#!/usr/bin/env bash
# .gitea/workflows/scripts/install-tools.sh — install the PINNED tools a given
# gate stage needs on a Gitea Actions runner. Versions come from ci/versions.env
# (single source of truth, R-TEST-02). Usage: install-tools.sh <lint|l0|l1|conformance>
set -euo pipefail
HERE="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
REPO_ROOT="$(cd "${HERE}/../../.." && pwd)"
# shellcheck disable=SC1091
source "${REPO_ROOT}/ci/versions.env"

stage="${1:-all}"
os="$(uname -s | tr '[:upper:]' '[:lower:]')"
arch="$(uname -m)"; case "$arch" in x86_64) arch=amd64 ;; aarch64|arm64) arch=arm64 ;; esac
bindir="${HOME}/.local/bin"; mkdir -p "$bindir"
echo "${bindir}" >> "${GITHUB_PATH:-/dev/null}" 2>/dev/null || true
export PATH="${bindir}:${PATH}"

log() { printf '[install] %s\n' "$*" >&2; }

install_yamllint() { have yamllint || { log "yamllint ${YAMLLINT_VERSION}"; pip install --quiet "yamllint==${YAMLLINT_VERSION}"; }; }

install_check_jsonschema() { have check-jsonschema || { log "check-jsonschema ${CHECK_JSONSCHEMA_VERSION}"; pip install --quiet "check-jsonschema==${CHECK_JSONSCHEMA_VERSION}"; }; }

install_kyverno() {
  have kyverno && return 0
  log "kyverno CLI ${KYVERNO_VERSION}"
  local url="https://github.com/kyverno/kyverno/releases/download/v${KYVERNO_VERSION}/kyverno-cli_v${KYVERNO_VERSION}_${os}_${arch}.tar.gz"
  curl -fsSL "$url" | tar -xz -C "$bindir" kyverno
}

install_chainsaw() {
  have chainsaw && return 0
  log "chainsaw ${CHAINSAW_VERSION}"
  local url="https://github.com/kyverno/chainsaw/releases/download/v${CHAINSAW_VERSION}/chainsaw_${os}_${arch}.tar.gz"
  curl -fsSL "$url" | tar -xz -C "$bindir" chainsaw
}

install_kubectl() {
  have kubectl && return 0
  log "kubectl ${KUBECTL_VERSION}"
  curl -fsSL -o "${bindir}/kubectl" "https://dl.k8s.io/release/v${KUBECTL_VERSION}/bin/${os}/${arch}/kubectl"
  chmod +x "${bindir}/kubectl"
}

have() { command -v "$1" >/dev/null 2>&1; }

case "$stage" in
  lint)        install_yamllint ;;
  l0)          install_yamllint; install_check_jsonschema; install_kyverno ;;  # schema (check-jsonschema) + Kyverno L0
  l1)          install_chainsaw ;;              # L1 render via conformance runner (Chainsaw)
  conformance) install_chainsaw; install_kubectl ;;   # trigger the in-cluster Job
  all)         install_yamllint; install_check_jsonschema; install_kyverno; install_chainsaw; install_kubectl ;;
  *) echo "unknown stage: $stage" >&2; exit 2 ;;
esac
log "stage '${stage}' tools ready"