#!/bin/sh

# Pull the newest passing build of the site from OxygenHub and make it

# live (oxygenvcs-web#1). Run by a timer on the host that serves the site

# (Earth now, a VisionFive 2 Lite later); the host needs no inbound

# access and no credentials, since the repository is public.

#

# Each run: find the newest passing run of main, and if it is not the one

# live already, download its site.tar.gz, check it against the run's

# provenance statement (the artifact's SHA-256, this repository, main),

# unpack it into releases/RUN and point `current` at it in one rename.

# The last five releases stay for a rollback: `ln -sfn releases/N current`.

#

# Needs: sh, curl, python3 (reading JSON), sha256sum, tar.

set -eu

HUB=${HUB:-https://oxygenhub.io}

REPO=${REPO:-andymccall/oxygenvcs-web}

BOOKMARK=${BOOKMARK:-main}

ROOT=${ROOT:-/srv/oxygenvcs}

KEEP=${KEEP:-5}

# Run after a new release goes live: busybox httpd resolves its document

# root when it starts, so the service restarts it (see README.md).

RELOAD=${RELOAD:-}

mkdir -p "$ROOT/releases"

cd "$ROOT"

json() { python3 -I -c "import json,sys; $1" ; }

run=$(curl -fsS "$HUB/api/v1/repos/$REPO/flow/runs?limit=20" | json "

runs=[r for r in json.load(sys.stdin) if r['bookmark']=='$BOOKMARK' and r['status']=='passed']

print(runs[0]['number'] if runs else '')")

[ -n "$run" ] || { echo "no passing run of $BOOKMARK yet"; exit 0; }

live=$(readlink current 2>/dev/null | sed 's|releases/||' || true)

[ "$run" = "$live" ] && exit 0

art="$HUB/$REPO/flow/$run/artifacts/site/site.tar.gz"

tmp=$(mktemp -d "$ROOT/.pull.XXXXXX")

trap 'rm -rf "$tmp"' EXIT

curl -fsS "$art" -o "$tmp/site.tar.gz"

curl -fsS "$art/provenance" -o "$tmp/provenance.json"

got=$(sha256sum "$tmp/site.tar.gz" | cut -d' ' -f1)

# The statement must name this file's digest, this repository and the

# bookmark. (Its DSSE signature is the hub's; checking that here is for

# when oh can verify provenance offline.)

json "

import base64

env=json.load(open('$tmp/provenance.json'))

st=json.loads(base64.b64decode(env['payload']))

digests=[s['digest'].get('sha256') for s in st.get('subject',[])]

p=st['predicate']['buildDefinition']['externalParameters']

assert '$got' in digests, 'the artifact does not match its provenance'

assert p['repository']=='$HUB/$REPO', 'provenance names another repository: '+p['repository']

assert p['bookmark']=='$BOOKMARK', 'provenance names another bookmark: '+p['bookmark']

" <"$tmp/provenance.json"

mkdir "$tmp/site"

tar -C "$tmp/site" -xzf "$tmp/site.tar.gz"

[ -f "$tmp/site/index.html" ] || { echo "run $run: no index.html in the site"; exit 1; }

rm -rf "releases/$run"

mv "$tmp/site" "releases/$run"

ln -sfn "releases/$run" current.new

mv -T current.new current

echo "live: run $run ($got)"

[ -z "$RELOAD" ] || sh -c "$RELOAD"

# Keep the newest few.

ls -1 releases | sort -n | head -n -"$KEEP" | while read -r old; do rm -rf "releases/$old"; done