#!/usr/bin/env bash
# Lightweight documentation gate. Manifest examples remain reviewable prose, so
# this gate checks deterministic repository contracts instead of applying them.

set -Eeuo pipefail
SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
# shellcheck source=../lib/common.sh
. "$SCRIPT_DIR/../lib/common.sh"

REPO_ROOT="$(cd "$SCRIPT_DIR/../.." && pwd)"
require_cmd rg
failed=0
OPERATIONAL_DOCS=(
  "$REPO_ROOT/README.md"
  "$REPO_ROOT/guide.md"
  "$REPO_ROOT/gitops/PROJECT.md"
  "$REPO_ROOT/gitops/clusters/lab/main/README.md"
  "$REPO_ROOT/docs/architecture.md"
  "$REPO_ROOT/docs/operations.md"
  "$REPO_ROOT/docs/networking.md"
  "$REPO_ROOT/docs/ingress-traefik.md"
  "$REPO_ROOT/docs/security-hardening.md"
  "$REPO_ROOT/docs/troubleshooting.md"
  "$REPO_ROOT/docs/vault-vso.md"
)

if rg -n $'\t' "$REPO_ROOT/docs" --glob '*.md'; then
  err "docs: tab 문자를 사용한 Markdown이 있습니다."
  failed=$((failed + 1))
fi

if rg -n 'k8s/(base|components|overlays|scripts)|terraform/(modules|environments)|base/(app|managing|plugins)/' \
  "$REPO_ROOT/README.md" \
  "$REPO_ROOT/AGENTS.md" \
  "$REPO_ROOT/guide.md" \
  "$REPO_ROOT/bootstrap" \
  "$REPO_ROOT/infrastructure" \
  "$REPO_ROOT/gitops" \
  "$REPO_ROOT/scripts/README.md" \
  "$REPO_ROOT/scripts/AGENTS.md" \
  "$REPO_ROOT/docs" \
  --glob '*.md'; then
  err "docs: 폐기된 Kustomize 경로가 남아 있습니다."
  failed=$((failed + 1))
fi

if rg -n '(password|token|secret)[[:space:]]*=[[:space:]]*\"[^<${][^\"]+\"' \
  "${OPERATIONAL_DOCS[@]}"; then
  err "docs: 실제 값처럼 보이는 credential literal이 있습니다."
  failed=$((failed + 1))
fi

((failed == 0)) || exit 1
log "documentation contract 검사 통과"