#!/usr/bin/env bash
# Verifies that every pinned submodule commit is reachable from its origin.
# Catches the classic "pinned to a local commit nobody else can fetch" mistake.
#
# Usage: ./scripts/check-submodule-pins.sh
set -euo pipefail

ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
cd "$ROOT"

fail=0

while read -r _mode _type sha path; do
	[ -n "${path:-}" ] || continue

	if [ ! -d "$path/.git" ] && [ ! -f "$path/.git" ]; then
		echo "FAIL $path: submodule is not initialised (git submodule update --init)"
		fail=1
		continue
	fi

	git -C "$path" fetch origin --quiet --prune 2>/dev/null || true

	if git -C "$path" branch -r --contains "$sha" 2>/dev/null | grep -q .; then
		echo "ok   $path: $sha is reachable from origin"
	else
		echo "FAIL $path: $sha is NOT pushed to origin — push the submodule first"
		fail=1
	fi
done < <(git ls-tree HEAD | grep '^160000')

exit $fail