#!/bin/sh
# script/lint: run the Go linter over the backend.
#
# .golangci.yml is standardized org-wide and must never be edited here
# (REPO_POLICIES.md). Its last silent drift replaced the v2 schema with
# v1 keys, which left every threshold in the file inert while the build
# stayed green. This script therefore asserts the file still matches the
# pinned copy byte for byte before the linter runs. The check is a local
# hash comparison: no network, no remote schema, nothing unpinned in the
# build path.
set -eu

ROOT="$(cd "$(dirname "$0")/.." && pwd -P)"

# sha256 of the pinned backend/.golangci.yml.
GOLANGCI_CONFIG_SHA256="33ba2bf7fe4a44779d09b0fb31d6daf03685f8dc9d2bc417f963d7aabb0d17dc"

# sha256 <file>: print the file's sha256, coreutils or Darwin/busybox.
sha256() {
    if command -v sha256sum >/dev/null 2>&1; then
        sha256sum "$1" | cut -d' ' -f1
    else
        shasum -a 256 "$1" | cut -d' ' -f1
    fi
}

check_config_hash() {
    actual="$(sha256 .golangci.yml)"
    if [ "$actual" != "$GOLANGCI_CONFIG_SHA256" ]; then
        echo ".golangci.yml has drifted from the pinned config."
        echo "  expected $GOLANGCI_CONFIG_SHA256"
        echo "  actual   $actual"
        echo "Restore it verbatim from sneak/prompts; do not edit it."
        echo "Only update GOLANGCI_CONFIG_SHA256 in this script when the"
        echo "pinned config is deliberately replaced with a new standard."
        exit 1
    fi
}

main() {
    cd "$ROOT"
    check_config_hash
    golangci-lint run ./...
}

main "$@"
