REPO_DIR="${REPO_DIR:-/persist/@configuration}"
STATE_DIR="${STATE_DIR:-/persist/@autodeploy}"
BRANCH="origin/${DEPLOY_BRANCH:-master}"

mkdir -p "$STATE_DIR"
exec 9>"$STATE_DIR/lock"
flock -n 9 || { echo "another deploy running"; exit 0; }

report_status() {
  [[ -f "$TOKEN_FILE" ]] || return 0
  curl -sf -X POST \
    -H "Authorization: token $(<"$TOKEN_FILE")" \
    -H "Content-Type: application/json" \
    -d "$(jq -n --arg s "$1" --arg d "$2" --arg c "deploy/$(hostname)" \
      '{state:$s,description:$d,context:$c}')" \
    "$GITEA_URL/api/v1/repos/$GITEA_REPO/statuses/$3" >/dev/null
}

cd "$REPO_DIR"

export GIT_CONFIG_COUNT=2
export GIT_CONFIG_KEY_0=gpg.format
export GIT_CONFIG_VALUE_0=ssh
export GIT_CONFIG_KEY_1=gpg.ssh.allowedSignersFile
export GIT_CONFIG_VALUE_1="$ALLOWED_SIGNERS"

git fetch origin --tags --prune-tags

latest=$(git describe --abbrev=0 "$BRANCH" 2>/dev/null) || {
  echo "no tags on $BRANCH"
  exit 0
}

current=$(cat "$STATE_DIR/tag" 2>/dev/null) || true
[[ "$latest" != "$current" ]] || { echo "already at $latest"; exit 0; }

echo "new tag: $latest (current: ${current:-none})"

git tag -v "$latest" || {
  sha=$(git rev-list -1 "$latest")
  report_status "failure" "tag signature verification failed" "$sha"
  exit 1
}

sha=$(git rev-list -1 "$latest")
report_status "pending" "deploying $latest" "$sha"

# build from remote, pinned to the verified rev - no local checkout needed
flake_url="git+${GITEA_URL}/${GITEA_REPO}?ref=refs/tags/${latest}&rev=${sha}#$(hostname)"

if nixos-rebuild switch --flake "$flake_url"; then
  echo "$latest" > "$STATE_DIR/tag"
  report_status "success" "deployed $latest" "$sha"
  echo "deployed $latest"
else
  report_status "failure" "nixos-rebuild failed" "$sha"
  exit 1
fi