patchctl

#!/usr/bin/env bash

set -euo pipefail

KIT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
PROJECTS_DIR="$KIT_DIR/projects"

usage() {
	cat <<'USAGE'
Usage:
  patchctl doctor
  patchctl list
  patchctl apply <project|all> <workspace>
  patchctl verify <project|all> <workspace>
  patchctl test <project|all> <workspace>
  patchctl build <project|all> <workspace>
  patchctl publish-local <project|all> <workspace>
  patchctl stage-selective <project|all> <workspace> <new-output-directory>
  patchctl publish-source <project|all> <workspace> [--push]
  patchctl capture <project> <source-repository> <new-output-directory>

Environment:
  PATCH_JAVA_HOME   JDK used for Gradle commands. On macOS, Java 21 is
                    discovered automatically when this is unset.
  PATCH_ARTIFACTORY_MAVEN_URL
                    Optional corporate virtual Maven repository used for all
                    plugin, buildscript, and dependency downloads.
  PATCH_ARTIFACTORY_USERNAME / PATCH_ARTIFACTORY_PASSWORD
                    Optional Artifactory credentials. Set both or neither;
                    they are read from the environment and never stored.

The apply command never overwrites an existing target repository.
The stage-selective command prepares a Maven-only upload directory containing
affected modules; it never connects to an artifact repository.
The publish-source command is a preview unless --push is supplied. It never
force-pushes and never stores credentials.
USAGE
}

die() {
	echo "error: $*" >&2
	exit 1
}

project_ids() {
	local config
	for config in "$PROJECTS_DIR"/*/project.conf; do
		[[ -f "$config" ]] || continue
		basename "$(dirname "$config")"
	done
}

load_project() {
	local requested_id="$1"
	PROJECT_CONFIG_DIR="$PROJECTS_DIR/$requested_id"
	local config="$PROJECT_CONFIG_DIR/project.conf"
	[[ -f "$config" ]] || die "unknown project '$requested_id'; run 'patchctl list'"

	unset PROJECT_ID DISPLAY_NAME REPOSITORY_URL BASE_REF TARGET_DIRECTORY
	unset PATCH_BRANCH EXPECTED_VERSION VERSION_FILE JAVA_VERSION
	unset TEST_ARGS BUILD_ARGS PUBLISH_ARGS EXPECTED_CVES
	unset PUBLISH_REPOSITORY_URL SOURCE_TAG
	unset SELECTIVE_BASE_VERSION SELECTIVE_GROUP SELECTIVE_MODULES SELECTIVE_DIRECTORIES
	unset SELECTIVE_PACKAGING BUILD_TOOL VERSION_PATTERN MAVEN_STAGE_ARGS

	# Project definitions are trusted files maintained in this kit.
	# shellcheck source=/dev/null
	source "$config"

	[[ "${PROJECT_ID:-}" == "$requested_id" ]] || die "invalid PROJECT_ID in $config"
	[[ -n "${DISPLAY_NAME:-}" ]] || die "missing DISPLAY_NAME in $config"
	[[ -n "${REPOSITORY_URL:-}" ]] || die "missing REPOSITORY_URL in $config"
	[[ -n "${BASE_REF:-}" ]] || die "missing BASE_REF in $config"
	[[ -n "${TARGET_DIRECTORY:-}" ]] || die "missing TARGET_DIRECTORY in $config"
	[[ -n "${PATCH_BRANCH:-}" ]] || die "missing PATCH_BRANCH in $config"
	[[ -n "${EXPECTED_VERSION:-}" ]] || die "missing EXPECTED_VERSION in $config"
	[[ -n "${VERSION_FILE:-}" ]] || die "missing VERSION_FILE in $config"
}

for_selection() {
	local selection="$1"
	shift
	local callback="$1"
	shift
	local project_id

	if [[ "$selection" == "all" ]]; then
		while IFS= read -r project_id; do
			[[ -n "$project_id" ]] || continue
			"$callback" "$project_id" "$@"
		done < <(project_ids)
	else
		"$callback" "$selection" "$@"
	fi
}

list_one() {
	local project_id="$1"
	load_project "$project_id"
	printf '%-35s %-28s %s\n' "$PROJECT_ID" "$EXPECTED_VERSION" "$DISPLAY_NAME"
}

