#!/usr/bin/env bash
#
# Run a command with one or more nixpkgs packages on PATH, pinned to the
# revision recorded in `nixpkgs-pin`, next to this script.
#
#     bash with-nixpkgs.sh apksigner apksigner verify --print-certs app.apk
#     bash with-nixpkgs.sh "fdroidserver jdk21 apksigner" fdroid update
#
# A space-separated list of attributes puts all of them on PATH at once, via
# multiple `nix shell` installables in one call -- `fdroid update` shells out
# to `jarsigner`/`keytool` (JDK) and `apksigner` itself, so a single package
# is not always enough.
#
# **Call it as `bash <script>`, not `<script>`.** The runner has no
# `/usr/bin/env`, so the shebang cannot be relied on there -- the same trap
# weblib-ci's with-nixpkgs.sh documents.
#
# ## Why this is not a copy of weblib-ci's with-nixpkgs.sh
#
# That script reads *the consuming repo's* `./flake.lock`, relative to the
# working directory, so the pin travels with whatever project vendors it.
# This repo has no flake.lock of its own -- deliberately; see weblib-ci#9,
# which is the same tension one repo over: a `flake.lock` would exist only to
# hold one 40-character string, for a repo whose README says it is *run*, not
# built. And per fdroid-repo-ci#1, the repo that consumes this one holds
# signing keys and is not guaranteed to be a flake at all, so reading a
# caller's flake.lock the way weblib-ci's script does would not even find one
# to read here.
#
# So the pin travels with *this* repo instead, in a file named `nixpkgs-pin`
# on purpose: it is the exact fallback weblib-ci#9 proposes adding to the
# shared script (`./flake.lock` present -> today's behaviour there; else
# `./nixpkgs-pin` -> a bare rev; else fail loudly). If that lands, this repo
# already speaks its format and nothing here needs to change.
#
# `fdroidserver`'s output feeds a *signed index* (fdroid-repo-ci#1), so a
# drifting nixpkgs is a worse trade here than for a disposable test job --
# unlike weblib-ci#9's stdlib-only 1.2s suite, this pin is load-bearing. A
# missing or malformed pin is therefore a hard failure, never a silent fall
# back to `nix shell nixpkgs#foo`, which would re-resolve the registry and
# fetch whatever the channel currently points at -- measured to cost an
# unpacked channel tarball in weblib-ci's own job log.
set -euo pipefail

here=$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)
pin="$here/nixpkgs-pin"

if [ "$#" -lt 2 ]; then
  echo "usage: $0 <nixpkgs attribute(s), space-separated> <command> [args...]" >&2
  exit 2
fi

attrs=$1
shift

if [ ! -f "$pin" ]; then
  echo "$0: no $pin -- refusing to fall back to an unpinned nix shell nixpkgs#<attr>" >&2
  exit 1
fi

rev=$(tr -d ' \t\n' < "$pin")
if ! [[ "$rev" =~ ^[0-9a-f]{40}$ ]]; then
  echo "$0: $pin does not hold a 40-character git revision (got '$rev')" >&2
  exit 1
fi

refs=()
for attr in $attrs; do
  refs+=("github:nixos/nixpkgs/${rev}#${attr}")
done

exec nix shell "${refs[@]}" --command "$@"