#!/usr/bin/env bash
set -euo pipefail

ROOT="$(
  git rev-parse --show-toplevel 2>/dev/null || {
    cd "$(dirname "${BASH_SOURCE[0]}")/.."
    pwd
  }
)"

work_dir="${BURROW_RELEASES_TOFU_DIR:-$ROOT/infra/releases}"
plugin_cache_dir="${BURROW_TOFU_PLUGIN_CACHE_DIR:-$ROOT/.cache/opentofu/plugins}"

usage() {
  cat <<'EOF'
Usage: Scripts/releases-tofu.sh [tofu args...]

Runs OpenTofu for Burrow Google Cloud Storage release and package repository
buckets. Cloud provider credentials must come from ADC or Workload Identity
Federation; do not put service-account JSON in this repository.

Examples:
  Scripts/releases-tofu.sh init -backend-config=backend.hcl
  Scripts/releases-tofu.sh plan -var-file=terraform.tfvars

Local syntax check:
  Scripts/releases-tofu.sh init -backend=false
  Scripts/releases-tofu.sh validate
EOF
}

if [[ "${1:-}" == "-h" || "${1:-}" == "--help" ]]; then
  usage
  exit 0
fi

mkdir -p "$plugin_cache_dir"
export TF_PLUGIN_CACHE_DIR="$plugin_cache_dir"
export TF_IN_AUTOMATION="${TF_IN_AUTOMATION:-true}"

exec nix shell --inputs-from "$ROOT" nixpkgs#opentofu -c tofu -chdir="$work_dir" "$@"