build_all

#!/usr/bin/env bash
# Build validate for all platforms via Nix (sandboxed, deterministic).
# Outputs to zig-out/<arch>-<os>/bin/validate for each target.
set -u

SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
cd "$SCRIPT_DIR"

EXEC_NAME="validate"

# Cross-compilation targets available from x86_64-linux in flake.nix
# Native targets are built by their respective platforms
declare -A CROSS_TARGETS=(
	["windows-x86_64"]="packages.x86_64-linux.windows-x86_64"
	["x86_64-macos"]="packages.x86_64-linux.macos-x86_64"
	["aarch64-macos"]="packages.x86_64-linux.macos-aarch64"
)

# Parse args
run_tests=true
for arg in "$@"; do
	case "$arg" in
		--no-test|--no-tests) run_tests=false ;;
	esac
done

# Collect all binary paths for hashing
all_paths=("zig-out/bin/$EXEC_NAME")
for dir_name in x86_64-linux aarch64-linux x86_64-windows aarch64-windows x86_64-macos aarch64-macos; do
	exec_name="$EXEC_NAME"
	[[ "$dir_name" == *windows* ]] && exec_name="${EXEC_NAME}.exe"
	all_paths+=("zig-out/$dir_name/bin/$exec_name")
done

# Step A: Hash all existing binaries BEFORE building
echo "=== Pre-build hashes ==="
declare -A PRE_HASHES
for p in "${all_paths[@]}"; do
	if [[ -f "$p" ]]; then
		hash=$(sha256sum "$p" | awk '{print $1}')
		PRE_HASHES["$p"]="$hash"
		echo "  $hash  $p"
	else
		PRE_HASHES["$p"]="(not found)"
		echo "  (not found)          $p"
	fi
done
echo

# Run tests first
if [[ "$run_tests" == true ]]; then
	echo "=== Running tests ==="
	"$SCRIPT_DIR/test" || { echo "Tests failed — aborting."; exit 1; }
fi

# Step B: Build native via nix build
echo "=== Building native ==="
nix build || { echo "Native build failed."; exit 1; }
"$SCRIPT_DIR/scripts/sync-nix-result-to-zig-out" result zig-out/bin "$EXEC_NAME"
# Bundle the third-party license notices alongside the binary (required for redistribution).
mkdir -p zig-out/share && cp -rf result/share/licenses zig-out/share/ 2>/dev/null || true

# Cross-compile targets via nix build flake outputs.
# The flake defines cross-compile packages built from x86_64-linux.
# Locally on macOS we can only build these if we have a Linux builder
# (e.g., via remote Nix builder or Docker). Otherwise, CI handles them.
failed=0
echo

# Map of dir-name -> flake attribute (packages that exist in flake.nix)
# Detect host system for choosing the right flake attributes
host_system=$(nix eval --raw nixpkgs#stdenv.hostPlatform.system 2>/dev/null || echo "unknown")

declare -A CROSS_ATTRS=()
declare -A NATIVE_ATTRS=()

if [[ "$host_system" == "aarch64-darwin" ]]; then
	# Building from macOS: use cross-compile for Linux (produces static musl binaries)
	CROSS_ATTRS=(
		["x86_64-linux"]="packages.aarch64-darwin.linux-x86_64"
		["x86_64-windows"]="packages.x86_64-linux.windows-x86_64"
		["aarch64-windows"]="packages.x86_64-linux.windows-aarch64"
		["aarch64-macos"]="packages.x86_64-linux.macos-aarch64"
	)
	NATIVE_ATTRS=(
		["aarch64-linux"]="packages.aarch64-linux.default"
	)
else
	# Building from Linux: use native builds + cross-compile for other platforms
	CROSS_ATTRS=(
		["x86_64-windows"]="packages.x86_64-linux.windows-x86_64"
		["aarch64-windows"]="packages.x86_64-linux.windows-aarch64"
		["aarch64-macos"]="packages.x86_64-linux.macos-aarch64"
	)
	NATIVE_ATTRS=(
		["x86_64-linux"]="packages.x86_64-linux.default"
		["aarch64-linux"]="packages.aarch64-linux.default"
	)
fi

echo "=== Cross-compiling via nix build ==="
for dir_name in $(echo "${!CROSS_ATTRS[@]} ${!NATIVE_ATTRS[@]}" | tr ' ' '\n' | sort -u); do
	attr="${CROSS_ATTRS[$dir_name]:-${NATIVE_ATTRS[$dir_name]:-}}"
	if [[ -z "$attr" ]]; then continue; fi

	out_dir="zig-out/$dir_name/bin"
	exec_name="$EXEC_NAME"
	[[ "$dir_name" == *windows* ]] && exec_name="${EXEC_NAME}.exe"

	echo "=== Building: $dir_name (nix build .#$attr) ==="
	mkdir -p "$out_dir"
	if nix build ".#$attr" -o "result-$dir_name" 2>&1; then
		"$SCRIPT_DIR/scripts/sync-nix-result-to-zig-out" "result-$dir_name" "$out_dir" "$exec_name"
		cp -rf "result-$dir_name/share/licenses" "zig-out/$dir_name/share/" 2>/dev/null || mkdir -p "zig-out/$dir_name/share" && cp -rf "result-$dir_name/share/licenses" "zig-out/$dir_name/share/" 2>/dev/null || true
		rm -f "result-$dir_name"
	else
		rm -f "result-$dir_name"
		echo "  SKIPPED: $dir_name (no builder available — CI will handle this)"
	fi
done

# Step C: Sign all binaries with integrity trailer
echo
echo "=== Signing binaries ==="
for p in "${all_paths[@]}"; do
	if [[ -f "$p" ]]; then
		"$SCRIPT_DIR/scripts/sign-binary" "$p"
	fi
done

# Step D: Hash all binaries AFTER building, report changes
echo
echo "=== Post-build hashes ==="
any_changed=0
for p in "${all_paths[@]}"; do
	if [[ -f "$p" ]]; then
		hash=$(sha256sum "$p" | awk '{print $1}')
		pre="${PRE_HASHES["$p"]}"
		if [[ "$pre" == "(not found)" ]]; then
			echo "  NEW       $hash  $p"
			any_changed=1
		elif [[ "$pre" == "$hash" ]]; then
			echo "  UNCHANGED $hash  $p"
		else
			echo "  CHANGED   $hash  $p"
			echo "    was:    $pre"
			any_changed=1
		fi
	else
		echo "  MISSING   $p"
	fi
done

echo
echo "=== Build complete ==="
if [[ "$any_changed" -eq 0 ]]; then
	echo "WARNING: No binaries changed! Build may be cached."
fi

if [[ "$failed" -gt 0 ]]; then
	echo "$failed cross-compilation target(s) failed."
	exit 1
fi