#!/usr/bin/env bash
set -Eeuo pipefail
umask 077
export PATH='/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin'
STEP_ID='STEP_050M07R20QUA0_READ_ONLY_INVENTORY_AND_BOUNDARY_CONFIRMATION'
SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
BUNDLE_ROOT="${BUNDLE_ROOT:-$SCRIPT_DIR}"; export BUNDLE_ROOT
BASE="${ROUTER_OPS_BASE:-/opt/router-ops}"
TS="$(date -u +%Y%m%d-%H%M%S)"
RUN_DIR="$BASE/step-runs/${STEP_ID}/${TS}-$$"
EVIDENCE="$RUN_DIR/evidence"; REPORT="$RUN_DIR/report"; PUBLIC_PAYLOAD="$RUN_DIR/public-payload"
CURRENT="$RUN_DIR/workflow-current.txt"; EVENTS="$RUN_DIR/workflow-events.tsv"; FINAL_ENV="$RUN_DIR/final-result.txt"
mkdir -p "$EVIDENCE" "$REPORT"; chmod 700 "$RUN_DIR" "$EVIDENCE" "$REPORT"
source "$BASE/lib/router-step-workflow.sh"
router_step_workflow_init "$CURRENT" "$EVENTS" preflight inventory report_build archive
CURRENT_PHASE=preflight
stop(){ local rc="$1" line="$2" cmd="$3"; trap - ERR; router_step_phase_fail "$CURRENT_PHASE" "line=$line rc=$rc command=$cmd" 2>/dev/null || true; echo RESULT=STOP_R20QUA0_READ_ONLY_INVENTORY; echo STOP_PHASE="$CURRENT_PHASE"; echo STOP_LINE="$line"; echo STOP_RC="$rc"; echo STOP_COMMAND="$cmd"; echo CORE_CHANGE_COMPLETE=false; echo ROLLBACK_STATUS=not_applicable_read_only; echo RUN_DIR="$RUN_DIR"; exit "$rc"; }
trap 'rc=$?; stop "$rc" "$LINENO" "$BASH_COMMAND"' ERR
router_step_phase_begin preflight
[[ "$(hostname)" == router-ops ]]
[[ "$(id -u)" -ne 0 ]]
[[ -x "$BASE/bin/router-vm100-git-source-publish" ]]
[[ -x "$BASE/bin/router-vm101-git-source-publish" ]]
[[ -x "$BASE/bin/router-vm121-git-source-publish" ]]
[[ -x "$BASE/bin/router-step-finalize" && -x "$BASE/bin/router-public-safe-payload" ]]
router_step_phase_complete preflight vm130_read_only_contract_ready
CURRENT_PHASE=inventory; router_step_phase_begin inventory
"$BUNDLE_ROOT/scripts/inventory.sh" "$EVIDENCE" | tee "$EVIDENCE/inventory-result.txt"
grep -Fqx RESULT=PASS_R20QUA0_INVENTORY "$EVIDENCE/inventory-result.txt"
router_step_phase_complete inventory live_vm130_vm100_vm101_inventory_collected
CURRENT_PHASE=report_build; router_step_phase_begin report_build
INSTALLER_SHA="$(cat "$BUNDLE_ROOT/installer.sha256")"
python3 "$BUNDLE_ROOT/scripts/build-report.py" "$EVIDENCE" "$REPORT" "$INSTALLER_SHA"
cp "$BUNDLE_ROOT/install.sh" "$REPORT/executed-step.sh"
cp "$BUNDLE_ROOT/release-info.json" "$REPORT/release-info.json"
cp "$BUNDLE_ROOT/installer.sha256" "$REPORT/installer.sha256"
cp "$BUNDLE_ROOT/manifest.sha256" "$REPORT/bundle-manifest.sha256"
/opt/router-ops/bin/router-public-safe-payload "$PUBLIC_PAYLOAD" \
 "$REPORT/report.txt" report.txt "$REPORT/facts.json" facts.json \
 "$REPORT/facts-public.html" facts-public.html "$REPORT/verify-public.html" verify-public.html \
 "$REPORT/rollback-public.html" rollback-public.html "$REPORT/verify.txt" verify.txt \
 "$REPORT/executed-step.sh" executed-step.sh "$REPORT/release-info.json" release-info.json \
 "$REPORT/installer.sha256" installer.sha256 "$REPORT/bundle-manifest.sha256" bundle-manifest.sha256
/opt/router-ops/bin/router-step-finalize --label step050m07r20qua0_read_only_inventory_and_boundary_confirmation --payload-dir "$PUBLIC_PAYLOAD" --workflow-current "$CURRENT" --workflow-events "$EVENTS" --output-env "$FINAL_ENV" --expect-kind step-report
router_step_phase_complete report_build report_published
CURRENT_PHASE=archive; router_step_phase_begin archive
TOKEN="$(cat "$BASE/public/.router-public-token")"; LATEST="$BASE/public/r/$TOKEN/latest"; ARCHIVE="/home/ops/incoming/WG_PAID_MGTS_LATEST_${TS}.zip"
python3 - "$LATEST" "$ARCHIVE" <<'PY'
from pathlib import Path
import sys,zipfile
src=Path(sys.argv[1]); out=Path(sys.argv[2]); out.parent.mkdir(parents=True,exist_ok=True)
tmp=out.with_suffix(out.suffix+'.tmp')
with zipfile.ZipFile(tmp,'w',compression=zipfile.ZIP_DEFLATED,compresslevel=6) as z:
    for p in sorted(src.rglob('*')):
        if p.is_file(): z.write(p, Path('latest')/p.relative_to(src))
tmp.replace(out)
PY
ARCHIVE_SHA="$(sha256sum "$ARCHIVE" | awk '{print $1}')"
router_step_phase_complete archive latest_python_zip_created
router_step_workflow_mark_complete
trap - ERR
cat "$FINAL_ENV"
STEP_REPORT_URL="$(awk -F= '$1=="PUBLIC_URL"{print substr($0,index($0,"=")+1)}' "$FINAL_ENV" | tail -n1)"
echo "STEP_REPORT_URL=$STEP_REPORT_URL"
cat "$REPORT/report.txt"
echo "PROJECT_SOURCE_URL=https://reports.secret-studio.ru/latest/20260731-055035_project_source_post_controlled_live_zero_healthy_r20qs/"
echo "LATEST_ARCHIVE=$ARCHIVE"
echo "LATEST_ARCHIVE_SHA256=$ARCHIVE_SHA"
echo BOOTSTRAP_INSTALLER_RC=0