java_major_version() {
	local java_home="$1"
	"$java_home/bin/java" -version 2>&1 | awk -F'"' '
		/version/ {
			split($2, parts, ".")
			print (parts[1] == "1" ? parts[2] : parts[1])
			exit
		}
	'
}

doctor() {
	local failed=false
	local tool
	for tool in bash git; do
		if command -v "$tool" >/dev/null 2>&1; then
			echo "found $tool: $(command -v "$tool")"
		else
			echo "missing required tool: $tool" >&2
			failed=true
		fi
	done

	if command -v java >/dev/null 2>&1; then
		echo "default Java:"
		java -version 2>&1 | head -n 1
	else
		echo "missing Java; apply and verify work, but test/build/publish do not" >&2
	fi

	local java_home=""
	if [[ -n "${PATCH_JAVA_HOME:-}" ]]; then
		java_home="$PATCH_JAVA_HOME"
	elif [[ "$(uname -s)" == "Darwin" && -x /usr/libexec/java_home ]]; then
		java_home="$(/usr/libexec/java_home -v 21 2>/dev/null || true)"
	elif [[ -n "${JAVA_HOME:-}" ]]; then
		java_home="$JAVA_HOME"
	fi
	if [[ -n "$java_home" && -x "$java_home/bin/java" ]]; then
		echo "Build Java: $java_home"
		"$java_home/bin/java" -version 2>&1 | head -n 1
		local java_major
		java_major="$(java_major_version "$java_home")"
		if [[ "$java_major" != "21" ]]; then
			echo "Build Java must be JDK 21, found major version ${java_major:-unknown}" >&2
			failed=true
		fi
	else
		echo "Java 21 was not discovered; set PATCH_JAVA_HOME before Gradle operations" >&2
		failed=true
	fi

	if [[ -n "${PATCH_ARTIFACTORY_MAVEN_URL:-}" ]]; then
		local mirror_valid=true
		case "$PATCH_ARTIFACTORY_MAVEN_URL" in
			https://*|file://*) ;;
			*) echo "Artifactory mirror URL must use https:// (or file:// for testing)" >&2; failed=true; mirror_valid=false ;;
		esac
		if [[ -n "${PATCH_ARTIFACTORY_USERNAME:-}" && -z "${PATCH_ARTIFACTORY_PASSWORD:-}" ]] ||
				[[ -z "${PATCH_ARTIFACTORY_USERNAME:-}" && -n "${PATCH_ARTIFACTORY_PASSWORD:-}" ]]; then
			echo "set both PATCH_ARTIFACTORY_USERNAME and PATCH_ARTIFACTORY_PASSWORD, or neither" >&2
			failed=true
		elif [[ "$mirror_valid" == true ]]; then
			echo "corporate Artifactory dependency mirror is configured"
		fi
	else
		echo "corporate Artifactory dependency mirror is not configured"
	fi

	if [[ "$failed" == true ]]; then
		return 1
	fi
	echo "environment is ready for patch replay"
}

verify_one() {
	local project_id="$1"
	local workspace="$2"
	load_project "$project_id"
	local repository="$workspace/$TARGET_DIRECTORY"

	[[ -d "$repository/.git" ]] || die "$repository is not a Git repository"
	local branch
	branch="$(git -C "$repository" branch --show-current)"
	[[ "$branch" == "$PATCH_BRANCH" ]] ||
		die "$PROJECT_ID is on '$branch', expected '$PATCH_BRANCH'"
	local version_pattern="${VERSION_PATTERN:-version=$EXPECTED_VERSION}"
	grep -Fq "$version_pattern" "$repository/$VERSION_FILE" ||
		die "$PROJECT_ID does not declare version $EXPECTED_VERSION"
	[[ -z "$(git -C "$repository" status --porcelain)" ]] ||
		die "$PROJECT_ID worktree is not clean"

	local commit_subjects
	commit_subjects="$(git -C "$repository" log "$BASE_REF..HEAD" --format='%s')"
	local cve
	for cve in "${EXPECTED_CVES[@]}"; do
		grep -Fq "$cve" <<<"$commit_subjects" ||
			die "$PROJECT_ID is missing an atomic commit for $cve"
	done

	echo "verified $PROJECT_ID at $EXPECTED_VERSION"
}

apply_one() {
	local project_id="$1"
	local workspace="$2"
	load_project "$project_id"
	local repository="$workspace/$TARGET_DIRECTORY"

