#!/usr/bin/env bash
set -euo pipefail

SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"

# Skip when the parent pom is not on a -SNAPSHOT version. Master sometimes
# lands on a release version (e.g. between the release commit and the
# follow-up next-SNAPSHOT bump) — deploying a non-SNAPSHOT to the snapshot
# repository is invalid and surfaces as a misleading "Could not find
# artifact" error from maven-deploy-plugin.
POM_VERSION=$(grep -m1 -oE '<version>[^<]+</version>' mockserver/pom.xml | head -1 | sed -E 's#</?version>##g')
if [[ "$POM_VERSION" != *-SNAPSHOT ]]; then
  echo "--- :fast_forward: Skipping snapshot deploy — pom is on release version $POM_VERSION (not a -SNAPSHOT)"
  exit 0
fi

echo "--- :aws: Fetching Sonatype Central Portal credentials from Secrets Manager"
{ set +x; } 2>/dev/null  # F-BK-04: suppress xtrace before secret fetch
SECRET_JSON=$(aws secretsmanager get-secret-value \
  --secret-id "mockserver-build/sonatype" \
  --region eu-west-2 \
  --query SecretString \
  --output text)

SONATYPE_USERNAME=$(echo "$SECRET_JSON" | jq -r '.username')
SONATYPE_PASSWORD=$(echo "$SECRET_JSON" | jq -r '.password')

if [ -z "$SONATYPE_USERNAME" ] || [ "$SONATYPE_USERNAME" = "null" ]; then
  echo "Error: Sonatype credentials not found in AWS Secrets Manager."
  echo "Store a Central Portal user token in mockserver-build/sonatype with keys 'username' and 'password'."
  echo "Generate the token at: https://central.sonatype.com → View Account → Generate User Token"
  exit 1
fi

echo "--- :nexus: Deploying snapshot to Central Portal"
# Snapshot-deploy specific flags (the release path activates -P release separately
# and intentionally re-enables javadoc / sources / GPG / central-publishing):
#   -T 1C                       run module compile + package + upload in parallel,
#                                using 1 thread per available core. Sonatype Central
#                                Portal's snapshot endpoint handles concurrent uploads
#                                from the same authenticated session, and Maven 3.9
#                                serialises shared-state phases internally.
#   -Dmaven.javadoc.skip=true   release profile is not active here so the javadoc
#                                plugin does not run anyway, but make it explicit so
#                                no future profile-activation flag accidentally turns
#                                on the slow doclet for snapshot builds.
#   -Dmaven.source.skip=true    same rationale as javadoc — defensive, snapshots do
#                                not need a -sources.jar artifact.
#   -Dgpg.skip=true             snapshots are not signature-checked by Central Portal;
#                                skipping GPG removes signing latency if the release
#                                profile were ever auto-activated.
exec "$SCRIPT_DIR/../run-in-docker.sh" \
  -i mockserver/mockserver:maven \
  -m 7g \
  -w /build/mockserver \
  -e "SONATYPE_USERNAME=$SONATYPE_USERNAME" \
  -e "SONATYPE_PASSWORD=$SONATYPE_PASSWORD" \
  -- ./mvnw -T 1C deploy -DskipTests \
    -Dmaven.javadoc.skip=true \
    -Dmaven.source.skip=true \
    -Dgpg.skip=true \
    -Djava.security.egd=file:/dev/./urandom \
    --settings .buildkite-settings.xml
