← snapshot

#!/usr/bin/env bash
# Builds the shelf that goes into the public container image.
#
# Only repositories that are already public on GitHub are imported. A publicly
# reachable container is the one place where getting this wrong cannot be taken
# back, so the visibility check is explicit, is re-run every time, and skips
# anything it cannot prove — unknown is not permission.
#
# Usage: scripts/build-deploy-shelf.sh [source-dir] [out-dir]
set -euo pipefail

SRC="${1:-$HOME/github/one}"
OUT="${2:-./deploy-shelf}"
STAGE="$(mktemp -d)"
trap 'rm -rf "$STAGE"' EXIT

command -v gh >/dev/null || { echo "needs the gh CLI, authenticated" >&2; exit 1; }
gh auth status >/dev/null 2>&1 || { echo "run: gh auth login" >&2; exit 1; }

echo "checking visibility of every repo under $SRC"
public=0
skipped=0
for dir in "$SRC"/*/; do
  name="$(basename "$dir")"
  [[ -d "$dir/.git" ]] || continue
  url="$(git -C "$dir" remote get-url origin 2>/dev/null || true)"
  if [[ -z "$url" ]]; then
    skipped=$((skipped + 1))
    continue
  fi
  slug="$(sed -E 's#.*github.com[:/]##; s#\.git$##' <<<"$url")"
  vis="$(gh repo view "$slug" --json visibility -q .visibility 2>/dev/null || echo UNKNOWN)"
  if [[ "$vis" == "PUBLIC" ]]; then
    ln -s "$dir" "$STAGE/$name"
    public=$((public + 1))
  else
    skipped=$((skipped + 1))
  fi
done

echo "  $public public, $skipped skipped (private, unknown, or no remote)"
[[ $public -gt 0 ]] || { echo "nothing public to ship" >&2; exit 1; }

rm -rf "$OUT"
cargo run --release -p jac-serve -- \
  --import-dir "$STAGE" --out "$OUT" --commits 12 --paths 120

echo
echo "shelf written to $OUT ($(du -sh "$OUT" | cut -f1))"
echo "every repo in it is already public on GitHub."