#!/usr/bin/env bash
set -euo pipefail
root="$(git rev-parse --show-toplevel)"
manifest="$root/x/agent-git-service.UPSTREAM"
[[ -f "$manifest" ]] || { echo "missing $manifest" >&2; exit 1; }
source_url="$(sed -n 's/^source=//p' "$manifest")"
commit="$(sed -n 's/^commit=//p' "$manifest")"
[[ "$source_url" == "https://github.com/pingcap/agent-git-service" ]] || { echo "unexpected AGS upstream: $source_url" >&2; exit 1; }
[[ "$commit" =~ ^[0-9a-f]{40}$ ]] || { echo "AGS upstream commit must be a full immutable SHA" >&2; exit 1; }
if grep -R -n -E 'git\.pingcap\.net:pingcap/agent-git-service|github\.com/pingcap/agent-git-service[^[:space:]]* (main|master)' "$root/Makefile" "$root/scripts/update-agent-git-service.sh" "$manifest"; then
  echo "mutable or stale AGS upstream reference detected" >&2
  exit 1
fi