#!/usr/bin/env bash
# 使用 ~/.secrets/gitea 推送分支（不写入 git config；token 不出现在 URL/`ps`）
set -euo pipefail

ROOT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
SECRETS="${HOME}/.secrets/gitea"
BRANCH="${1:-dev}"

if [[ ! -f "${SECRETS}" ]]; then
  echo "[错误] 未找到 ${SECRETS}"
  exit 1
fi

TOKEN=$(grep -E '^- ACCESS_TOKEN=' "${SECRETS}" | sed 's/^- ACCESS_TOKEN=//')
PREFIX=$(grep -E '^- URL_PREFIX=' "${SECRETS}" | sed 's/^- URL_PREFIX=//')

if [[ -z "${TOKEN}" || -z "${PREFIX}" ]]; then
  echo "[错误] ${SECRETS} 缺少 ACCESS_TOKEN 或 URL_PREFIX"
  exit 1
fi

cd "${ROOT_DIR}"

# 通过临时 credential helper 注入，避免 oauth2:token@host 出现在进程列表。
HELPER_SCRIPT="$(mktemp)"
cleanup() {
  rm -f "${HELPER_SCRIPT}"
}
trap cleanup EXIT

cat > "${HELPER_SCRIPT}" <<EOF
#!/usr/bin/env bash
set -euo pipefail
if [[ "\${1:-}" == "get" ]]; then
  echo "username=oauth2"
  echo "password=${TOKEN}"
fi
EOF
chmod 700 "${HELPER_SCRIPT}"

git -c "credential.helper=${HELPER_SCRIPT}" \
  push "https://${PREFIX}/weichen/Agent-System.git" "${BRANCH}"