#!/bin/sh
set -eu

# ─────────────────────────────────────────
# Required secrets
# ─────────────────────────────────────────
: "${GIT_REPO_URL:?GIT_REPO_URL secret is required}"
: "${GIT_TOKEN:?GIT_TOKEN secret is required}"

GIT_HOST="${GIT_HOST:-github.com}"
GIT_USERNAME="${GIT_USERNAME:-x-access-token}"

APP_DIR="/app/src"
CREDS="/tmp/git-credentials"

cleanup() {
    rm -f "$CREDS" || true
}
trap cleanup EXIT

rm -rf "$APP_DIR"
mkdir -p "$APP_DIR"

# ─────────────────────────────────────────
# Secure git credential setup
# Token is written to a temp file, not printed.
# ─────────────────────────────────────────
umask 077
printf 'https://%s:%s@%s\n' "$GIT_USERNAME" "$GIT_TOKEN" "$GIT_HOST" > "$CREDS"

git config --global credential.helper "store --file=$CREDS"

# ─────────────────────────────────────────
# Clone private repository
# ─────────────────────────────────────────
git clone --depth 1 "$GIT_REPO_URL" "$APP_DIR"

# Remove credential file and helper after clone
rm -f "$CREDS"
git config --global --unset credential.helper || true

# ─────────────────────────────────────────
# Install dependencies and start app
# ─────────────────────────────────────────
cd "$APP_DIR"

python -m pip install --no-cache-dir -r requirements.txt

exec python -m uvicorn app:app \
    --host 0.0.0.0 \
    --port "${PORT:-7860}"