#!/usr/bin/env bash
# Entrypoint for the PR-checker orchestrator container. Logs tg in non-interactively from an
# app-password secret (no keyring in a container, so --insecure writes credentials.json), then fetches
# the CURRENT scripts/pr-check.sh from Tangled raw and runs it. Fetching at run time (like the NAS
# stats job) keeps the checker logic current without rebuilding the image.
#
# Required env:
#   TG_HANDLE         the account that authors the comments (a dedicated bot is recommended)
#   TG_APP_PASSWORD   an atproto app-password for TG_HANDLE (Bluesky/PDS app password)
#   PR_CHECK_DIR      working dir; MUST be a host bind-mount at the SAME path (so the sandbox
#                     sibling's -v resolves on the host). e.g. /volume1/docker/pr-check/work
# Optional: DRY_RUN=1 (check + log, never comment), PR_CHECK_REPO (default atcommons.eu/website).
set -euo pipefail

: "${TG_HANDLE:?set TG_HANDLE (the commenting account)}"
: "${TG_APP_PASSWORD:?set TG_APP_PASSWORD (atproto app-password for TG_HANDLE)}"
: "${PR_CHECK_DIR:?set PR_CHECK_DIR (a host bind-mount path, same inside and on the host)}"

# The image builds tg v0.6.0, whose default appview (bobbin) is stale and misreports PR state. Pin the
# canonical appview for the login AND every downstream tg call, so the checker reads real state.
export TG_APPVIEW="${TG_APPVIEW:-https://api.tangled.org}"

echo "[entrypoint] logging tg in as $TG_HANDLE"
printf '%s' "$TG_APP_PASSWORD" | tg auth login "$TG_HANDLE" --password-stdin --insecure >/dev/null
unset TG_APP_PASSWORD   # drop it from the env before running anything else
tg auth status | sed 's/^/[entrypoint] /'

RAW="${PR_CHECK_RAW:-https://tangled.org/atcommons.eu/website/raw/main/scripts/pr-check.sh}"
echo "[entrypoint] fetching pr-check.sh from $RAW"
tmp="$(mktemp)"
# -L: Tangled raw 302-redirects to its blob backend.
curl -fsSL --max-time 30 "$RAW" -o "$tmp"
[ -s "$tmp" ] || { echo "[entrypoint] failed to fetch pr-check.sh" >&2; exit 1; }

echo "[entrypoint] running pr-check.sh"
exec bash "$tmp"