git-sync.sh

# Shared git checkout sync for production deploy.
# Source after setting APP_DIR, TARGET_BRANCH, DEPLOY_SHA, REPO_URL (or REPO_SSH_URL/REPO_FALLBACK).
#
# Provides: normalize_app_dir, ensure_git_repository

normalize_app_dir() {
  case "${APP_DIR:-}" in
    "~"|"~/"*) APP_DIR="${HOME}${APP_DIR#\~}" ;;
  esac
  export APP_DIR
}

# Legacy bootstrap may have left host files in APP_DIR before git clone was possible.
_git_sync_stash_bootstrap_artifacts() {
  local stash_dir
  stash_dir="$(mktemp -d "${TMPDIR:-/tmp}/dabljaar-git-stash.XXXXXX")"
  local item
  for item in .env.production .runtime deploy.log .deploy.lock; do
    if [ -e "$APP_DIR/$item" ]; then
      mv "$APP_DIR/$item" "$stash_dir/"
    fi
  done
  printf '%s' "$stash_dir"
}

_git_sync_restore_stashed_env() {
  local stash_dir="$1"
  local host_env="${HOST_ENV_FILE:-/var/lib/dabljaar/.env.production}"

  if [ -f "$host_env" ]; then
    return 0
  fi
  if [ -f "$stash_dir/.env.production" ]; then
    install -d -m 0755 "$(dirname "$host_env")"
    install -m 600 "$stash_dir/.env.production" "$host_env"
  fi
}

_git_sync_cleanup_stash() {
  local stash_dir="$1"
  rm -rf "$stash_dir"
}

ensure_git_repository() {
  normalize_app_dir

  local repo_url="${REPO_URL:-${REPO_SSH_URL:-${REPO_FALLBACK:-}}}"
  local stash_dir=""

  if [ ! -d "$APP_DIR/.git" ]; then
    if [ -z "$repo_url" ]; then
      echo "REPO_SSH_URL or REPO_FALLBACK is required for initial clone" >&2
      return 1
    fi

    if [ -n "$(ls -A "$APP_DIR" 2>/dev/null || true)" ]; then
      if [ "${DEPLOY_FORCE_CLONE:-false}" = "true" ]; then
        echo "DEPLOY_FORCE_CLONE=true: removing non-git contents under $APP_DIR" >&2
        rm -rf "${APP_DIR:?}/"*
      else
        stash_dir="$(_git_sync_stash_bootstrap_artifacts)"
        if [ -n "$(ls -A "$APP_DIR" 2>/dev/null || true)" ]; then
          _git_sync_cleanup_stash "$stash_dir"
          echo "APP_DIR exists without .git and contains unexpected files: $APP_DIR" >&2
          echo "Set DEPLOY_FORCE_CLONE=true to reset, or remove the directory manually." >&2
          return 1
        fi
      fi
    fi

    git clone -b "$TARGET_BRANCH" "$repo_url" "$APP_DIR" || {
      if [ -n "$stash_dir" ]; then
        _git_sync_cleanup_stash "$stash_dir"
      fi
      echo "Failed to clone repository. Ensure VM has GitHub SSH access for private repo." >&2
      echo "Tried URL: $repo_url" >&2
      return 1
    }

    if [ -n "$stash_dir" ]; then
      _git_sync_restore_stashed_env "$stash_dir"
      _git_sync_cleanup_stash "$stash_dir"
    fi
  fi

  if [ -z "${DEPLOY_SHA:-}" ]; then
    echo "DEPLOY_SHA is required" >&2
    return 1
  fi

  cd "$APP_DIR"

  if ! git fetch --prune origin "$TARGET_BRANCH"; then
    echo "git fetch failed. Remote configuration:" >&2
    git remote -v || true
    return 1
  fi

  git checkout -B "$TARGET_BRANCH" "$DEPLOY_SHA"
  git reset --hard "$DEPLOY_SHA"
  echo "Repository synced to $(git rev-parse --short HEAD)"
}