#!/usr/bin/env bash
set -euo pipefail

repo_root="$(git rev-parse --show-toplevel)"
tool_dir="${BIOMCP_TOOL_DIR:-$repo_root/.cache/tools/bin}"
mkdir -p "$tool_dir"

install_archive_binary() {
  local name="$1" version="$2" url="$3" expected="$4" member="$5" current
  if [ -x "$tool_dir/$name" ]; then
    current="$("$tool_dir/$name" --version 2>&1)" || current=""
    if [ "$name" = cargo-deny ]; then
      [ "$current" != "cargo-deny $version" ] || return 0
    elif printf '%s\n' "$current" | grep -Fq "$version"; then
      return
    fi
  fi
  local temp_dir archive actual
  temp_dir="$(mktemp -d)"
  trap 'rm -rf "$temp_dir"' RETURN
  archive="$temp_dir/archive"
  curl --fail --location --silent --show-error --proto '=https' --tlsv1.2 "$url" -o "$archive"
  actual="$(sha256sum "$archive" | awk '{print $1}')"
  [ "$actual" = "$expected" ] || {
    printf 'checksum mismatch for %s: expected %s, got %s\n' "$name" "$expected" "$actual" >&2
    return 1
  }
  if [ "$member" = - ]; then
    install -m 0755 "$archive" "$tool_dir/$name"
    return
  fi
  case "$url" in
    *.tar.xz) tar -xJf "$archive" -C "$temp_dir" "$member" ;;
    *.tar.gz) tar -xzf "$archive" -C "$temp_dir" "$member" ;;
    *) printf 'unsupported lint-tool archive: %s\n' "$url" >&2; return 1 ;;
  esac
  install -m 0755 "$temp_dir/$member" "$tool_dir/$name"
}


# Official release assets and SHA-256 values:
# https://github.com/google/osv-scanner/releases/tag/v2.7.0
# OSV includes GitHub Security Advisories, RustSec and PyPA data.
# https://google.github.io/osv-scanner/supported-languages-and-lockfiles/
if [ "${1:-}" = --advisories ]; then
  case "$(uname -s)-$(uname -m)" in
    Linux-x86_64) platform=linux_amd64; digest=160c6253e2922e9e0a6a9771c5c4c40a4b3c6090b34a3cdd5e80c96cc2e4218b ;;
    Linux-aarch64|Linux-arm64) platform=linux_arm64; digest=4061ef4c021ed3c47f203b818f337e351336cc5cd67c0274fc36bd1dfc728dd7 ;;
    Darwin-arm64) platform=darwin_arm64; digest=d4926ef8da134332543be276dff157e4c170f99ad91fc48e89448a8816bdf70b ;;
    Darwin-x86_64) platform=darwin_amd64; digest=e82c5df7ab0a42dff29a1cd0660711447b56b4c0483ff66ad8634df10fd81a45 ;;
    *) printf 'No pinned advisory scanner for %s\n' "$(uname -s)-$(uname -m)" >&2; exit 1 ;;
  esac
  osv_version=2.7.0
  install_archive_binary osv-scanner "$osv_version" \
    "https://github.com/google/osv-scanner/releases/download/v$osv_version/osv-scanner_$platform" "$digest" -
  printf '%s\n' "$tool_dir"
  exit
fi

case "$(uname -s)-$(uname -m)" in
  Linux-x86_64)
    install_archive_binary shellcheck 0.10.0 \
      https://github.com/koalaman/shellcheck/releases/download/v0.10.0/shellcheck-v0.10.0.linux.x86_64.tar.xz \
      6c881ab0698e4e6ea235245f22832860544f17ba386442fe7e9d629f8cbedf87 \
      shellcheck-v0.10.0/shellcheck
    install_archive_binary actionlint 1.7.12 \
      https://github.com/rhysd/actionlint/releases/download/v1.7.12/actionlint_1.7.12_linux_amd64.tar.gz \
      8aca8db96f1b94770f1b0d72b6dddcb1ebb8123cb3712530b08cc387b349a3d8 \
      actionlint
    ;;
  Darwin-arm64)
    install_archive_binary shellcheck 0.10.0 \
      https://github.com/koalaman/shellcheck/releases/download/v0.10.0/shellcheck-v0.10.0.darwin.aarch64.tar.xz \
      bbd2f14826328eee7679da7221f2bc3afb011f6a928b848c80c321f6046ddf81 \
      shellcheck-v0.10.0/shellcheck
    install_archive_binary actionlint 1.7.12 \
      https://github.com/rhysd/actionlint/releases/download/v1.7.12/actionlint_1.7.12_darwin_arm64.tar.gz \
      aba9ced2dee8d27fecca3dc7feb1a7f9a52caefa1eb46f3271ea66b6e0e6953f \
      actionlint
    ;;
  *)
    printf 'No pinned lint-tool archive for %s; install ShellCheck 0.10.0 and actionlint 1.7.12 manually.\n' "$(uname -s)-$(uname -m)" >&2
    exit 1
    ;;
esac

# CI owns the policy version. Checksums bind its reviewed release assets.
cargo_deny_version="$(sed -n 's/^  CARGO_DENY_VERSION: \([0-9.]*\)$/\1/p' "$repo_root/.github/workflows/ci.yml")"
case "$cargo_deny_version-$(uname -s)-$(uname -m)" in
  0.19.4-Linux-x86_64)
    cargo_deny_target=x86_64-unknown-linux-musl
    cargo_deny_digest=3bd58b784e83715b86ddbc9deac591890372ec77fda5741bb0826970b958506f
    ;;
  0.19.4-Darwin-arm64)
    cargo_deny_target=aarch64-apple-darwin
    cargo_deny_digest=2437a51d904b29abe2d3aa9ea87e353c86cff108d519ba1e5fb495bb28e7fbaf
    ;;
  *) printf 'No pinned cargo-deny archive for policy %s on %s\n' "$cargo_deny_version" "$(uname -s)-$(uname -m)" >&2; exit 1 ;;
esac
# https://github.com/EmbarkStudios/cargo-deny/releases/tag/0.19.4
install_archive_binary cargo-deny "$cargo_deny_version" \
  "https://github.com/EmbarkStudios/cargo-deny/releases/download/$cargo_deny_version/cargo-deny-$cargo_deny_version-$cargo_deny_target.tar.gz" \
  "$cargo_deny_digest" "cargo-deny-$cargo_deny_version-$cargo_deny_target/cargo-deny"
[ "$("$tool_dir/cargo-deny" --version)" = "cargo-deny $cargo_deny_version" ] || {
  printf 'Installed cargo-deny does not match policy %s\n' "$cargo_deny_version" >&2
  exit 1
}

printf '%s\n' "$tool_dir"