	[[ ! -e "$repository" ]] ||
		die "$repository already exists; choose a fresh workspace or move it first"
	mkdir -p "$workspace"

	echo "cloning $DISPLAY_NAME from $BASE_REF"
	git clone --depth 1 --branch "$BASE_REF" "$REPOSITORY_URL" "$repository"
	git -C "$repository" switch -c "$PATCH_BRANCH"

	local patch found_patch=false
	for patch in "$PROJECT_CONFIG_DIR"/patches/*.patch; do
		[[ -f "$patch" ]] || continue
		found_patch=true
		echo "applying $(basename "$patch")"
		if ! git -C "$repository" am --3way "$patch"; then
			git -C "$repository" am --abort || true
			die "failed to apply $(basename "$patch") to $PROJECT_ID"
		fi
	done
	[[ "$found_patch" == true ]] || die "no patches found for $PROJECT_ID"

	verify_one "$project_id" "$workspace"
}

resolve_java_home() {
	if [[ -n "${PATCH_JAVA_HOME:-}" ]]; then
		printf '%s\n' "$PATCH_JAVA_HOME"
		return
	fi
	if [[ "$(uname -s)" == "Darwin" && -x /usr/libexec/java_home ]]; then
		/usr/libexec/java_home -v "${JAVA_VERSION:-21}"
		return
	fi
	if [[ -n "${JAVA_HOME:-}" ]]; then
		printf '%s\n' "$JAVA_HOME"
		return
	fi
	die "set PATCH_JAVA_HOME to a Java ${JAVA_VERSION:-21} JDK"
}

run_build_one() {
	local project_id="$1"
	local workspace="$2"
	local operation="$3"
	load_project "$project_id"
	verify_one "$project_id" "$workspace"
	local repository="$workspace/$TARGET_DIRECTORY"
	local java_home
	java_home="$(resolve_java_home)"
	[[ -x "$java_home/bin/java" ]] || die "$java_home does not contain an executable Java runtime"
	local java_major
	java_major="$(java_major_version "$java_home")"
	[[ "$java_major" == "${JAVA_VERSION:-21}" ]] ||
		die "$PROJECT_ID requires JDK ${JAVA_VERSION:-21}, found ${java_major:-unknown} at $java_home"

	local build_tool="${BUILD_TOOL:-gradle}"
	local -a args=()
	case "$build_tool" in
		gradle)
			if [[ -n "${PATCH_ARTIFACTORY_MAVEN_URL:-}" ]]; then
				args+=("--init-script" "$KIT_DIR/gradle/artifactory-mirror.init.gradle")
			fi
			case "$operation" in
				test) args+=("${TEST_ARGS[@]}") ;;
				build) args+=("${BUILD_ARGS[@]}") ;;
				publish-local) args+=("${PUBLISH_ARGS[@]}") ;;
				*) die "unsupported build operation '$operation'" ;;
			esac
			echo "running $operation for $PROJECT_ID with Gradle and $java_home"
			(
				cd "$repository"
				env JAVA_HOME="$java_home" ./gradlew "${args[@]}"
			)
			;;
		maven)
			if [[ -n "${PATCH_ARTIFACTORY_MAVEN_URL:-}" ]]; then
				args+=("--settings" "$KIT_DIR/examples/maven-settings-artifactory.xml")
			fi
			case "$operation" in
				test) args+=("${TEST_ARGS[@]}") ;;
				build) args+=("${BUILD_ARGS[@]}") ;;
				publish-local) args+=("${PUBLISH_ARGS[@]}") ;;
				*) die "unsupported build operation '$operation'" ;;
			esac
			echo "running $operation for $PROJECT_ID with Maven Wrapper and $java_home"
			(
				cd "$repository"
				env JAVA_HOME="$java_home" ./mvnw "${args[@]}"
			)
			;;
		*) die "unsupported BUILD_TOOL '$build_tool' for $PROJECT_ID" ;;
	esac
}

