#!/bin/sh
# git-cf-access-init.sh
#
# Configures git so any clone/fetch from Gitea ends up going to
# git.neuralplatform.ai with the runner's Cloudflare Access service-token
# headers attached.
#
# How this gets invoked:
#   The forgejo-runner job execution path runs each step via a
#   non-interactive bash invocation inside the build container. Setting
#   BASH_ENV=/usr/local/bin/git-cf-access-init.sh in act_runner's
#   container.env causes bash to source this script before any step's
#   commands run. (See servers/legion/k8s/gitea-runner/deployment.yaml.)
#
# What it does:
#   1. Rewrites http://gitea.git.svc.cluster.local:3000/ → https://git.neuralplatform.ai/
#      via insteadOf. The runner registered against the in-cluster URL (no
#      CF Access on the daemon's polling loop), so act_runner advertises
#      that URL to the build container as github.server_url. Build
#      containers run with network: host and can't resolve
#      *.svc.cluster.local, so we need to redirect to the public URL.
#   2. Adds the CF Access service-token headers to outbound requests to
#      git.neuralplatform.ai so the clone authenticates through CF Access.
#
# Idempotent — re-runs replace any prior config keys without accumulating
# duplicate header entries.
#
# Known limitation: actions/checkout sets an Authorization extraheader
# keyed to the server URL it was given (the in-cluster URL). After
# insteadOf substitution the request goes to the public URL where git
# matches http.<public>.extraheader, and the in-cluster-keyed
# Authorization header is dropped. For public repos this is fine. For
# private repos the per-job token will not be sent — see the PR
# description for the follow-up plan if dharma-el's CI needs that token.

if [ -n "${CF_ACCESS_CLIENT_ID:-}" ] && [ -n "${CF_ACCESS_CLIENT_SECRET:-}" ]; then
    git config --global --replace-all \
        url."https://git.neuralplatform.ai/".insteadOf \
        "http://gitea.git.svc.cluster.local:3000/" 2>/dev/null || true

    # Reset extraHeader on the public URL, then add both CF Access headers.
    git config --global --unset-all \
        http."https://git.neuralplatform.ai/".extraHeader 2>/dev/null || true
    git config --global --add \
        http."https://git.neuralplatform.ai/".extraHeader \
        "CF-Access-Client-Id: ${CF_ACCESS_CLIENT_ID}" 2>/dev/null || true
    git config --global --add \
        http."https://git.neuralplatform.ai/".extraHeader \
        "CF-Access-Client-Secret: ${CF_ACCESS_CLIENT_SECRET}" 2>/dev/null || true
fi