pin-cpflow-github-ref

#!/usr/bin/env ruby
# frozen_string_literal: true

require "pathname"

USAGE = <<~USAGE
  Usage: bin/pin-cpflow-github-ref [--allow-moving-ref] <control-plane-flow-ref>

  Use a release tag for normal operation, e.g. v5.0.0.
  Use a full 40-character commit SHA for temporary unreleased upstream testing.
  Use --allow-moving-ref only for short-lived local branch/ref experiments.
USAGE

ALLOWED_OPTIONS = ["--allow-moving-ref"].freeze
FULL_COMMIT_SHA = /\A[0-9a-f]{40}\z/i
RELEASE_TAG = /\Av\d+\.\d+\.\d+(?:[-.][0-9A-Za-z][0-9A-Za-z.-]*)?\z/

options, positional = ARGV.partition { |arg| arg.start_with?("--") }
unknown_options = options - ALLOWED_OPTIONS

unless unknown_options.empty?
  warn "Unknown option(s): #{unknown_options.join(', ')}"
  warn USAGE
  exit 1
end

unless positional.length == 1
  warn USAGE
  exit 1
end

ref = positional.first
allow_moving_ref = options.include?("--allow-moving-ref")

unless ref.match?(/\A[0-9A-Za-z._\/-]+\z/)
  warn "Ref contains unsupported characters: #{ref.inspect}"
  exit 1
end

unless ref.match?(FULL_COMMIT_SHA) || ref.match?(RELEASE_TAG) || allow_moving_ref
  warn "Ref must be a full 40-character commit SHA or a v-prefixed release tag: #{ref.inspect}"
  warn "Use --allow-moving-ref only for a short-lived branch/ref experiment."
  exit 1
end

root = Pathname.new(__dir__).join("..").expand_path
workflow_paths = Dir[root.join(".github/workflows/cpflow-*.yml")].sort

if workflow_paths.empty?
  warn "No cpflow workflow wrappers found."
  exit 1
end

changed = []
workflow_paths.each do |path|
  text = File.read(path)
  updated = text
    .gsub(%r{(uses:\s+shakacode/control-plane-flow/\.github/workflows/[^@\s]+@)[^\s]+}, "\\1#{ref}")
    .gsub(/(\bcontrol_plane_flow_ref:\s*)\S+/, "\\1#{ref}")

  next if updated == text

  File.write(path, updated)
  changed << Pathname.new(path).relative_path_from(root).to_s
end

puts "Pinned cpflow GitHub ref to #{ref}"
if changed.empty?
  puts "No files changed."
else
  changed.each { |path| puts "updated #{path}" }
end