#!/usr/bin/env bash
# Print the default a commit's infra/variables.tf gives one variable.
#
#   scripts/pin.sh <rev> indigo_ref
#
# What a release builds and what its deploy applies are the commit's own
# pins, not the working tree's and not whatever the live state was applied
# with. Reading the file out of git needs no checkout and no `tofu init`.
# Only a quoted string default on its own line is understood, which is how
# every pin there is written; anything else is an error rather than a guess.
set -euo pipefail

if [ "$#" -ne 2 ]; then
  echo "usage: scripts/pin.sh <rev> <variable>" >&2
  exit 2
fi
rev="$1"
name="$2"

value="$(git show "$rev:infra/variables.tf" | awk -v name="$name" '
  $0 ~ "^variable \"" name "\" *[{]" { inside = 1; next }
  inside && /^}/ { exit }
  inside && /^[ \t]*default[ \t]*=[ \t]*"[^"]*"[ \t]*$/ {
    sub(/^[^"]*"/, ""); sub(/"[ \t]*$/, ""); print; exit
  }
')"
if [ -z "$value" ]; then
  echo "pin: $rev's infra/variables.tf has no string default for $name" >&2
  exit 1
fi
printf '%s\n' "$value"