#!/usr/bin/env bash
# One-time: capture cluster runner registration token into SOPS (operator host with age key).
# RAIL-HO-WP-0005 T05 — closes runner secret gap when bootstrap used kubectl create secret.
set -euo pipefail

ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
OUT="${ROOT}/helm/forgejo-runner-registration.sops.yaml"
KUBECONFIG="${KUBECONFIG:-$HOME/.kube/config-hosteurope}"
FORGEJO_NAMESPACE="${FORGEJO_NAMESPACE:-forgejo}"

export KUBECONFIG

if ! command -v sops >/dev/null 2>&1; then
  echo "ERROR: sops required" >&2
  exit 1
fi

if [[ -f "${OUT}" ]]; then
  echo "Already exists: ${OUT}" >&2
  echo "Remove it first if you intend to re-capture from cluster." >&2
  exit 1
fi

token="$(kubectl get secret forgejo-runner-registration -n "${FORGEJO_NAMESPACE}" \
  -o jsonpath='{.data.token}' | base64 -d)"
if [[ -z "${token}" ]]; then
  echo "ERROR: forgejo-runner-registration secret missing or empty in ${FORGEJO_NAMESPACE}" >&2
  exit 1
fi

cat > "${OUT}" <<EOF
apiVersion: v1
kind: Secret
metadata:
  name: forgejo-runner-registration
  namespace: ${FORGEJO_NAMESPACE}
type: Opaque
stringData:
  token: ${token}
EOF

sops --encrypt --in-place "${OUT}"
echo "Created ${OUT}"
echo "Verify: SOPS_SENTINEL=${OUT} make check-sops"