#!/usr/bin/env bash
# =====================================================================
# prep_order_release.sh — Project Drogheda workspace hygiene + release sync
# Helgen EinarBoard 1.0 Rev 1.1 — order-prep housekeeping
#
# SAFE BY DEFAULT: dry-run unless RUN=1. Push only with PUSH=1.
#   ./scripts/prep_order_release.sh              # preview (deletes nothing)
#   RUN=1 ./scripts/prep_order_release.sh        # clean + stage + commit
#   RUN=1 PUSH=1 ./scripts/prep_order_release.sh # ...and push to remote
#
# NEVER touches: .kicad_sch/.kicad_pcb/.kicad_pro/.kicad_prl, netlists
# (.net/.ipc/.dsn/.ses), python modules, xlsx ledgers, PDFs, fab outputs
# (production/), DRC/ERC baselines, raw field logs (nested repos are
# pruned entirely). macOS bash 3.2 compatible.
# =====================================================================
set -euo pipefail

ROOT="$(cd "$(dirname "$0")/.." && pwd)"
cd "$ROOT"
RUN="${RUN:-0}"; PUSH="${PUSH:-0}"
COMMIT_MSG="build: helgen einarboard 1.0 rev 1.1 production release core"

say()  { printf '%s\n' "$*"; }
act()  { # act <path>  — delete (or preview) one filesystem entry
  if [ "$RUN" = "1" ]; then rm -rf -- "$1"; say "  removed  $1"
  else say "  [dry-run] would remove  $1"; fi
}

# Prune list: never descend (nested git repos hold raw field logs/evidence;
# 99-Archive is read-only by convention).
PRUNE=( -path './.git' -o -path './99-Archive' \
        -o -path './04-Source-Code/htracker' \
        -o -path './04-Source-Code/firmware' \
        -o -path './06-Testing-Validation/log-analysis' \
        -o -name 'production' -o -name 'node_modules' )

say "== Drogheda order-prep cleanup (RUN=$RUN PUSH=$PUSH) =="
say "root: $ROOT"

# ---- 1. Compiler / build clutter (unambiguous junk extensions) --------
say "-- [1/4] LaTeX aux + Python cache + OS litter + KiCad autosaves"
find . \( \( "${PRUNE[@]}" \) -prune \) -o -type f \( \
     -name '*.aux' -o -name '*.out' -o -name '*.toc' -o -name '*.lof' \
  -o -name '*.lot' -o -name '*.fls' -o -name '*.fdb_latexmk' \
  -o -name '*.synctex.gz' -o -name '*.nav' -o -name '*.snm' -o -name '*.vrb' \
  -o -name '*.bbl' -o -name '*.blg' -o -name '*.pyc' -o -name '.DS_Store' \
  -o -name '_autosave-*' -o -name '*.kicad_sch-bak' -o -name '*.kicad_pcb-bak' \
  -o -name '*.lck' -o -name 'fp-info-cache' \) -print | while IFS= read -r f; do
    act "$f"
done
find . \( \( "${PRUNE[@]}" \) -prune \) -o -type d -name '__pycache__' -print \
  | while IFS= read -r d; do act "$d"; done

# ---- 2. LaTeX .log files — ONLY when a sibling .tex proves provenance --
# (raw field logs elsewhere in the tree are precious evidence — untouched)
say "-- [2/4] LaTeX build logs (require sibling .tex with same stem)"
find . \( \( "${PRUNE[@]}" \) -prune \) -o -type f -name '*.log' -print \
  | while IFS= read -r f; do
    stem="${f%.log}"
    if [ -f "${stem}.tex" ]; then act "$f"; fi
done

# ---- 3. Stray text drafts — UNTRACKED only, draft-pattern only ---------
# Tracked .txt (e.g. DRC baselines) are never candidates; among untracked
# .txt/.log we delete only obvious scratch names and always protect
# drc/erc/baseline/requirements/README files.
say "-- [3/4] Untracked stray .txt drafts / scratch logs"
git ls-files --others --exclude-standard -- '*.txt' '*.log' 2>/dev/null \
  | while IFS= read -r f; do
    base="$(basename "$f" | tr '[:upper:]' '[:lower:]')"
    case "$base" in
      *drc*|*erc*|*baseline*|*requirements*|readme*|leeme*|*netlist*)
        say "  protected $f" ;;
      *draft*|*scratch*|*tmp*|*temp*|*borrador*|*notes-old*|untitled*)
        act "$f" ;;
      *) say "  skipped (ambiguous — review manually)  $f" ;;
    esac
done

# ---- 4. Git stage / commit / sync --------------------------------------
say "-- [4/4] Git release sync"
if ! git rev-parse --is-inside-work-tree >/dev/null 2>&1; then
  say "  not a git work tree — skipping git phase."; exit 0
fi

if [ "$RUN" != "1" ]; then
  say "  [dry-run] git status summary:"; git status --short | sed 's/^/    /' | head -40
  say "  [dry-run] would: git add -A && git commit -m \"$COMMIT_MSG\"${PUSH:+ && push}"
  exit 0
fi

git add -A

# Secret pre-scan (invariant #6: no secrets in the repo — ever).
# Blocks the commit if staged additions look like credentials.
if git diff --cached -U0 | grep -E '^\+' | grep -Ei \
    '(password|passwd|pwd)[[:space:]]*[:=][[:space:]]*[^[:space:]]{4,}|BEGIN (RSA|OPENSSH) PRIVATE KEY|api[_-]?key[[:space:]]*[:=]' \
    >/dev/null 2>&1; then
  say "  !! ABORT: staged content matches a credential pattern (invariant #6)."
  say "     Inspect with: git diff --cached | grep -inE 'password|api[_-]?key|private key'"
  exit 1
fi

if git diff --cached --quiet; then
  say "  nothing to commit — tree already clean."
else
  git commit -m "$COMMIT_MSG"
  say "  committed: $COMMIT_MSG"
fi

if [ "$PUSH" = "1" ]; then
  BRANCH="$(git rev-parse --abbrev-ref HEAD)"
  say "  pushing $BRANCH -> origin (git.helgen.dev pipeline)..."
  git push origin "$BRANCH"
  say "  push complete."
else
  say "  push skipped (set PUSH=1 to sync to the remote pipeline)."
fi
say "== done =="