#!/bin/sh
# git-ssh-init.sh
#
# Sets up SSH authentication for git operations inside CI build containers.
#
# How this gets invoked:
#   act_runner runs each step via a non-interactive bash invocation.
#   Setting BASH_ENV=/usr/local/bin/git-ssh-init.sh in act_runner's
#   container.env causes bash to source this before any step's commands.
#   (See servers/legion/k8s/gitea-runner/deployment.yaml.)
#
# What it does:
#   1. Writes GITEA_SSH_PRIVATE_KEY (from the runner secret) to ~/.ssh/gitea_key
#   2. Creates an ~/.ssh/config entry so git uses that key for git.neuralplatform.ai
#   3. Sets a git insteadOf rule to rewrite HTTPS Gitea URLs to SSH,
#      so `actions/checkout` and any direct `git clone https://...` also use SSH
#
# Idempotent — safe to re-run on every step.

if [ -n "${GITEA_SSH_PRIVATE_KEY:-}" ]; then
    mkdir -p ~/.ssh
    chmod 700 ~/.ssh

    # Write the private key
    printf '%s\n' "${GITEA_SSH_PRIVATE_KEY}" > ~/.ssh/gitea_key
    chmod 600 ~/.ssh/gitea_key

    # SSH config — use this key for git.neuralplatform.ai, skip host key checking
    # (build containers are ephemeral; we don't persist a known_hosts file)
    cat > ~/.ssh/gitea_config << 'EOF'
Host git.neuralplatform.ai
  HostName git.neuralplatform.ai
  User git
  IdentityFile ~/.ssh/gitea_key
  StrictHostKeyChecking no
  UserKnownHostsFile /dev/null
EOF
    chmod 600 ~/.ssh/gitea_config

    # Point SSH at our per-job config (merge with any existing config if present)
    export GIT_SSH_COMMAND="ssh -F ~/.ssh/gitea_config"

    # NOTE: Do NOT add url.insteadOf SSH rewrite here.
    # Gitea's built-in SSH server is disabled (START_SSH_SERVER=false) so
    # SSH git clones would fail. HTTPS git operations work directly from
    # the build container host network — Cloudflare bypasses the CF Access
    # gate for git smart-HTTP and release asset paths.
fi