validate_selective_pom() {
	local pom="$1"
	local group="$2"
	local custom_version="$3"
	local selected_csv="$4"

	grep -Fq "<version>$custom_version</version>" "$pom" ||
		die "$pom does not declare selective artifact version $custom_version"

	awk -v internal_group="$group" -v custom_version="$custom_version" \
		-v selected_csv="$selected_csv" '
		BEGIN {
			split(selected_csv, selected, ",")
			for (item in selected) {
				selected_artifacts[selected[item]] = 1
			}
		}
		/<dependency>/ {
			in_dependency = 1
			dependency_group = ""
			dependency_artifact = ""
			dependency_version = ""
		}
		in_dependency && /<groupId>/ {
			dependency_group = $0
			sub(/^.*<groupId>/, "", dependency_group)
			sub(/<\/groupId>.*$/, "", dependency_group)
		}
		in_dependency && /<artifactId>/ {
			dependency_artifact = $0
			sub(/^.*<artifactId>/, "", dependency_artifact)
			sub(/<\/artifactId>.*$/, "", dependency_artifact)
		}
		in_dependency && /<version>/ {
			dependency_version = $0
			sub(/^.*<version>/, "", dependency_version)
			sub(/<\/version>.*$/, "", dependency_version)
		}
		/<\/dependency>/ {
			if (dependency_group == internal_group &&
				dependency_version == custom_version &&
				!selected_artifacts[dependency_artifact]) {
				printf "unrewritten custom dependency %s:%s:%s in %s\n", \
					dependency_group, dependency_artifact, dependency_version, FILENAME > "/dev/stderr"
				exit 1
			}
			in_dependency = 0
		}
	' "$pom" || die "selective POM validation failed for $pom"
}

stage_selective_one() {
	local project_id="$1"
	local workspace="$2"
	local stage_root="$3"
	load_project "$project_id"
	verify_one "$project_id" "$workspace"

	[[ -n "${SELECTIVE_BASE_VERSION:-}" ]] ||
		die "missing SELECTIVE_BASE_VERSION for $PROJECT_ID"
	[[ -n "${SELECTIVE_GROUP:-}" ]] || die "missing SELECTIVE_GROUP for $PROJECT_ID"
	[[ "${#SELECTIVE_MODULES[@]}" -gt 0 ]] || die "missing SELECTIVE_MODULES for $PROJECT_ID"
	if declare -p SELECTIVE_DIRECTORIES >/dev/null 2>&1; then
		[[ "${#SELECTIVE_DIRECTORIES[@]}" -eq "${#SELECTIVE_MODULES[@]}" ]] ||
			die "SELECTIVE_DIRECTORIES must match SELECTIVE_MODULES for $PROJECT_ID"
	fi

	local repository="$workspace/$TARGET_DIRECTORY"
	local java_home
	java_home="$(resolve_java_home)"
	[[ -x "$java_home/bin/java" ]] || die "$java_home does not contain an executable Java runtime"
	local java_major
	java_major="$(java_major_version "$java_home")"
	[[ "$java_major" == "${JAVA_VERSION:-21}" ]] ||
		die "$PROJECT_ID requires JDK ${JAVA_VERSION:-21}, found ${java_major:-unknown} at $java_home"

	local selected_csv
	selected_csv="$(IFS=,; echo "${SELECTIVE_MODULES[*]}")"
	if [[ "${BUILD_TOOL:-gradle}" == "maven" ]]; then
		declare -p MAVEN_STAGE_ARGS >/dev/null 2>&1 ||
			die "missing MAVEN_STAGE_ARGS for $PROJECT_ID"
		declare -p SELECTIVE_PACKAGING >/dev/null 2>&1 ||
			die "missing SELECTIVE_PACKAGING for $PROJECT_ID"
		[[ "${#SELECTIVE_PACKAGING[@]}" -eq "${#SELECTIVE_MODULES[@]}" ]] ||
			die "SELECTIVE_PACKAGING must match SELECTIVE_MODULES for $PROJECT_ID"

