#!/usr/bin/env bash
# Emit a release-manifest fragment describing the artifact this CI run produced.
# Provenance only - it never blocks. sow-platform's promotion (D24) consumes it.
#
# Env (all optional except REPO + SHA):
#   FRAG_REPO     repo name (e.g. sow-codebase)         [required]
#   FRAG_SHA      git sha of the build                  [required]
#   FRAG_ARTIFACT artifact name (image ref or filename) [required]
#   FRAG_FILE     path to a built file to checksum       (optional)
#   FRAG_DIGEST   image digest if known                  (optional)
#   FRAG_URL      publish URL                            (optional)
#   FRAG_RUN_ID   CI run id                              (optional)
#   FRAG_OUT      output path (default release-fragment.json)
set -euo pipefail
: "${FRAG_REPO:?set FRAG_REPO}"; : "${FRAG_SHA:?set FRAG_SHA}"; : "${FRAG_ARTIFACT:?set FRAG_ARTIFACT}"
out="${FRAG_OUT:-release-fragment.json}"

checksum=""
if [[ -n "${FRAG_FILE:-}" && -f "${FRAG_FILE}" ]]; then
  checksum="$(sha256sum "$FRAG_FILE" | cut -d' ' -f1)"
fi

json_escape() {
  local s="$1"
  s="${s//\\/\\\\}"
  s="${s//\"/\\\"}"
  s="${s//$'\n'/\\n}"
  s="${s//$'\r'/\\r}"
  s="${s//$'\t'/\\t}"
  printf '%s' "$s"
}

cat > "$out" <<JSON
{
  "repo": "$(json_escape "$FRAG_REPO")",
  "sha": "$(json_escape "$FRAG_SHA")",
  "artifact": "$(json_escape "$FRAG_ARTIFACT")",
  "digest": "$(json_escape "${FRAG_DIGEST:-}")",
  "sha256": "$checksum",
  "publish_url": "$(json_escape "${FRAG_URL:-}")",
  "run_id": "$(json_escape "${FRAG_RUN_ID:-}")"
}
JSON
echo "emit-release-fragment: wrote $out"