 1; }

VAR=${PLUGIN_VAR:?settings.var is missing}
REGISTRY=${PLUGIN_REGISTRY:-git.uesome.de}
IMAGE=${PLUGIN_IMAGE:-$REGISTRY/${CI_REPO:?CI_REPO is missing}}
TAG=${PLUGIN_TAG:-${CI_COMMIT_TAG:-}}
DEPLOY_USER=${PLUGIN_DEPLOY_USER:-oumta-ci}
DEPLOY_REPO=${PLUGIN_DEPLOY_REPO:-https://git.uesome.de/tanztee/oumta-deploy.git}
[[ -n $TAG ]] || die "no tag (settings.tag or tag event)"
[[ -n ${PLUGIN_DEPLOY_TOKEN:-} ]] || die "settings.deploy_token is missing"

major=${TAG#v}; major=${major%%.*}
VAR=${VAR//\{major\}/$major}

if [[ -n ${PLUGIN_REGISTRY_USERNAME:-} ]]; then
  crane auth login "$REGISTRY" -u "$PLUGIN_REGISTRY_USERNAME" --password-stdin \
    <<<"${PLUGIN_REGISTRY_PASSWORD:?settings.registry_password is missing}" >/dev/null
fi

# Token only via credential helper, never in a URL or config, so no log shows it
helper='!f() { echo "username=$DEPLOY_USER"; echo "password=$PLUGIN_DEPLOY_TOKEN"; }; f'
export DEPLOY_USER PLUGIN_DEPLOY_TOKEN
work=$(mktemp -d)
git -c credential.helper="$helper" clone --quiet "$DEPLOY_REPO" "$work/oumta-deploy"
git -C "$work/oumta-deploy" config credential.helper "$helper"

export DEPLOY_ENVS=${PLUGIN_ENVS:-}
export SOURCE_REPO=${CI_REPO:-} SOURCE_COMMIT=${CI_COMMIT_SHA:-}
"$work/oumta-deploy/ci/deploy-image.sh" "$VAR" "${IMAGE,,}:$TAG"