#!/usr/bin/env bash
# mac_setup.sh — CI runner 自举件（Mac 本机 host 模式；2026-11-03 用户裁，取代 Docker 镜像路线）。
# 一条命令把一台 macOS 变成 gplan 的远端 CI runner：专用低权限账户＋Godot＋gdstyle＋Pillow＋act_runner 常驻。
# 用法（sudo 必须——建账户与写 /Library/LaunchDaemons 都要 root）:
#   sudo bash tools/ci/mac_setup.sh [--godot-zip <本地已下载的 macOS 版 zip 路径>]
# 环境前提:
#   ① macOS（Intel/Apple Silicon 皆可，Godot 走 universal 包）② Xcode Command Line Tools 已装（python3/git 在位：
#      缺则先 xcode-select --install）③ 调用账户的 ~/gitea-runner/act_runner 已就位（gitea.com gitea/runner
#      releases 的 darwin 包，版本与注册时一致）且该目录含已注册的 .runner（注册动作一次性，见 Gitea 文档）。
# 安全设计（用户裁「收紧 runner 权限」）:
#   - 所有作业以专用账户 ci-runner 运行：无 admin、无 sudo、可写面仅其家目录与仓库工作区；
#     与日常账户隔离——测试代码摸不到日常环境（威胁模型=测试写坏环境，非恶意第三方件）。
#   - runner 以 LaunchDaemon（系统级）常驻：开机自启、不依赖任何人登录、崩溃自动拉起。
# 幂等：重复执行只补缺件，不重复建账户/不重复下载（本地已有同版本产物即跳过）。
set -euo pipefail

GODOT_ZIP=""
while [ $# -gt 0 ]; do
	case "$1" in
		--godot-zip) GODOT_ZIP="${2:-}"; shift 2 ;;
		*) die "未知参数: $1（用法见头注）" ;;
	esac
done

GODOT_VER="4.7.2-stable"
GODOT_URL_BASE="https://github.com/godotengine/godot/releases/download/${GODOT_VER}-stable/Godot_${GODOT_VER}-stable_macos.universal.zip"
GDSTYLE_VER="0.4.0"
GDSTYLE_URL="https://github.com/atelico/gdstyle/releases/download/v${GDSTYLE_VER}/gdstyle-x86_64-apple-darwin.tar.gz"
MIRRORS=("" "https://gh-proxy.net/" "https://gh-proxy.com/")   # 直连优先，镜像回落
CI_USER="ci-runner"
CI_HOME="/Users/${CI_USER}"

log() { echo "[mac_setup] $*"; }
die() { echo "[mac_setup] ✗ $*" >&2; exit 1; }

[ "$(uname -s)" = "Darwin" ] || die "仅支持 macOS"
[ "$(id -u)" -eq 0 ] || die "请用 sudo 运行（建账户/写 LaunchDaemon 需要 root）"
for t in git curl python3 unzip dscl; do command -v "$t" >/dev/null 2>&1 || die "缺 $t（先 xcode-select --install）"; done
INVOKER="${SUDO_USER:-$(whoami)}"
RUNNER_SRC="/Users/${INVOKER}/gitea-runner"
[ -x "${RUNNER_SRC}/act_runner" ] || die "缺 ${RUNNER_SRC}/act_runner——先从 gitea.com/gitea/runner releases 下载 darwin 包（版本须与 .runner 注册时一致）"
[ -f "${RUNNER_SRC}/.runner" ] || die "缺 ${RUNNER_SRC}/.runner——act_runner 尚未注册（register 子命令，见 Gitea 文档）"

