#!/usr/bin/env python3
"""Record a built blog image digest without requiring a YAML package in CI."""

import re
import sys
from pathlib import Path

REPOSITORY = "tea.ahmza.com/ahmza/blog-ahmza-com"
DIGEST_IMAGE = re.compile(re.escape(REPOSITORY) + r"@sha256:[0-9a-f]{64}\Z")
IMAGE_LINE = re.compile(
    r"(?m)^(?P<prefix> +image: )"
    + re.escape(REPOSITORY)
    + r"(?::[A-Za-z0-9_][A-Za-z0-9_.-]*|@sha256:[0-9a-f]{64})"
    + r"(?P<suffix>[ \t]*(?:#[^\n]*)?)$"
)


def update_image(manifest: Path, image: str) -> bool:
    """Replace exactly one blog image; reject mutable or unexpected image input."""
    if not DIGEST_IMAGE.fullmatch(image):
        raise ValueError("expected the blog repository with a sha256 image digest")

    original = manifest.read_text()
    matches = list(IMAGE_LINE.finditer(original))
    if len(matches) != 1:
        raise ValueError(f"expected exactly one blog image line, found {len(matches)}")

    updated = IMAGE_LINE.sub(
        lambda match: match["prefix"] + image + match["suffix"], original
    )
    if updated == original:
        return False
    manifest.write_text(updated)
    return True


def main() -> int:
    if len(sys.argv) != 3:
        print("usage: update_gitops_image.py MANIFEST IMAGE@sha256:DIGEST", file=sys.stderr)
        return 2
    try:
        changed = update_image(Path(sys.argv[1]), sys.argv[2])
    except (OSError, ValueError) as error:
        print(f"Cannot update GitOps image: {error}", file=sys.stderr)
        return 1
    print("GitOps image updated" if changed else "GitOps image already current")
    return 0


if __name__ == "__main__":
    raise SystemExit(main())