#!/bin/sh
set -eu
: "${VYLOCORE_TOKEN:?Set VYLOCORE_TOKEN from your CI secret store}"
: "${VYLOCORE_PROJECT:?Set VYLOCORE_PROJECT to the scoped project slug}"
source_archive=${VYLOCORE_SOURCE_ARCHIVE:-source.zip}
source_directory=${VYLOCORE_SOURCE_DIR:-dist}
policy_file=${VYLOCORE_POLICY_FILE:-protection.json}
script_directory=$(CDPATH= cd -- "$(dirname -- "$0")" && pwd)
node "$script_directory/zip-source.mjs" "$source_directory" "$source_archive"
vylocore policy validate --policy "$policy_file" --json
vylocore scan --project "$VYLOCORE_PROJECT" --source "$source_archive" --policy "$policy_file" --json > scan.json
revision_id=$(node -e 'const s=JSON.parse(require("node:fs").readFileSync("scan.json","utf8"));if(!Number.isSafeInteger(s.revision_id)||s.revision_id<1)process.exit(2);process.stdout.write(String(s.revision_id))')
vylocore protect --project "$VYLOCORE_PROJECT" --revision "$revision_id" --policy "$policy_file" --wait --output protected.zip --json > build.json
build_id=$(node -e 'const b=JSON.parse(require("node:fs").readFileSync("build.json","utf8"));if(!Number.isSafeInteger(b.job?.id)||b.job.id<1)process.exit(2);process.stdout.write(String(b.job.id))')
vylocore report --project "$VYLOCORE_PROJECT" --build "$build_id" --output report.json --json
# Deploy protected.zip; keep scan.json, build.json and report.json with the release.