# ── 1. 专用账户（sysadminctl 一条建全：随机未告知密码＝无法交互登录，纯服务账户）──
if dscl . -read "${CI_HOME}" NFSHomeDirectory >/dev/null 2>&1; then
	log "账户 ${CI_USER} 已存在，跳过创建"
else
	_randpw="$(uuidgen | tr -d '-')"
	/usr/sbin/sysadminctl -addUser "$CI_USER" -password "$_randpw" -home "$CI_HOME" \
		|| die "账户创建失败（sysadminctl）——检查磁盘/SecureToken 设置"
	log "账户 ${CI_USER} 已创建（随机密码未落盘＝无法交互登录，纯服务账户）"
fi

# ── 2. Godot macOS 版 → /usr/local/bin/godot ──
if /usr/local/bin/godot --version >/dev/null 2>&1 && /usr/local/bin/godot --version 2>/dev/null | grep -q "${GODOT_VER}"; then
	log "Godot ${GODOT_VER} 已在位，跳过"
else
	ZIP="$GODOT_ZIP"
	SRC_ZIP="/Users/${INVOKER}/godot-linux/Godot_${GODOT_VER}-stable_macos.universal.zip"
	if [ -n "$ZIP" ] && [ -s "$ZIP" ]; then
		log "使用本地 zip: $ZIP"
	elif [ -z "$ZIP" ] && [ -s "$SRC_ZIP" ]; then
		log "复用已下载 zip: $SRC_ZIP"
		ZIP="$SRC_ZIP"
	else
		ZIP="$(mktemp "${TMPDIR:-/tmp}/godot_mac_XXXXXX.zip")"
		_ok=0
		for m in "${MIRRORS[@]}"; do
			url="${m}${GODOT_URL_BASE}"
			log "下载 Godot（${m:+经 $m}）：${GODOT_URL_BASE}"
			if curl -fL --retry 2 -m 1800 -o "$ZIP" "$url"; then _ok=1; break; fi
			log "该源失败，换下一源"
		done
		[ "$_ok" = 1 ] || die "全部下载源失败——请手动下载 ${GODOT_URL_BASE} 后重跑本脚本加 --godot-zip <zip路径>"
	fi
	TMPD="$(mktemp -d)"
	unzip -q -o "$ZIP" -d "$TMPD"
	install -m 0755 "${TMPD}/Godot.app/Contents/MacOS/Godot" /usr/local/bin/godot
	xattr -dr com.apple.quarantine /usr/local/bin/godot 2>/dev/null || true
	rm -rf "$TMPD"
	log "Godot 已装：$(/usr/local/bin/godot --version 2>/dev/null | head -1)"
fi

# ── 3. gdstyle v0.4.0 darwin → /usr/local/bin/gdstyle（S13 静态扫描闸件，版本钉死）──
if /usr/local/bin/gdstyle --version >/dev/null 2>&1; then
	log "gdstyle 已在位，跳过"
else
	TGZ="$(mktemp "${TMPDIR:-/tmp}/gdstyle_XXXXXX.tar.gz")"
	_ok=0
	for m in "${MIRRORS[@]}"; do
		log "下载 gdstyle v${GDSTYLE_VER} darwin（${m:+经 $m}）"
		if curl -fL --retry 2 -m 600 -o "$TGZ" "${m}${GDSTYLE_URL}"; then _ok=1; break; fi
	done
	[ "$_ok" = 1 ] || die "gdstyle 下载失败——手动下载 ${GDSTYLE_URL} 解压后放 /usr/local/bin/gdstyle 再重跑"
	TMPD="$(mktemp -d)"
	tar -xzf "$TGZ" -C "$TMPD"
	BIN="$(find "$TMPD" -type f -name 'gdstyle*' | head -1)"
	[ -n "$BIN" ] || die "gdstyle 压缩包内未找到二进制"
	install -m 0755 "$BIN" /usr/local/bin/gdstyle
	xattr -dr com.apple.quarantine /usr/local/bin/gdstyle 2>/dev/null || true
	rm -rf "$TMPD"
	log "gdstyle 已装：/usr/local/bin/gdstyle"
fi

