#!/bin/sh
# script/lint: run the Go linter over the backend.
#
# .golangci.yml is standardized org-wide and must never be edited here
# (REPO_POLICIES.md). Its last silent drift replaced the v2 schema with
# v1 keys, which left every threshold in the file inert while the build
# stayed green. This script therefore asserts the file still matches the
# pinned copy byte for byte before the linter runs. The check is a local
# hash comparison: no network, no remote schema, nothing unpinned in the
# build path.
set -eu

ROOT="$(cd "$(dirname "$0")/.." && pwd -P)"

# sha256 of the pinned backend/.golangci.yml.
#
# PROVISIONAL. The hash below is the file currently on main, which is
# the schema-invalid v1-keyed config described above: it is pinned only
# so this branch and main stay green, NOT because it is canonical.
#
# The canonical org-wide .golangci.yml is
# 021cc83f4e6fc7c31b95b34b846723dfcf20b66b7baeea1dc40406e643346bcb,
# and PR #31 replaces backend/.golangci.yml with it. When #31 lands,
# GOLANGCI_CONFIG_SHA256 must be updated to that hash in the same
# commit. Until then, do not treat the pinned file as the standard.
GOLANGCI_CONFIG_SHA256="33ba2bf7fe4a44779d09b0fb31d6daf03685f8dc9d2bc417f963d7aabb0d17dc"

# sha256 <file>: print the file's sha256, coreutils or Darwin/busybox.
sha256() {
    if command -v sha256sum >/dev/null 2>&1; then
        sha256sum "$1" | cut -d' ' -f1
    else
        shasum -a 256 "$1" | cut -d' ' -f1
    fi
}

check_config_hash() {
    actual="$(sha256 .golangci.yml)"
    if [ "$actual" != "$GOLANGCI_CONFIG_SHA256" ]; then
        echo ".golangci.yml has drifted from the pinned config."
        echo "  expected $GOLANGCI_CONFIG_SHA256"
        echo "  actual   $actual"
        echo "Restore it verbatim from sneak/prompts; do not edit it."
        echo "Only update GOLANGCI_CONFIG_SHA256 in this script when the"
        echo "pinned config is deliberately replaced with a new standard."
        exit 1
    fi
}

main() {
    cd "$ROOT"
    check_config_hash
    golangci-lint run ./...
}

main "$@"