#!/usr/bin/env bash
set -Eeuo pipefail

ROOT_DIR="$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")/.." && pwd -P)"
failures=0

for script in "$ROOT_DIR/install.sh" "$ROOT_DIR/uninstall.sh" \
              "$ROOT_DIR"/libexec/* "$ROOT_DIR"/scripts/*.sh "$ROOT_DIR"/config/*.example "$ROOT_DIR"/maintenance/*.sh; do
  if bash -n "$script"; then
    printf 'OK bash -n %s\n' "${script#"$ROOT_DIR/"}"
  else
    failures=$((failures + 1))
  fi
done

if command -v shellcheck >/dev/null 2>&1; then
  shellcheck -x "$ROOT_DIR/install.sh" "$ROOT_DIR/uninstall.sh" \
    "$ROOT_DIR"/libexec/* "$ROOT_DIR"/scripts/*.sh || failures=$((failures + 1))
else
  printf 'HINWEIS: shellcheck fehlt; Lint wird nur in entsprechend ausgestatteter CI ausgeführt.\n'
fi

python3 "$ROOT_DIR/tests/test_llama.py" || failures=$((failures + 1))
python3 "$ROOT_DIR/tests/test_llama_watchdog.py" || failures=$((failures + 1))
python3 "$ROOT_DIR/tests/test_workstation.py" || failures=$((failures + 1))
python3 "$ROOT_DIR/tests/test_hermes_update.py" || failures=$((failures + 1))

if (cd -- "$ROOT_DIR" && rg -n --hidden --glob '!tests/smoke.sh' --glob '!tests/test_llama.py' --glob '!.git/**' \
   '(TELEGRAM_BOT_TOKEN|SIGNAL_ACCOUNT|API_KEY)=("|'"'"')?[A-Za-z0-9+]' .); then
  printf 'Möglicher eingecheckter Secret-Wert gefunden.\n' >&2
  failures=$((failures + 1))
fi

for unit in "$ROOT_DIR"/systemd/user/*.{service,timer}; do
  [[ -s "$unit" ]] || {
    printf 'Leere Unit: %s\n' "$unit" >&2
    failures=$((failures + 1))
  }
done

((failures == 0))