#!/bin/sh
# bitwarden-go dev wrapper. EVERY compile/vet/test path routes through the
# digest-pinned Docker builder (same image as mopac-keyproxy; the host runs
# containers, never toolchains).
#
# Usage: ./dev.sh {build|vet|test|check|smoke|shell} [args...]
#
#   build    compile ./cmd/bitwarden-go into bin/bitwarden-go
#   vet      go vet ./...
#   test     go test ./... (all tests run against the in-process fake
#            Secrets Manager server; the real vault is NEVER contacted)
#   check    build + vet + test (the pre-push gate)
#   smoke    end-to-end smoke: builds, boots the fake Secrets Manager in a
#            container on 127.0.0.1:8600, drives the real CLI from the host
#            through a 0600 env file (login / projects / secrets list / get,
#            redaction check on stderr), tears everything down
#   shell    interactive sh inside the builder
set -e

IMAGE="golang@sha256:e8c859f5632dcfde7b32d2012b4351728f6437930887c2f6a91ea242459e5514" # = golang:1.26-bookworm (bash present; alpine lacks it)

run() {
    docker run --rm -v "$PWD:/h" -w /h \
        -u "$(id -u):$(id -g)" -e HOME=/tmp -e GOFLAGS=-buildvcs=false \
        "$IMAGE" "$@"
}

cmd=${1:-check}
shift || true

case "$cmd" in
build)
    run go build -o bin/bitwarden-go ./cmd/bitwarden-go
    ;;
vet)
    run go vet ./...
    ;;
test)
    run go test "$@" ./...
    ;;
check)
    run sh -c 'go build -o bin/bitwarden-go ./cmd/bitwarden-go && go vet ./... && go test ./...'
    ;;
smoke)
    ./smoke/smoke.sh
    ;;
shell)
    run sh
    ;;
*)
    echo "dev.sh: unknown command $cmd (build|vet|test|check|smoke|shell)" >&2
    exit 1
    ;;
esac