#!/usr/bin/env bash
# SPDX-License-Identifier: Apache-2.0
#
# Installs pinned, checksum-verified development tools on Linux (amd64/arm64)
# for CI: golangci-lint, buf, shellcheck, nfpm.
#
# Usage: scripts/ci/install-tools.sh [BINDIR] [TOOL...]
#   BINDIR defaults to $HOME/.local/bin; without TOOL all tools are installed.
# In GitHub/Gitea Actions the directory is appended to $GITHUB_PATH.

set -euo pipefail

readonly GOLANGCI_LINT_VERSION="2.14.0"
readonly BUF_VERSION="1.73.0"
readonly SHELLCHECK_VERSION="0.11.0"
readonly NFPM_VERSION="2.48.0"

bindir="${1:-$HOME/.local/bin}"
shift || true
tools=("$@")
if ((${#tools[@]} == 0)); then
  tools=(golangci-lint buf shellcheck nfpm)
fi

case "$(uname -m)" in
  x86_64 | amd64)
    golangci_arch="amd64"
    buf_arch="x86_64"
    shellcheck_arch="x86_64"
    nfpm_arch="x86_64"
    golangci_sha="ab90aeb7b066f92a33415b638a50fe5344bbb75a0d32ad30cc248d88f81032ab"
    buf_sha="8f2986298ad08f0cc1bf999b9797b7c383adf32d7edf0f73d6f1e1a701baeac1"
    shellcheck_sha="b7af85e41cc99489dcc21d66c6d5f3685138f06d34651e6d34b42ec6d54fe6f6"
    nfpm_sha="6d7f9a28b2f397934403950fcbba83f598b08d02edbe79a0815b3b4897341750"
    ;;
  aarch64 | arm64)
    golangci_arch="arm64"
    buf_arch="aarch64"
    shellcheck_arch="aarch64"
    nfpm_arch="arm64"
    golangci_sha="ee7ec5f3453d15ddf106fae5a4d6c71737712348a979d1fe9cd52ec7ea299bae"
    buf_sha="902b75267db7f4391e99b7fa0756050e5354234cc0437ef50eee9c788950c7a3"
    shellcheck_sha="68a8133197a50beb8803f8d42f9908d1af1c5540d4bb05fdfca8c1fa47decefc"
    nfpm_sha="a9a75213763783b7669719e505474c748c5ad7dc66591a195619deb50f85c2f4"
    ;;
  *)
    echo "unsupported architecture: $(uname -m)" >&2
    exit 1
    ;;
esac

workdir="$(mktemp -d)"
trap 'rm -rf "$workdir"' EXIT
mkdir -p "$bindir"

# fetch URL FILE SHA256
fetch() {
  curl -fsSL --retry 3 -o "$2" "$1"
  echo "$3  $2" | sha256sum -c --quiet -
}

for tool in "${tools[@]}"; do
  case "$tool" in
    golangci-lint)
      name="golangci-lint-${GOLANGCI_LINT_VERSION}-linux-${golangci_arch}"
      fetch "https://github.com/golangci/golangci-lint/releases/download/v${GOLANGCI_LINT_VERSION}/${name}.tar.gz" \
        "$workdir/golangci.tar.gz" "$golangci_sha"
      tar -xzf "$workdir/golangci.tar.gz" -C "$workdir"
      install -m 0755 "$workdir/${name}/golangci-lint" "$bindir/golangci-lint"
      "$bindir/golangci-lint" version
      ;;
    buf)
      fetch "https://github.com/bufbuild/buf/releases/download/v${BUF_VERSION}/buf-Linux-${buf_arch}" \
        "$workdir/buf" "$buf_sha"
      install -m 0755 "$workdir/buf" "$bindir/buf"
      "$bindir/buf" --version
      ;;
    shellcheck)
      name="shellcheck-v${SHELLCHECK_VERSION}"
      fetch "https://github.com/koalaman/shellcheck/releases/download/v${SHELLCHECK_VERSION}/${name}.linux.${shellcheck_arch}.tar.gz" \
        "$workdir/shellcheck.tar.gz" "$shellcheck_sha"
      tar -xzf "$workdir/shellcheck.tar.gz" -C "$workdir"
      install -m 0755 "$workdir/${name}/shellcheck" "$bindir/shellcheck"
      "$bindir/shellcheck" --version | head -n 2
      ;;
    nfpm)
      fetch "https://github.com/goreleaser/nfpm/releases/download/v${NFPM_VERSION}/nfpm_${NFPM_VERSION}_Linux_${nfpm_arch}.tar.gz" \
        "$workdir/nfpm.tar.gz" "$nfpm_sha"
      tar -xzf "$workdir/nfpm.tar.gz" -C "$workdir" nfpm
      install -m 0755 "$workdir/nfpm" "$bindir/nfpm"
      "$bindir/nfpm" --version >"$workdir/nfpm.version"
      grep GitVersion "$workdir/nfpm.version"
      ;;
    *)
      echo "unknown tool: $tool" >&2
      exit 2
      ;;
  esac
done

if [[ -n "${GITHUB_PATH:-}" ]]; then
  echo "$bindir" >>"$GITHUB_PATH"
fi