		local -a maven_args=()
		if [[ -n "${PATCH_ARTIFACTORY_MAVEN_URL:-}" ]]; then
			maven_args+=("--settings" "$KIT_DIR/examples/maven-settings-artifactory.xml")
		fi
		maven_args+=("${MAVEN_STAGE_ARGS[@]}")
		echo "generating selective Maven publications for $PROJECT_ID with $java_home"
		(
			cd "$repository"
			env JAVA_HOME="$java_home" ./mvnw "${maven_args[@]}"
		)

		local group_path="${SELECTIVE_GROUP//.//}"
		local module_index=0
		for module in "${SELECTIVE_MODULES[@]}"; do
			local source_directory="${SELECTIVE_DIRECTORIES[$module_index]}"
			local packaging="${SELECTIVE_PACKAGING[$module_index]}"
			local source_root="$repository/$source_directory"
			local target_directory="$stage_root/$group_path/$module/$EXPECTED_VERSION"
			local pom="$source_root/pom.xml"
			mkdir -p "$target_directory"
			[[ -f "$pom" ]] || die "missing $pom"
			validate_selective_pom "$pom" "$SELECTIVE_GROUP" "$EXPECTED_VERSION" "$selected_csv"
			cp "$pom" "$target_directory/$module-$EXPECTED_VERSION.pom"

			if [[ "$packaging" == "jar" ]]; then
				local classifier
				for classifier in "" "-sources" "-javadoc"; do
					local jar="$source_root/target/$module-$EXPECTED_VERSION$classifier.jar"
					[[ -f "$jar" ]] || die "missing $jar"
					cp "$jar" "$target_directory/"
				done
			elif [[ "$packaging" != "pom" ]]; then
				die "unsupported selective Maven packaging '$packaging' for $module"
			fi
			echo "staged $SELECTIVE_GROUP:$module:$EXPECTED_VERSION"
			module_index=$((module_index + 1))
		done

		verify_one "$project_id" "$workspace"
		return
	fi
	[[ "${BUILD_TOOL:-gradle}" == "gradle" ]] ||
		die "unsupported BUILD_TOOL '${BUILD_TOOL:-}' for selective staging"
	local -a gradle_args=(
	)
	if [[ -n "${PATCH_ARTIFACTORY_MAVEN_URL:-}" ]]; then
		gradle_args+=("--init-script" "$KIT_DIR/gradle/artifactory-mirror.init.gradle")
	fi
	gradle_args+=(
		"--init-script" "$KIT_DIR/gradle/selective-pom.init.gradle"
		"-DspringPatchKit.baseVersion=$SELECTIVE_BASE_VERSION"
		"-DspringPatchKit.customVersion=$EXPECTED_VERSION"
		"-DspringPatchKit.internalGroup=$SELECTIVE_GROUP"
		"-DspringPatchKit.selectedArtifacts=$selected_csv"
	)
	local module
	for module in "${SELECTIVE_MODULES[@]}"; do
		gradle_args+=(
			":$module:jar"
			":$module:sourcesJar"
			":$module:javadocJar"
			":$module:generatePomFileForMavenJavaPublication"
		)
	done

	echo "generating selective Maven publications for $PROJECT_ID with $java_home"
	(
		cd "$repository"
		env JAVA_HOME="$java_home" ./gradlew "${gradle_args[@]}"
	)

	local group_path="${SELECTIVE_GROUP//.//}"
	local module_index=0
	for module in "${SELECTIVE_MODULES[@]}"; do
		local source_directory="$module"
		if declare -p SELECTIVE_DIRECTORIES >/dev/null 2>&1; then
			source_directory="${SELECTIVE_DIRECTORIES[$module_index]}"
		fi
		local target_directory="$stage_root/$group_path/$module/$EXPECTED_VERSION"
		mkdir -p "$target_directory"

		local main_jar="$repository/$source_directory/build/libs/$module-$EXPECTED_VERSION.jar"
		local sources_jar="$repository/$source_directory/build/libs/$module-$EXPECTED_VERSION-sources.jar"
		local javadoc_jar="$repository/$source_directory/build/libs/$module-$EXPECTED_VERSION-javadoc.jar"
		local pom="$repository/$source_directory/build/publications/mavenJava/pom-default.xml"
		[[ -f "$main_jar" ]] || die "missing $main_jar"
		[[ -f "$sources_jar" ]] || die "missing $sources_jar"
		[[ -f "$javadoc_jar" ]] || die "missing $javadoc_jar"
		[[ -f "$pom" ]] || die "missing $pom"
		validate_selective_pom "$pom" "$SELECTIVE_GROUP" "$EXPECTED_VERSION" "$selected_csv"

