#!/usr/bin/env bash
set -Eeuo pipefail
umask 077
: "${CACHE_ROOT:?CACHE_ROOT fehlt}"
: "${REPO_URL:?REPO_URL fehlt}"
cd "$CACHE_ROOT/repo"
git remote set-url origin "$REPO_URL"
git fetch origin main
# Never destroy uncommitted downloaded records. A pending local commit is pushed first.
LOCAL=$(git rev-parse HEAD)
REMOTE=$(git rev-parse FETCH_HEAD)
if [[ "$LOCAL" != "$REMOTE" ]]; then
  if git merge-base --is-ancestor "$REMOTE" "$LOCAL"; then
    if [[ -n "$(git status --porcelain)" ]]; then
      echo 'Local pending commit plus uncommitted files; manual review needed' >&2; exit 1
    fi
    git push origin HEAD:main
    git fetch origin main
  elif [[ -z "$(git status --porcelain)" ]]; then
    # Clean checkout: resetting to the fetched head cannot discard local data.
    git reset --hard FETCH_HEAD
  else
    echo 'Remote changed while cached checkout has local data. Refusing destructive reset.' >&2; exit 1
  fi
fi
# Dirty data/state is an interrupted import and is safe to continue. Other changes are not.
if git status --porcelain | awk '{print substr($0,4)}' | grep -Ev '^(data/|state/)' | grep -q .; then
  echo 'Unexpected changes outside data/ and state/; aborting' >&2; exit 1
fi
python3 scripts/sync.py --root . --max-pages "${NVD_MAX_PAGES:-20}"
python3 scripts/validate.py --changed
git add -A -- data state
if git diff --cached --quiet; then
  echo 'No changes'; exit 0
fi
git -c user.name='Vulnerability Bot' -c user.email='vulnerability-bot@users.noreply.local' -c gc.auto=0 commit -qm "Update NVD CPE $(date -u +%FT%TZ)"
git -c gc.auto=0 push origin HEAD:main
echo "Updated $(git rev-parse --short HEAD)"