import { spawnSync } from "node:child_process";
import { readFile, writeFile } from "node:fs/promises";

import { supplyChainDigest } from "./lib/supply-chain.ts";

const owner = process.env.DEPENDENCY_BASELINE_OWNER;
const reason = process.env.DEPENDENCY_BASELINE_REASON;
if (!owner?.trim() || !reason?.trim()) {
  process.stderr.write(
    "DEPENDENCY_BASELINE_OWNER and DEPENDENCY_BASELINE_REASON are required.\n",
  );
  process.exit(2);
}

const commands: Array<[string, string[]]> = [
  ["corepack", ["pnpm", "build"]],
  ["node", ["scripts/generate-supply-chain.ts", "--no-baseline"]],
];
for (const [command, args] of commands) {
  const result = spawnSync(command, args, { stdio: "inherit" });
  if (result.status !== 0) process.exit(result.status ?? 1);
}

const inventory = JSON.parse(
  await readFile("artifacts/release/dependency-inventory.json", "utf8"),
);
await writeFile(
  "config/security/dependency-baseline.json",
  `${JSON.stringify(inventory, null, 2)}\n`,
);
await writeFile(
  "config/security/dependency-baseline.approval.json",
  `${JSON.stringify(
    {
      schemaVersion: 1,
      snapshotDigest: supplyChainDigest(inventory),
      owner,
      reason,
      approvedAt: new Date().toISOString(),
    },
    null,
    2,
  )}\n`,
);
process.stdout.write(
  `Dependency baseline approved: ${inventory.dependencyCount} packages\n`,
);