		cp "$main_jar" "$target_directory/"
		cp "$sources_jar" "$target_directory/"
		cp "$javadoc_jar" "$target_directory/"
		cp "$pom" "$target_directory/$module-$EXPECTED_VERSION.pom"
		echo "staged $SELECTIVE_GROUP:$module:$EXPECTED_VERSION"
		module_index=$((module_index + 1))
	done

	verify_one "$project_id" "$workspace"
}

write_selective_checksums() {
	local stage_root="$1"
	local checksum_tool=""
	if command -v sha256sum >/dev/null 2>&1; then
		checksum_tool="sha256sum"
	elif command -v shasum >/dev/null 2>&1; then
		checksum_tool="shasum"
	else
		die "sha256sum or shasum is required to checksum selective publications"
	fi

	(
		cd "$stage_root"
		find . -type f ! -name SHA256SUMS -print | sort | while IFS= read -r file; do
			if [[ "$checksum_tool" == "sha256sum" ]]; then
				sha256sum "$file"
			else
				shasum -a 256 "$file"
			fi
		done > SHA256SUMS
	)
}

stage_selective() {
	local selection="$1"
	local workspace="$2"
	local output_directory="$3"
	[[ ! -e "$output_directory" ]] ||
		die "$output_directory already exists; selective staging requires a new directory"
	local output_parent
	output_parent="$(dirname "$output_directory")"
	mkdir -p "$output_parent"
	local partial_directory="$output_directory.partial.$$"
	[[ ! -e "$partial_directory" ]] || die "$partial_directory already exists"
	mkdir -p "$partial_directory"

	for_selection "$selection" stage_selective_one "$workspace" "$partial_directory"
	write_selective_checksums "$partial_directory"
	mv "$partial_directory" "$output_directory"
	echo "selective Maven upload directory is ready: $output_directory"
	echo "upload its repository paths and retain SHA256SUMS as evidence; it contains no Gradle module metadata"
}

source_publish_one() {
	local project_id="$1"
	local workspace="$2"
	local mode="$3"
	load_project "$project_id"
	verify_one "$project_id" "$workspace"

	[[ -n "${PUBLISH_REPOSITORY_URL:-}" ]] ||
		die "missing PUBLISH_REPOSITORY_URL for $PROJECT_ID"
	[[ -n "${SOURCE_TAG:-}" ]] || die "missing SOURCE_TAG for $PROJECT_ID"
	case "$PUBLISH_REPOSITORY_URL" in
		https://*@*) die "publish URL must not contain credentials" ;;
		https://github.com/*.git) ;;
		*) die "publish URL must be a public GitHub HTTPS .git URL" ;;
	esac

	local repository="$workspace/$TARGET_DIRECTORY"
	git -C "$repository" merge-base --is-ancestor "$BASE_REF" HEAD ||
		die "$BASE_REF is not an ancestor of $PROJECT_ID HEAD"

	local expected_commit_count=0
	local patch
	for patch in "$PROJECT_CONFIG_DIR"/patches/*.patch; do
		[[ -f "$patch" ]] || continue
		expected_commit_count=$((expected_commit_count + 1))
	done
	[[ "$expected_commit_count" -gt 0 ]] || die "no patches found for $PROJECT_ID"

	local actual_commit_count
	actual_commit_count="$(git -C "$repository" rev-list --count "$BASE_REF..HEAD")"
	[[ "$actual_commit_count" -eq "$expected_commit_count" ]] ||
		die "$PROJECT_ID has $actual_commit_count backport commits; expected $expected_commit_count from the registered patch series"

	local head_commit
	head_commit="$(git -C "$repository" rev-parse HEAD)"
	if git -C "$repository" show-ref --verify --quiet "refs/tags/$SOURCE_TAG"; then
		local tag_commit
		tag_commit="$(git -C "$repository" rev-list -n 1 "$SOURCE_TAG")"
		[[ "$tag_commit" == "$head_commit" ]] ||
			die "existing tag $SOURCE_TAG does not point to $PROJECT_ID HEAD"
	fi

