#!/usr/bin/env bash
# Validate that a release is an immutable, reviewed snapshot of main and that
# its tag agrees exactly with the published Cargo package version.
set -euo pipefail

if [[ $# -ne 1 ]]; then
    echo "usage: $0 vX.Y.Z" >&2
    exit 2
fi

tag="$1"
repo_root="$(git rev-parse --show-toplevel)"
manifest="$repo_root/Cargo.toml"
version="$(sed -n 's/^version = "\([^"]*\)"/\1/p' "$manifest" | head -n 1)"
expected_tag="v$version"
release_sha="${RELEASE_SHA:?RELEASE_SHA must be the immutable release-event commit SHA}"

if [[ "$tag" != "$expected_tag" ]]; then
    echo "release tag $tag does not match package version $version (expected $expected_tag)" >&2
    exit 1
fi

release_commit="$(git rev-parse --verify "$release_sha^{commit}")"
head_commit="$(git rev-parse HEAD)"
if [[ "$head_commit" != "$release_commit" ]]; then
    echo "checked-out commit $head_commit does not match release-event commit $release_commit" >&2
    exit 1
fi

tag_commit="$(git rev-parse --verify "$tag^{commit}")"
if [[ "$tag_commit" != "$release_commit" ]]; then
    echo "release tag $tag resolves to $tag_commit, not release-event commit $release_commit" >&2
    exit 1
fi

default_branch="${DEFAULT_BRANCH:-main}"
git merge-base --is-ancestor "$release_commit" "origin/$default_branch"