"""Resolve an approved image and invoke the restricted production SSH command."""

import os
from pathlib import Path
import subprocess
import sys
import tempfile
import uuid

sys.path.insert(0, str(Path(__file__).resolve().parents[1] / "gitops"))
from request import image_digest, resolve_release  # noqa: E402


def main():
    os.umask(0o077)
    try:
        sha = resolve_release(os.environ["RELEASE"])
        image = image_digest(f"gitea.vandeplanque.com/tonio/car-tracker:{sha}", sha)
        # Stable across job retries; a new manual dispatch has a different run ID.
        request_id = str(uuid.uuid5(uuid.NAMESPACE_URL,
                                   "https://gitea.vandeplanque.com/tonio/car-tracker/actions/runs/"
                                   + os.environ["GITHUB_RUN_ID"]))
        with tempfile.TemporaryDirectory(prefix="car-tracker-ssh-") as directory:
            key, hosts = Path(directory) / "key", Path(directory) / "known_hosts"
            key.write_text(os.environ["SSH_PRIVATE_KEY"].strip() + "\n")
            hosts.write_text(os.environ["SSH_KNOWN_HOSTS"].strip() + "\n")
            key.chmod(0o600)
            hosts.chmod(0o600)
            print(f"Running request {request_id}; revision {sha}", flush=True)
            result = subprocess.run([
                "ssh", "-F", "/dev/null", "-T", "-i", str(key),
                "-o", "BatchMode=yes", "-o", "IdentitiesOnly=yes",
                "-o", "StrictHostKeyChecking=yes", "-o", f"UserKnownHostsFile={hosts}",
                "-o", "ConnectTimeout=15", "-o", "ServerAliveInterval=30",
                "-o", "ServerAliveCountMax=3", "tonio@192.168.1.56",
                f"run {request_id} {sha} {image}",
            ])
            if result.returncode == 255:
                print("SSH connection failed/lost. The job may still be running; inspect the host before another dispatch.")
            return result.returncode if result.returncode >= 0 else 70
    except (KeyError, ValueError, OSError, subprocess.SubprocessError):
        print("Run failed: check release, image and SSH configuration. No completion confirmed.")
        return 70


if __name__ == "__main__":
    sys.exit(main())