import { appendFile } from "node:fs/promises";

import { finalizeVerifiedPromotion } from "./lib/promotion-stager.ts";

const required = (name: string): string => {
  const value = process.env[name];
  if (!value) throw new TypeError(`promotion staging environment is missing ${name}`);
  return value;
};

const staged = await finalizeVerifiedPromotion({
  repositoryRoot: process.cwd(),
  archivePath: required("CANDIDATE_ARCHIVE_PATH"),
  expectedArchiveSha256: required("CANDIDATE_ARCHIVE_SHA256"),
  vulnerabilityReportPath: required("VULNERABILITY_REPORT_PATH"),
  provenanceAttestationPath: required("PROVENANCE_ATTESTATION_PATH"),
  vulnerabilityPublicKeyPath: required("VULNERABILITY_PUBLIC_KEY_PATH"),
  vulnerabilityKeyId: required("VULNERABILITY_KEY_ID"),
  provenancePublicKeyPath: required("PROVENANCE_PUBLIC_KEY_PATH"),
  provenanceKeyId: required("PROVENANCE_KEY_ID"),
  expectedRun: {
    id: process.env.GITEA_RUN_ID ?? process.env.GITHUB_RUN_ID ?? required("CI_RUN_ID"),
    attempt: Number(process.env.GITEA_RUN_ATTEMPT ?? process.env.GITHUB_RUN_ATTEMPT ?? required("CI_RUN_ATTEMPT")),
    sourceRevision: process.env.EXPECTED_SOURCE_REVISION ?? required("VITE_COMMIT_SHA"),
  },
  vulnerabilityInvocationNonce: required("VULNERABILITY_INVOCATION_NONCE"),
  provenanceInvocationNonce: required("PROVENANCE_INVOCATION_NONCE"),
  runnerTempRoot: required("RUNNER_TEMP"),
});
const output = required("GITHUB_OUTPUT");
await appendFile(
  output,
  [
    `staging_root=${staged.stagingRoot}`,
    `cleanup_token=${staged.cleanupToken}`,
    `runner_temp_dev=${staged.runnerTempIdentity.dev}`,
    `runner_temp_ino=${staged.runnerTempIdentity.ino}`,
    "",
  ].join("\n"),
  { encoding: "utf8" },
);
process.stdout.write(
  `Promotion staging: ${staged.files.map(({ name, sha256 }) => `${name}=${sha256}`).join(", ")} PASS\n`,
);