#!/usr/bin/env bash
# gate-linux.sh  -  run the ci-lite job on a real Ubuntu image, locally.
#
# The pre-push gate (pre-push-check.sh) is the primary one, but it runs on the
# maintainer's macOS workstation against an installed node_modules that has
# accumulated over months. Two things it cannot answer: does this tree work on
# Linux, and does `npm ci` from the lockfile into an empty tree still resolve.
# ci-lite.yml answers both, and has not executed since 2026-07-25.
#
# `act` runs that workflow against the same image GitHub would use, so the
# answer comes from the workflow definition rather than from a second script
# that would drift away from it.
#
# NOT part of `npm run gate` on purpose: act and Docker are not installed
# everywhere, and a required gate that cannot run is the failure ADR-0011
# exists to avoid. Run it before a release, or after touching install/,
# lib/credential-store.sh, or anything path-shaped.
#
# Needs network inside the container: the scorecard's dependency metrics ask
# the registry (advisories and signatures) and report an unreachable registry
# as a failure rather than a skip, on the grounds that a supply-chain check
# which goes green without reaching the registry is worse than no check.
#
# Exit codes: 0 = the job passed, 1 = the job failed, 2 = tooling missing

set -uo pipefail

REPO_ROOT="$(cd "$(dirname "$0")/../.." && pwd)"
cd "$REPO_ROOT" || { echo "FAIL: can't cd to repo root" >&2; exit 2; }

if ! command -v act >/dev/null 2>&1; then
  cat >&2 <<'MSG'
✗ act is not installed - this gate needs it to run the Ubuntu job locally.

    brew install act        # macOS
    # and a running Docker daemon (Docker Desktop, colima, orbstack)

Why this is not bundled: it pulls a multi-gigabyte runner image. The rest of
the gate chain (npm run gate) has no such dependency and stays the default.
MSG
  exit 2
fi

if ! docker info >/dev/null 2>&1; then
  echo "✗ act is installed but no Docker daemon is reachable. Start Docker and retry." >&2
  exit 2
fi

echo "→ Running ci-lite on ubuntu-22.04 via act (this pulls an image on first run)"
echo ""

if act workflow_dispatch \
  -W .github/workflows/ci-lite.yml \
  -P ubuntu-latest=catthehacker/ubuntu:act-22.04; then
  echo ""
  echo "✓ ci-lite passed on Linux"
  exit 0
fi

echo "" >&2
echo "✗ ci-lite failed on Linux. A pass on macOS does not cover this." >&2
exit 1