# ── 4. Pillow（渲染闸 shot_checker/golden_compare 依赖，装给 ci-runner 用户）──
if sudo -u "$CI_USER" python3 -c "import PIL" >/dev/null 2>&1; then
	log "Pillow 已在位（ci-runner 用户），跳过"
else
	log "为 ci-runner 安装 Pillow（阿里源）"
	sudo -u "$CI_USER" python3 -m pip install --user pillow \
		-i https://mirrors.aliyun.com/pypi/simple/ --quiet \
		|| die "Pillow 安装失败"
fi

# ── 5. runner 程序与注册文件就位（复制既有注册身份，免重新注册）──
mkdir -p "${CI_HOME}/gitea-runner"
cp -f "${RUNNER_SRC}/act_runner" "${CI_HOME}/gitea-runner/act_runner"
cp -f "${RUNNER_SRC}/.runner" "${CI_HOME}/gitea-runner/.runner"
cp -f "${RUNNER_SRC}/config.yaml" "${CI_HOME}/gitea-runner/config.yaml" 2>/dev/null || true
# 标签切 host 模式：作业直接跑在本机（.runner 的 labels 是声明面，daemon 启动时重新 declare）
python3 - "${CI_HOME}/gitea-runner/.runner" <<'PYEOF'
import json, sys
p = sys.argv[1]
d = json.load(open(p))
d["labels"] = ["ci-mac:host"]
json.dump(d, open(p, "w"))
print("labels ->", d["labels"])
PYEOF
sed -i '' 's/^  level: debug/  level: info/' "${CI_HOME}/gitea-runner/config.yaml" 2>/dev/null || true
chown -R "${CI_USER}:staff" "${CI_HOME}/gitea-runner"

# ── 6. LaunchDaemon 常驻（系统级：开机自启、不依赖登录、崩溃自动拉起）──
PLIST="/Library/LaunchDaemons/com.gitea.act-runner.plist"
cat > "$PLIST" <<EOF
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
  <key>Label</key><string>com.gitea.act-runner</string>
  <key>UserName</key><string>${CI_USER}</string>
  <key>GroupName</key><string>staff</string>
  <key>ProgramArguments</key>
  <array>
    <string>${CI_HOME}/gitea-runner/act_runner</string>
    <string>daemon</string>
  </array>
  <key>WorkingDirectory</key><string>${CI_HOME}/gitea-runner</string>
  <key>RunAtLoad</key><true/>
  <key>KeepAlive</key><true/>
  <key>StandardOutPath</key><string>${CI_HOME}/gitea-runner/daemon.log</string>
  <key>StandardErrorPath</key><string>${CI_HOME}/gitea-runner/daemon.log</string>
</dict>
</plist>
EOF
launchctl bootout system/com.gitea.act-runner 2>/dev/null || true
launchctl bootstrap system "$PLIST" || launchctl load -w "$PLIST"
log "LaunchDaemon 已加载（com.gitea.act-runner，用户 ${CI_USER}）"

# ── 7. 退役 Docker 版 runner（如存在）──
if command -v docker >/dev/null 2>&1; then
	docker rm -f gitea-runner >/dev/null 2>&1 && log "Docker 版 runner 容器已退役" || log "无 Docker 版 runner 容器（或 docker 未运行）"
fi

# ── 8. 验证 ──
sleep 5
if launchctl print "system/com.gitea.act-runner" 2>/dev/null | grep -q "state"; then
	log "runner 服务在跑"
else
	die "runner 服务未起来——查 ${CI_HOME}/gitea-runner/daemon.log"
fi
log "全部完成。验证清单："
log "  ① Gitea 网页 → 仓库设置 → Actions → Runners 应显示 mac-ci 在线（Idle）"
log "  ② sudo -u ${CI_USER} /usr/local/bin/godot --headless --version"
log "  ③ sudo -u ${CI_USER} python3 -c 'import PIL'"
log "  ④ 任意 push 触发一次跑批端到端验证"