#!/bin/sh
# Run local checks without publishing or changing files.
set -eu
cd "$(dirname "$0")/.."

go test -race -vet=off ./...
go vet ./...
python3 ./scripts/check-examples.py

unformatted=$(
    git ls-files '*.go' |
        while IFS= read -r go_file
        do
            gofmt -l "$go_file"
        done
)
test -z "$unformatted"

python3 - <<'PY'
from pathlib import Path
import re
import subprocess
import sys
from urllib.parse import unquote

root = Path.cwd().resolve()
markdown_files = [
    root / name
    for name in subprocess.check_output(
        ["git", "ls-files", "*.md"], text=True
    ).splitlines()
]
link_pattern = re.compile(r"!?\[[^]]*\]\(([^)]+)\)")
heading_pattern = re.compile(r"^#{1,6}\s+(.+?)\s*#*\s*$")
scheme_pattern = re.compile(r"^[a-z][a-z0-9+.-]*:", re.IGNORECASE)


def markdown_lines(path):
    in_fence = False
    fence = ""
    for line in path.read_text(encoding="utf-8").splitlines():
        stripped = line.lstrip()
        marker = stripped[:3]
        if marker in {"```", "~~~"}:
            if not in_fence:
                in_fence = True
                fence = marker
            elif marker == fence:
                in_fence = False
                fence = ""
            continue
        if not in_fence:
            yield line


anchor_cache = {}


def anchors(path):
    if path in anchor_cache:
        return anchor_cache[path]
    found = set()
    counts = {}
    for line in markdown_lines(path):
        match = heading_pattern.match(line)
        if not match:
            continue
        heading = re.sub(r"<[^>]+>", "", match.group(1)).replace("`", "")
        base = re.sub(r"[^\w\- ]", "", heading.lower()).replace(" ", "-")
        count = counts.get(base, 0)
        counts[base] = count + 1
        found.add(base if count == 0 else f"{base}-{count}")
    anchor_cache[path] = found
    return found


failures = []
for source in markdown_files:
    text = "\n".join(markdown_lines(source))
    for match in link_pattern.finditer(text):
        target = match.group(1).strip()
        if target.startswith("<") and target.endswith(">"):
            target = target[1:-1]
        if scheme_pattern.match(target) or target.startswith("//"):
            continue
        path_text, separator, fragment = target.partition("#")
        destination = source if not path_text else source.parent / unquote(path_text)
        try:
            destination = destination.resolve()
            destination.relative_to(root)
        except ValueError:
            failures.append(f"{source.relative_to(root)}: escapes repository: {target}")
            continue
        if not destination.exists():
            failures.append(f"{source.relative_to(root)}: missing target: {target}")
            continue
        if separator and destination.suffix.lower() == ".md":
            fragment = unquote(fragment).lower()
            if fragment not in anchors(destination):
                failures.append(f"{source.relative_to(root)}: missing anchor: {target}")

if failures:
    print("\n".join(failures), file=sys.stderr)
    raise SystemExit(1)
PY

case "$(go env GOWORK)" in
    ''|off) ;;
    *) printf '%s\n' 'an active Go workspace is not allowed' >&2; exit 1 ;;
esac
test -z "$(git ls-files go.work go.work.sum)"
test ! -e vendor
if grep -Eq '^[[:space:]]*replace([[:space:]]|\()' go.mod
then
    printf '%s\n' 'go.mod contains a replacement' >&2
    exit 1
fi

git diff --check
git diff --cached --check
credential_pattern='-----BEGIN ([A-Z0-9]+ )?PRIV''ATE KEY-----|AKI''A[0-9A-Z]{16}|gh[pousr]_[A-Za-z0-9]{36,}|sk-[A-Za-z0-9]{32,}'
if git grep -nEI -e "$credential_pattern" -- .
then
    printf '%s\n' 'possible credential found' >&2
    exit 1
fi