#!/usr/bin/env bash
set -euo pipefail

upstream_ref=${1:?usage: ./verify-fork.sh <upstream-tag-or-commit>}
package_project=${PACKAGE_PROJECT:-src/DurableTask.SqlServer/DurableTask.SqlServer.csproj}
test_project=${TEST_PROJECT:-test/DurableTask.SqlServer.Tests/DurableTask.SqlServer.Tests.csproj}

test -f PATCHES.md || { echo "PATCHES.md is required." >&2; exit 1; }
test -f "$package_project" || { echo "Missing package project: $package_project" >&2; exit 1; }
test -f "$test_project" || { echo "Missing test project: $test_project" >&2; exit 1; }

git diff --check "$upstream_ref"...HEAD
git diff --name-only "$upstream_ref"...HEAD | tee /tmp/durabletask-fork-changes.txt
grep -q . /tmp/durabletask-fork-changes.txt || { echo "No fork diff from $upstream_ref." >&2; exit 1; }

if find . -name packages.lock.json -print -quit | grep -q .; then
  dotnet restore --locked-mode
else
  echo "No packages.lock.json found; restoring without locked mode. Add and commit lock files before an offline release." >&2
  dotnet restore
fi
dotnet test "$test_project" -c Release --no-restore
dotnet pack "$package_project" -c Release --no-restore -o artifacts
dotnet list "$package_project" package --include-transitive --vulnerable

sha256sum artifacts/*.nupkg
echo "Verification complete. Attach the changed-file list, package digest, test log, and PATCHES.md to the release record."