#!/usr/bin/env bash
# Publish current main tree to github as orphan + hard sanitize (force).
# Usage: publish-to-github.sh [source_repo] [version]
set -euo pipefail

SOURCE_REPO="${1:-$(pwd)}"
VERSION="${2:-}"
REMOTE_NAME="${REMOTE_NAME:-github}"
SOURCE_REPO="$(cd "$SOURCE_REPO" && pwd)"
cd "$SOURCE_REPO"

REMOTE_URL="$(git remote get-url "$REMOTE_NAME")"
REPO_NAME="$(basename "$(git rev-parse --show-toplevel)")"
WORK="${TMPDIR:-/tmp}/gh-orphan-${REPO_NAME}-$$"

rm -rf "$WORK"
mkdir -p "$WORK"
git archive --format=tar main | tar -x -C "$WORK"
rm -rf "$WORK/.cursor" "$WORK/.cursorignore" 2>/dev/null || true

# URL + PII + Cursor sanitize
export LC_ALL=C
while IFS= read -r -d '' f; do
  case "$f" in
    *.md|*.py|*.ts|*.vue|*.json|*.sh|*.ps1|*.yml|*.yaml|*.example|*.service|*.txt|*.html|*.css|*.kt|*.kts|*.xml|*.properties|*.gradle|*.pro) ;;
    *) continue ;;
  esac
  perl -i -pe '
    s#https://git\.kalinamall\.ru/PapaTramp/([^)/\s\"\x27`]+)/src/branch/main/#https://git.papatramp.ru/PapaTramp/$1/src/branch/main/#g;
    s#https://git\.kalinamall\.ru/PapaTramp/([^)/\s\"\x27`]+)/blob/main/#https://git.papatramp.ru/PapaTramp/$1/src/branch/main/#g;
    s#https://git\.kalinamall\.ru/PapaTramp/#https://git.papatramp.ru/PapaTramp/#g;
    s#git\.kalinamall\.ru/PapaTramp/#git.papatramp.ru/PapaTramp/#g;
    s#https://git\.papatramp\.ru/(PapaTramp|PTah)/#https://git.papatramp.ru/PapaTramp/#g;
    s#git\.papatramp\.ru/(PapaTramp|PTah)/#git.papatramp.ru/PapaTramp/#g;
    s#ssh://git\@git\.kalinamall\.ru:2222/PapaTramp/#https://git.papatramp.ru/PapaTramp/#g;
    s#ssh://git\@git\.papatramp\.ru:2222/PapaTramp/#https://git.papatramp.ru/PapaTramp/#g;
    s#sac-api\.kalinamall\.ru#sac-api.example.com#g;
    s#sac\.kalinamall\.ru#sac.example.com#g;
    s#ext\.kalinamall\.ru#ext.example.com#g;
    s#\*\.kalinamall\.ru#*.example.com#g;
    s#kalinamall\.ru#example.com#g;
    s#papatramp\.lan#example.lan#g;
    s#192\.168\.\d+\.\d+#10.0.0.1#g;
    s#Co-authored-by:\s*Cursor\s*<cursoragent\@cursor\.com>\s*##g;
    s#Made-with:\s*Cursor\s*##g;
    s#Cursor Agent##g;
    s#Cursor IDE##g;
    s#cursoragent\@cursor\.com##g;
    s#B26\\#CONTOSO\\#g;
    s#B26/#CONTOSO/#g;
    s#K6A-DC\d#WIN-DC01#g;
    s#UNMS Kalina#Example Site#g;
    s#k\.khodasevich#user1#g;
    s#\bkalinamall\b#example#g;
    s#\bpapatramp\b#jdoe#g;
  ' "$f"
done < <(find "$WORK" -type f -print0)

HITS=0
while IFS= read -r -d '' f; do
  case "$f" in
    *.md|*.py|*.ts|*.vue|*.json|*.sh|*.ps1|*.yml|*.yaml|*.example|*.service|*.txt|*.html|*.css|*.kt|*.kts|*.xml|*.properties|*.gradle|*.pro) ;;
    *) continue ;;
  esac
  if grep -nE 'git\.kalinamall\.ru|git\.papatramp\.ru|papatramp\.lan|192\.168\.[0-9]+\.[0-9]+|cursoragent@cursor\.com|Co-authored-by:[[:space:]]*Cursor|Made-with:[[:space:]]*Cursor|\bkalinamall\b|\bpapatramp\b|K6A-DC|B26\\\\' "$f" >/dev/null 2>&1; then
    echo "FORBIDDEN in ${f#$WORK/}" >&2
    grep -nE 'git\.kalinamall\.ru|git\.papatramp\.ru|papatramp\.lan|192\.168\.[0-9]+\.[0-9]+|cursoragent@cursor\.com|Co-authored-by:[[:space:]]*Cursor|Made-with:[[:space:]]*Cursor|\bkalinamall\b|\bpapatramp\b|K6A-DC|B26\\\\' "$f" >&2 || true
    HITS=$((HITS + 1))
  fi
done < <(find "$WORK" -type f -print0)

if [[ "$HITS" -gt 0 ]]; then
  echo "sanitization failed: $HITS file(s)" >&2
  rm -rf "$WORK"
  exit 1
fi

cd "$WORK"
git init -b main >/dev/null
git add -A
if [[ -n "$VERSION" ]]; then
  MSG="chore(github): sync public mirror ($VERSION)"
else
  MSG='chore(github): sync public mirror'
fi
git -c user.name='PTah' -c user.email='papatramp@gmail.com' commit -m "$MSG" >/dev/null
git remote add target "$REMOTE_URL"
git push target main --force
echo "OK -> $REMOTE_URL (orphan, force)"

cd "$SOURCE_REPO"
rm -rf "$WORK"