#!/usr/bin/env bash
set -euo pipefail

readonly JQ_VERSION='1.8.1'
readonly JQ_SHA256_AMD64='020468de7539ce70ef1bceaf7cde2e8c4f2ca6c3afb84642aabc5c97d9fc2a0d'
readonly JQ_SHA256_ARM64='6bc62f25981328edd3cfcfe6fe51b073f2d7e7710d7ef7fcdac28d4e384fc3d4'
readonly DOWNLOAD_BASE_URL="${JQ_DOWNLOAD_BASE_URL:-https://github.com/jqlang/jq/releases/download/jq-${JQ_VERSION}}"

: "${RUNNER_TEMP:?RUNNER_TEMP must be set by the CI runner}"
: "${GITHUB_PATH:?GITHUB_PATH must be set by the CI runner}"

architecture="${RUNNER_ARCH:-$(uname -m)}"
case "${architecture}" in
  X64 | x86_64 | amd64)
    asset='jq-linux-amd64'
    expected_sha256="${JQ_SHA256_AMD64}"
    ;;
  ARM64 | aarch64 | arm64)
    asset='jq-linux-arm64'
    expected_sha256="${JQ_SHA256_ARM64}"
    ;;
  *)
    printf '::error::install-jq: unsupported runner architecture: %s\n' "${architecture}" >&2
    exit 1
    ;;
esac

install_dir="${RUNNER_TEMP}/jq-${JQ_VERSION}/bin"
destination="${install_dir}/jq"
mkdir -p "${install_dir}"

temporary="$(mktemp "${RUNNER_TEMP}/jq-${JQ_VERSION}.XXXXXX")"
trap 'rm -f "${temporary}"' EXIT

curl --fail --show-error --silent --location --retry 3 \
  --proto '=https' --tlsv1.2 \
  "${DOWNLOAD_BASE_URL}/${asset}" \
  --output "${temporary}"
printf '%s  %s\n' "${expected_sha256}" "${temporary}" | sha256sum -c -
chmod 0755 "${temporary}"
mv "${temporary}" "${destination}"
trap - EXIT

printf '%s\n' "${install_dir}" >> "${GITHUB_PATH}"
installed_version="$("${destination}" --version)"
if [[ "${installed_version}" != "jq-${JQ_VERSION}" ]]; then
  printf '::error::install-jq: expected jq-%s, got %s\n' "${JQ_VERSION}" "${installed_version}" >&2
  exit 1
fi
printf 'install-jq: %s installed under RUNNER_TEMP\n' "${installed_version}"