#!/bin/sh
set -eu

set_output() {
  key="$1"
  value="$2"
  if [ -n "${GITHUB_OUTPUT:-}" ]; then
    printf '%s=%s\n' "$key" "$value" >> "$GITHUB_OUTPUT"
  fi
  printf '%s=%s\n' "$key" "$value"
}

set_all() {
  value="$1"
  set_output app "$value"
  set_output security_deps "$value"
  set_output deploy "$value"
}

event_name="${GITHUB_EVENT_NAME:-}"
if [ "$event_name" = "schedule" ] || [ "$event_name" = "workflow_dispatch" ]; then
  echo "Running all jobs for $event_name."
  set_all true
  exit 0
fi

head_sha="${GITHUB_SHA:-HEAD}"
base_sha="${CHANGESET_PR_BASE_SHA:-}"
before_sha="${CHANGESET_BEFORE:-}"
zero_sha="0000000000000000000000000000000000000000"

if [ -z "$base_sha" ] && [ -n "$before_sha" ] && [ "$before_sha" != "$zero_sha" ]; then
  base_sha="$before_sha"
fi

if [ -z "$base_sha" ]; then
  echo "No reliable base commit found; running all jobs."
  set_all true
  exit 0
fi

if ! git cat-file -e "$base_sha^{commit}" 2>/dev/null; then
  git fetch --no-tags --depth=1 origin "$base_sha" || true
fi

if ! git cat-file -e "$base_sha^{commit}" 2>/dev/null; then
  echo "Base commit $base_sha is unavailable; running all jobs."
  set_all true
  exit 0
fi

changed_files="$(git diff --name-only "$base_sha" "$head_sha")"
if [ -z "$changed_files" ]; then
  echo "No changed files detected."
  set_all false
  exit 0
fi

app=false
security_deps=false
deploy=false

echo "Changed files:"
printf '%s\n' "$changed_files"

for path in $changed_files; do
  case "$path" in
    *)
      app=true
      deploy=true
      ;;
  esac

  case "$path" in
    .gitea/workflows/*|docker-compose*.yml|scripts/trivy-scan.sh|Dockerfile*|package.json|package-lock.json)
      security_deps=true
      ;;
  esac
done

set_output app "$app"
set_output security_deps "$security_deps"
set_output deploy "$deploy"