#!/usr/bin/env bash
set -euo pipefail
GITEA=${GITEA_URL:-https://git.thepra.dev}
ORG=${GITEA_ORG:-Arasaka}
REPO=${GITEA_REPO:-MeWeb}
name=$1
file=$2
[ -f "$file" ] || { echo "usage: set_secret.sh NAME FILE (the file holds the value)"; exit 1; }

cred=$(printf 'protocol=https\nhost=%s\n\n' "${GITEA#https://}" | git credential fill)
user=$(printf '%s\n' "$cred" | sed -n 's/^username=//p')
pass=$(printf '%s\n' "$cred" | sed -n 's/^password=//p')
[ -n "$user" ] && [ -n "$pass" ] || { echo "no stored git credential for $GITEA"; exit 1; }

body=$(python3 -c 'import json,sys; print(json.dumps({"data": open(sys.argv[1]).read().strip()}))' "$file")
code=$(printf '%s' "$body" | curl -s -o /dev/null -w '%{http_code}' -u "$user:$pass" -H 'Content-Type: application/json' \
  -X PUT "$GITEA/api/v1/repos/$ORG/$REPO/actions/secrets/$name" --data-binary @-)
case "$code" in
  201|204) echo "secret $name set on $ORG/$REPO" ;;
  *) echo "Gitea answered $code for $name"; exit 1 ;;
esac