#!/usr/bin/env bash
#
# Resolve the effective INFINITO_WHITELIST that the discover step should pass to
# scripts/github/resolve/output_apps.sh, and write it to GITHUB_OUTPUT.
#
# Inputs via env:
#   INPUT_WHITELIST  caller-provided whitelist (space-separated), as role ids
#                    or as the display names utils.roles.display renders. A
#                    token may pin deploy axes onto the role
#                    (`#variant`, `@mode`, `+tor`, see
#                    utils.github.variant.selection); the pins are passed
#                    through untouched, and only the name in front of them is
#                    the directory this checks for.
#                    Three cases, in this order of precedence:
#                      * "__ALL__" (sentinel, case-insensitive): force
#                        full deploy across the workflow's scope. Skips
#                        the diff logic and emits an empty whitelist.
#                      * any other non-empty value: used verbatim.
#                      * empty: trigger the diff-based derivation.
#
# Output (GITHUB_OUTPUT):
#   whitelist=<value>  effective whitelist. An empty string means
#                      "no restriction; deploy everything in scope".
#
# Diff logic (only when INPUT_WHITELIST is empty):
#   1. Run scripts/meta/resolve/diff/affected_roles.sh.
#   2. If it returns "__ALL__", emit empty whitelist.
#   3. Otherwise emit the resolved (transitively expanded) role list.

set -euo pipefail

: "${GITHUB_OUTPUT:?Missing GITHUB_OUTPUT}"

# shellcheck source=scripts/meta/env/python.sh
source scripts/meta/env/python.sh

input="${INPUT_WHITELIST:-}"
input_trimmed="${input//[[:space:]]/}"

shopt -s nocasematch
if [[ "${input_trimmed}" == "__ALL__" ]]; then
	shopt -u nocasematch
	printf 'whitelist=\n' >>"${GITHUB_OUTPUT}"
	echo "Caller forced full deploy via '__ALL__' sentinel."
	exit 0
fi
shopt -u nocasematch

if [[ -n "${input_trimmed}" ]]; then
	input="$("${PYTHON}" -m utils.roles.display "${input}")"
	unknown=()
	for role in ${input}; do
		[[ -d "roles/${role%%[#@+]*}" ]] || unknown+=("${role}")
	done
	if ((${#unknown[@]})); then
		echo "[ERROR] Unknown role id(s) in the caller-supplied whitelist: ${unknown[*]}" >&2
		echo "[ERROR] They match no directory under roles/, so they would be dropped silently and never deployed." >&2
		exit 1
	fi
	printf 'whitelist=%s\n' "${input}" >>"${GITHUB_OUTPUT}"
	echo "Using caller-supplied whitelist: ${input}"
	exit 0
fi

resolved="$(./scripts/meta/resolve/diff/affected_roles.sh)"

if [[ "${resolved}" == "__ALL__" ]]; then
	printf 'whitelist=\n' >>"${GITHUB_OUTPUT}"
	echo "Diff vs origin/main implies full deploy (no whitelist)."
	exit 0
fi

printf 'whitelist=%s\n' "${resolved}" >>"${GITHUB_OUTPUT}"
echo "Diff-derived whitelist: ${resolved}"