	echo
	echo "source publication plan for $PROJECT_ID"
	echo "  repository: $repository"
	echo "  commit:     $head_commit"
	echo "  branch:     $PATCH_BRANCH"
	echo "  tag:        $SOURCE_TAG"
	echo "  fork:       $PUBLISH_REPOSITORY_URL"
	git -C "$repository" log --reverse --oneline "$BASE_REF..HEAD" | sed 's/^/    /'

	if [[ "$mode" != "push" ]]; then
		echo "preview only; rerun with --push after creating the GitHub fork"
		return
	fi

	if ! git -C "$repository" show-ref --verify --quiet "refs/tags/$SOURCE_TAG"; then
		git -C "$repository" tag "$SOURCE_TAG" "$head_commit"
	fi

	local remote_name="patch-publish"
	if git -C "$repository" remote get-url "$remote_name" >/dev/null 2>&1; then
		local configured_url
		configured_url="$(git -C "$repository" remote get-url "$remote_name")"
		[[ "$configured_url" == "$PUBLISH_REPOSITORY_URL" ]] ||
			die "$remote_name points to $configured_url, expected $PUBLISH_REPOSITORY_URL"
	else
		git -C "$repository" remote add "$remote_name" "$PUBLISH_REPOSITORY_URL"
	fi

	echo "pushing only $PATCH_BRANCH and $SOURCE_TAG (never force)"
	git -C "$repository" push --atomic --set-upstream "$remote_name" \
		"HEAD:refs/heads/$PATCH_BRANCH" \
		"refs/tags/$SOURCE_TAG:refs/tags/$SOURCE_TAG"
}

capture_one() {
	local project_id="$1"
	local source_repository="$2"
	local output_directory="$3"
	load_project "$project_id"

	[[ -d "$source_repository/.git" ]] || die "$source_repository is not a Git repository"
	[[ -z "$(git -C "$source_repository" status --porcelain)" ]] ||
		die "source repository worktree is not clean"
	git -C "$source_repository" rev-parse --verify "$BASE_REF^{commit}" >/dev/null
	[[ ! -e "$output_directory" ]] ||
		die "$output_directory already exists; capture requires a new directory"
	mkdir -p "$output_directory"

	git -C "$source_repository" format-patch \
		--output-directory "$output_directory" "$BASE_REF..HEAD"
	echo "captured $PROJECT_ID patches in $output_directory"
}

main() {
	local command="${1:-}"
	case "$command" in
		doctor)
			[[ $# -eq 1 ]] || { usage; exit 2; }
			doctor
			;;
		list)
			printf '%-35s %-28s %s\n' PROJECT VERSION DESCRIPTION
			local project_id
			while IFS= read -r project_id; do
				[[ -n "$project_id" ]] || continue
				list_one "$project_id"
			done < <(project_ids)
			;;
		apply|verify|test|build|publish-local)
			[[ $# -eq 3 ]] || { usage; exit 2; }
			local selection="$2"
			local workspace="$3"
			if [[ "$command" == "apply" ]]; then
				for_selection "$selection" apply_one "$workspace"
			elif [[ "$command" == "verify" ]]; then
				for_selection "$selection" verify_one "$workspace"
			else
				for_selection "$selection" run_build_one "$workspace" "$command"
			fi
			;;
		publish-source)
			[[ $# -eq 3 || ( $# -eq 4 && "${4:-}" == "--push" ) ]] || { usage; exit 2; }
			local publish_mode="preview"
			[[ "${4:-}" == "--push" ]] && publish_mode="push"
			for_selection "$2" source_publish_one "$3" "$publish_mode"
			;;
		stage-selective)
			[[ $# -eq 4 ]] || { usage; exit 2; }
			stage_selective "$2" "$3" "$4"
			;;
		capture)
			[[ $# -eq 4 ]] || { usage; exit 2; }
			capture_one "$2" "$3" "$4"
			;;
		-h|--help|help)
			usage
			;;
		*)
			usage
			exit 2
			;;
	esac
}

main "$@"