release

#!/usr/bin/env bash

# Repository-owned release policy guard for the Base Bash v2 release line.

release_script_dir="$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")" && pwd -P)" || exit 1
# shellcheck source=release-version-policy.sh
source "$release_script_dir/release-version-policy.sh" || exit 1

release_usage() {
    cat >&2 << 'EOF'
Usage:
  scripts/release <check|plan|notes|refs|publish> --version <version> [options]

Allowed release identifiers:
  2.MINOR.PATCH
  2.MINOR.PATCH-alpha.N
  2.MINOR.PATCH-beta.N
  2.MINOR.PATCH-rc.N

MINOR and PATCH are non-negative integers without leading zeroes. N is a
positive integer without leading zeroes. Stable and approved prerelease
publication use the same verified-artifact and immutable-tag gates.

The refs command is a read-only preflight that fails closed when the candidate
tag already exists locally or on origin. Published tags are immutable.
EOF
}

release_error() {
    printf 'ERROR: %s\n' "$*" >&2
}

release_check_tag_refs() {
    local repo_root="$1"
    local tag_name="$2"
    local remote_refs=""
    local git_status

    if ! command -v git > /dev/null 2>&1; then
        release_error "Git is required to inspect release tag '$tag_name'."
        return 1
    fi

    if git -C "$repo_root" show-ref --verify --quiet "refs/tags/$tag_name"; then
        release_error "Release tag '$tag_name' already exists in the local repository."
        release_error "Remove only a confirmed stale local ref before retrying; never retag a published release."
        return 1
    else
        git_status=$?
        if ((git_status != 1)); then
            release_error "Unable to inspect the local release tag '$tag_name' (git status $git_status)."
            return 1
        fi
    fi

    if ! remote_refs="$(git -C "$repo_root" ls-remote --tags origin "refs/tags/$tag_name" 2> /dev/null)"; then
        release_error "Unable to inspect release tag '$tag_name' on origin; refusing to continue."
        return 1
    fi
    if [[ -n "$remote_refs" ]]; then
        release_error "Release tag '$tag_name' already exists on origin."
        release_error "Published tags are immutable; choose a new policy-compliant release identifier."
        return 1
    fi

    printf 'Release tag %s is absent locally and on origin.\n' "$tag_name"
}

main() {
    local canonical_manifest
    local command="${1-}"
    local manifest_value=""
    local version=""
    local dry_run=0
    local index
    local release_driver="${BASE_BASH_RELEASE_BASECTL:-basectl}"
    local script_dir repo_root
    local -a arguments=("$@")
    local -a delegated_arguments=()
    local seen_dry_run=0
    local seen_format=0
    local seen_manifest=0
    local seen_version=0
    local seen_yes=0

    case "$command" in
    check | plan | notes | refs | publish) ;;
    "" | -h | --help | help)
        release_usage
        return 2
        ;;
    *)
        release_error "Unknown release command '$command'."
        release_usage
        return 2
        ;;
    esac

    script_dir="$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")" && pwd -P)" || return 1
    repo_root="$(cd -- "$script_dir/.." && pwd -P)" || return 1
    canonical_manifest="$repo_root/base_manifest.yaml"
    if [[ ! -f "$canonical_manifest" ]]; then
        release_error "Canonical release manifest was not found at '$canonical_manifest'."
        return 1
    fi

    index=1
    while ((index < ${#arguments[@]})); do
        case "${arguments[$index]}" in
        --version)
            if ((seen_version)); then
                release_error "Option '--version' may be provided only once."
                return 2
            fi
            seen_version=1
            index=$((index + 1))
            if ((index >= ${#arguments[@]})) || [[ -z "${arguments[$index]}" ]]; then
                release_error "Option '--version' requires an argument."
                return 2
            fi
            version="${arguments[$index]}"
            ;;
        --manifest)
            if ((seen_manifest)); then
                release_error "Option '--manifest' may be provided only once."
                return 2
            fi
            seen_manifest=1
            index=$((index + 1))
            if ((index >= ${#arguments[@]})) || [[ -z "${arguments[$index]}" ]]; then
                release_error "Option '--manifest' requires an argument."
                return 2
            fi
            manifest_value="${arguments[$index]}"
            if [[ "$manifest_value" != "base_manifest.yaml" &&
                "$manifest_value" != "./base_manifest.yaml" &&
                "$manifest_value" != "$canonical_manifest" ]]; then
                release_error "Release operations must use the canonical manifest at '$canonical_manifest'."
                return 1
            fi
            ;;
        --format)
            if [[ "$command" != "check" ]]; then
                release_error "Option '--format' is only supported by release check."
                return 2
            fi
            if ((seen_format)); then
                release_error "Option '--format' may be provided only once."
                return 2
            fi
            seen_format=1
            index=$((index + 1))
            if ((index >= ${#arguments[@]})) || [[ -z "${arguments[$index]}" ]]; then
                release_error "Option '--format' requires an argument."
                return 2
            fi
            ;;
        --dry-run)
            if [[ "$command" != "publish" ]]; then
                release_error "Option '--dry-run' is only supported by release publish."
                return 2
            fi
            if ((seen_dry_run)); then
                release_error "Option '--dry-run' may be provided only once."
                return 2
            fi
            seen_dry_run=1
            dry_run=1
            ;;
        --yes)
            if [[ "$command" != "publish" ]]; then
                release_error "Option '--yes' is only supported by release publish."
                return 2
            fi
            if ((seen_yes)); then
                release_error "Option '--yes' may be provided only once."
                return 2
            fi
            seen_yes=1
            ;;
        -h | --help)
            release_usage
            return 0
            ;;
        *)
            release_error "Unknown release $command option '${arguments[$index]}'."
            return 2
            ;;
        esac
        index=$((index + 1))
    done

    if [[ -z "$version" ]]; then
        release_error "Release commands require --version."
        return 2
    fi

    base_bash_release_version_supported "$version" || {
        release_error "Version '$version' is outside the supported Base Bash v2 release policy."
        release_error "Use 2.MINOR.PATCH or an approved alpha.N, beta.N, or rc.N prerelease."
        return 1
    }

    if [[ "$command" == "refs" ]]; then
        release_check_tag_refs "$repo_root" "v$version"
        return $?
    fi

    if [[ "$command" == "publish" && "$dry_run" -eq 0 ]]; then
        release_check_tag_refs "$repo_root" "v$version" || return $?
    fi

    delegated_arguments=("$@")
    if ((seen_manifest == 0)); then
        delegated_arguments+=(--manifest "$canonical_manifest")
    fi

    (
        cd -- "$repo_root" || exit 1
        "$release_driver" release "${delegated_arguments[@]}"
    )
}

main "$@"