#!/bin/sh


# git for-each-ref refs/tags  # see which tags are annotated and which are lightweight. Annotated tags are "tag" objects.
# # Set these so your commits and tags are always signed
# git config commit.gpgsign true
# git config tag.gpgsign true

verify_commit_signed() {
    if git verify-commit HEAD &> /dev/null; then
        :
        # echo "HEAD commit seems signed..."
    else
        echo "HEAD commit isn't signed!"
        exit 1
    fi
}

verify_tag() {
    if git describe --exact-match --tags HEAD &> /dev/null; then
        : # You might be ok to push
        # echo "Tag is annotated."
        return 0
    else
        echo "Tag for [$version] not an annotated tag."
        exit 1
    fi
}

verify_tag_signed() {
    if git verify-tag "$version" &> /dev/null ; then
        : # ok, I guess we'll let you push
        # echo "Tag appears signed"
        return 0
    else
        echo "$version tag isn't signed"
        echo "Sign it with [git tag -ams\"$version\" $version]"
        exit 1
    fi
}

while read local_ref local_oid remote_ref remote_oid; do
    # Check some things if we're pushing a branch called "release/"
    if echo "$remote_ref" | grep ^refs\/heads\/release\/ &> /dev/null ; then
        version=$(git tag --points-at HEAD)
        echo "Looks like you're trying to push a $version release..."
        echo "Making sure you've signed and tagged it."
        if verify_commit_signed && verify_tag && verify_tag_signed ; then
            : # Ok, I guess you can push
        else
            exit 1
        fi
    fi
done

command -v git-lfs >/dev/null 2>&1 || { echo >&2 "\nThis repository is configured for Git LFS but 'git-lfs' was not found on your path. If you no longer wish to use Git LFS, remove this hook by deleting the 'pre-push' file in the hooks directory (set by 'core.hookspath'; usually '.git/hooks').\n"; exit 2; }

git lfs pre-push "$@"
