#!/usr/bin/env bash
# Install the Helm CLI, pinned + checksum-verified (M24-5) - the same fail-closed download
# posture as deploy/k8s/sealed-secrets.sh. The M24-5 CI deploy streams this over SSH to the dev
# VM (exe.dev VMs take `bash -s` exec channels) so `helm upgrade/rollback` runs next to the k3s
# kubeconfig; it works the same on any linux-amd64 host, including a CI runner.
#
# Usage:
#   helm-cli.sh [install]      (default: install; idempotent - a matching version is a no-op)
#
# Environment overrides:
#   HELM_VERSION   - release to install (default: the pinned one, kept in lockstep with the
#                    version CI's azure/setup-helm uses in ci-test.yml). Overriding it REQUIRES
#                    overriding the sha256 pin below - the download is refused otherwise.
#   HELM_SHA256    - sha256 of that release's helm-v<version>-linux-amd64.tar.gz.
#   HELM_DIR       - where to install helm (default /usr/local/bin; sudo is used only if that
#                    directory is not writable).
set -euo pipefail

PINNED_VERSION="3.16.4"
# sha256 of helm-v3.16.4-linux-amd64.tar.gz, from https://get.helm.sh/<asset>.sha256sum.
PINNED_SHA256="fc307327959aa38ed8f9f7e66d45492bb022a66c3e5da6063958254b9767d179"

VERSION="${HELM_VERSION:-$PINNED_VERSION}"
SHA256="${HELM_SHA256:-}"
if [ "$VERSION" = "$PINNED_VERSION" ]; then
  SHA256="${SHA256:-$PINNED_SHA256}"
fi
HELM_DIR="${HELM_DIR:-/usr/local/bin}"

log() { printf '==> %s\n' "$*"; }

workdir="$(mktemp -d)"
trap 'rm -rf "$workdir"' EXIT

install_helm() {
  if command -v helm >/dev/null 2>&1 \
    && helm version --template '{{.Version}}' 2>/dev/null | grep -q "^v${VERSION}$"; then
    log "helm v${VERSION} already installed"
    return 0
  fi
  [ "$(uname -m)" = "x86_64" ] || { echo "ERROR: only linux-amd64 helm is pinned" >&2; return 1; }
  if [ -z "$SHA256" ]; then
    echo "ERROR: no sha256 pin for helm v${VERSION} - set HELM_SHA256 when overriding HELM_VERSION." >&2
    return 1
  fi
  log "installing helm v${VERSION} into ${HELM_DIR}"
  curl -fsSL "https://get.helm.sh/helm-v${VERSION}-linux-amd64.tar.gz" -o "$workdir/helm.tar.gz"
  echo "$SHA256  $workdir/helm.tar.gz" | sha256sum -c - >/dev/null || {
    echo "ERROR: checksum mismatch for helm v${VERSION}" >&2
    return 1
  }
  tar -xzf "$workdir/helm.tar.gz" -C "$workdir" linux-amd64/helm
  if [ -w "$HELM_DIR" ]; then
    install -m 0755 "$workdir/linux-amd64/helm" "$HELM_DIR/helm"
  else
    sudo install -m 0755 "$workdir/linux-amd64/helm" "$HELM_DIR/helm"
  fi
}

main() {
  local cmd="${1:-install}"
  case "$cmd" in
    install) install_helm ;;
    *) echo "usage: $0 [install]" >&2; exit 2 ;;
  esac
}

main "$@"