#!/usr/bin/env bash
# Render exactly what install.sh applies, without touching any cluster.
#   render.sh <stage-dir>
# Downloads the upstream v1.22.0 assets (reusing files already in <stage-dir>
# only when their pinned SHA-256 matches), verifies every checksum, and writes:
#   <stage-dir>/crds.yaml                 upstream CRDs, verbatim (applied first)
#   <stage-dir>/serving-core.rendered.yaml  serving-core + declared CPU requests
#   <stage-dir>/kourier.rendered.yaml       kourier + CPU requests, ClusterIP, Envoy pin
# Needs curl, sha256sum and a local kubectl with built-in kustomize.
set -euo pipefail
root="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
source "$root/release-lock.env"
stage="${1:?usage: render.sh <stage-dir>}"
mkdir -p "$stage"

fetch() {
  local url="$1" out="$2" sum="$3"
  if ! printf '%s  %s\n' "$sum" "$out" | sha256sum --check --status 2>/dev/null; then
    curl -fsSL --retry 3 "$url" -o "$out"
    printf '%s  %s\n' "$sum" "$out" | sha256sum --check --status \
      || { echo "checksum mismatch: $url" >&2; rm -f "$out"; exit 1; }
  fi
}
serving="https://github.com/knative/serving/releases/download/knative-v${KNATIVE_VERSION}"
kourier="https://github.com/knative-extensions/net-kourier/releases/download/knative-v${KNATIVE_VERSION}"
fetch "$serving/serving-crds.yaml" "$stage/crds.yaml" "$SERVING_CRDS_SHA256"
fetch "$serving/serving-core.yaml" "$stage/core.yaml" "$SERVING_CORE_SHA256"
fetch "$kourier/kourier.yaml" "$stage/kourier.yaml" "$KOURIER_SHA256"

build() {
  local overlay="$1" asset="$2" out="$3" dir="$stage/overlay-$1"
  rm -rf "$dir"
  cp -r "$root/overlays/$overlay" "$dir"
  cp "$stage/$asset" "$dir/upstream.yaml"
  if [ "$overlay" = kourier ]; then
    printf 'images:\n  - name: docker.io/envoyproxy/envoy\n    newName: %s\n    digest: %s\n' \
      "${ENVOY_IMAGE%@*}" "${ENVOY_IMAGE#*@}" >> "$dir/kustomization.yaml"
  fi
  kubectl kustomize "$dir" > "$stage/$out"
}
build serving-core core.yaml serving-core.rendered.yaml
build kourier kourier.yaml kourier.rendered.yaml