# SPDX-License-Identifier: AGPL-3.0-only
# SPDX-FileCopyrightText: Copyright (C) 2026 Catcrafts®
#
# crafter-review as a Flatpak. The runtime is the Freedesktop *Sdk*, as
# Crafter.Build's is, not for a compiler but for what a lens runs through its
# Bash tool: git, python3 for `python3 -` heredocs, curl, jq and coreutils.
# Node (for the Playwright MCP server) and ripgrep (`Bash(rg:*)`, which the Sdk
# lacks) are bundled. claude is not: it is a proprietary binary, found in the
# host's home where its installers put it, and run inside the sandbox like
# everything else, so the memory sampler sees every pass and a pass's whole
# tree can be killed.
#
# The base app is the Crafter.Build Flatpak: its crafter-build, LLVM 23 and
# libc++ build this project inside flatpak-builder, so no second LLVM is
# built. Everything of it but the libc++ the binary links is pruned at the
# end (cleanup-commands below); bump `runtime-version` together with the
# base's.
app-id: net.catcrafts.CrafterReview
runtime: org.freedesktop.Sdk
runtime-version: '26.08'
sdk: org.freedesktop.Sdk
base: net.catcrafts.CrafterBuild
base-version: stable
command: crafter-review
finish-args:
  # claude to the API, npx to the npm registry, the local stacks on the
  # host's loopback, and the driver's SQL broker on 127.0.0.1
  - --share=network
  # repositories, ~/.claude, ~/.cache/review-gates, ~/.cache/ms-playwright,
  # ~/.npm: anywhere a developer keeps them. A convenience for a developer
  # tool, not an isolation boundary.
  - --filesystem=host
  # The sandbox's own /tmp is private; this makes /tmp the host's, so a
  # repository, a config or an artifact under /tmp works as it does natively.
  - --filesystem=/tmp
  # freeze reads `%G?`; gnupg with use-keyboxd keeps its public keys behind
  # this socket. Only this one: the agent, which signs, stays out of reach.
  - --filesystem=xdg-run/gnupg/S.keyboxd
  - --env=PATH=/app/bin:/usr/bin
modules:
  - name: ripgrep
    buildsystem: simple
    build-commands:
      - install -Dm755 rg /app/bin/rg
    sources:
      - type: archive
        url: https://github.com/BurntSushi/ripgrep/releases/download/15.2.0/ripgrep-15.2.0-x86_64-unknown-linux-musl.tar.gz
        sha256: 33e15bcf1624b25cdd2a55813a47a2f95dbe126268203e76aa6a585d1e7b149c

  - name: node
    # For the Playwright MCP server, which the claude CLI starts through
    # `npx`. Unpacked whole, with links in /app/bin.
    buildsystem: simple
    build-commands:
      - mkdir -p /app/lib/node /app/bin
      - cp -a bin include lib share /app/lib/node/
      - ln -sf ../lib/node/bin/node /app/bin/node
      - ln -sf ../lib/node/bin/npm /app/bin/npm
      - ln -sf ../lib/node/bin/npx /app/bin/npx
    sources:
      - type: archive
        url: https://nodejs.org/dist/v24.22.0/node-v24.22.0-linux-x64.tar.xz
        sha256: cc2f601cee82d9a5a233302fe307abc600727035fd7d2c3a3571755989e95008

  - name: crafter-review
    buildsystem: simple
    build-options:
      # crafter-build fetches Crafter.Network, Crafter.Thread and
      # Crafter.LintRules from git, each at the commit project.cpp pins.
      build-args:
        - --share=network
      # On this module, not at the top: top-level build options are part of
      # every module's cache key, and the version changes with every commit.
      env:
        # The shipped binary runs on any x86_64 from the last decade.
        CRAFTER_BUILD_MARCH: x86-64-v2
        CRAFTER_BUILD_MTUNE: generic
        # CI replaces this with the version; a local build is a development
        # build.
        CRAFTER_REVIEW_VERSION: 0.0.0-dev
    build-commands:
      - crafter-build
      - crafter-build test
      - install -Dm755 bin/crafter.review-exe-*/crafter-review /app/bin/crafter-review
      - mkdir -p /app/share/crafter-review && cp -r process /app/share/crafter-review/
      - install -Dm644 packaging/flatpak/prune-base.sh /app/share/crafter-review/prune-base.sh
      - install -Dm644 LICENSE -t /app/share/licenses/net.catcrafts.CrafterReview/
      - install -Dm644 packaging/flatpak/net.catcrafts.CrafterReview.metainfo.xml -t /app/share/metainfo/
    sources:
      - type: dir
        path: ../..
        skip:
          - .git
          - bin
          - build

# The base's files are no module's of this manifest, so `cleanup` patterns do
# not reach them: the prune keeps a named list and removes the rest.
cleanup-commands:
  - sh /app/share/crafter-review/prune-base.sh