publish.cmd

@echo off
setlocal EnableExtensions DisableDelayedExpansion

set "REPO_URL=https://github.com/jassermedhat/visioncart-autonomous-checkout.git"
set "DEFAULT_COMMIT_MESSAGE=Update VisionCart project"

pushd "%~dp0" >nul 2>&1
if errorlevel 1 (
    echo Error: Could not open the VisionCart project directory.
    exit /b 1
)

where git >nul 2>&1
if errorlevel 1 (
    echo Error: Git is not installed or is not available on PATH.
    popd
    exit /b 1
)
git --version >nul 2>&1
if errorlevel 1 (
    echo Error: Git is not working correctly.
    popd
    exit /b 1
)

set "RUN_CHECKS=0"
if "%~1"=="" (
    set "COMMIT_MESSAGE=%DEFAULT_COMMIT_MESSAGE%"
) else if /I "%~1"=="--check" (
    set "COMMIT_MESSAGE=%DEFAULT_COMMIT_MESSAGE%"
    set "RUN_CHECKS=1"
) else (
    set "COMMIT_MESSAGE=%~1"
    if not "%~2"=="" (
        if /I not "%~2"=="--check" goto :usage
        set "RUN_CHECKS=1"
    )
)
if /I "%~1"=="--check" (
    if not "%~2"=="" goto :usage
) else (
    if not "%~3"=="" goto :usage
)

where python >nul 2>&1
if errorlevel 1 (
    echo Error: Python is required for the VisionCart credential scan.
    popd
    exit /b 1
)

if not exist ".git\" (
    echo Initializing Git repository...
    git init
    if errorlevel 1 (
        echo Git initialization failed.
        popd
        exit /b 1
    )
    git branch -M main
    if errorlevel 1 (
        echo Failed to configure the main branch.
        popd
        exit /b 1
    )
)

for /f "delims=" %%B in ('git branch --show-current 2^>nul') do set "CURRENT_BRANCH=%%B"
if not "%CURRENT_BRANCH%"=="main" (
    echo Error: The current branch is "%CURRENT_BRANCH%". Switch to main before publishing.
    popd
    exit /b 1
)

call :ensure_origin
if errorlevel 1 (
    popd
    exit /b 1
)

for %%P in (
    ".env"
    ".local\publish-safety-probe"
    "data\raw\publish-safety-probe"
    "data\processed\publish-safety-probe"
    "models\publish-safety-probe.pt"
    "models\publish-safety-probe.pth"
    "models\publish-safety-probe.ckpt"
    "models\publish-safety-probe.onnx"
    "models\publish-safety-probe.engine"
    "frontend\node_modules\publish-safety-probe"
    "frontend\dist\publish-safety-probe"
    "outputs\publish-safety-probe"
    "transactions\publish-safety-probe"
    "runs\publish-safety-probe"
    "logs\publish-safety-probe"
) do (
    git check-ignore -q -- "%%~P"
    if errorlevel 1 (
        echo Error: Required private/generated path "%%~P" is not ignored.
        goto :safety_failed
    )
)

for %%P in (
    ".env.example"
    "reports\publish-safety-probe.json"
    "assets\demo\publish-safety-probe.jpg"
    "assets\ui\publish-safety-probe.png"
    "src\visioncart\publish-safety-probe.py"
    "frontend\src\publish-safety-probe.ts"
) do (
    git check-ignore -q -- "%%~P"
    if not errorlevel 1 (
        echo Error: Required portfolio path "%%~P" is ignored.
        goto :safety_failed
    )
)
call :reject_tracked_private
if errorlevel 1 goto :safety_failed

echo Running VisionCart credential scan...
python scripts\security_scan.py --output reports\security_scan.json
if errorlevel 1 (
    echo Security validation failed. Nothing was staged or published.
    popd
    exit /b 1
)

if "%RUN_CHECKS%"=="1" (
    echo Running optional VisionCart validation...
    python -m pytest -q
    if errorlevel 1 goto :validation_failed
    python -m ruff check .
    if errorlevel 1 goto :validation_failed
    python -m compileall -q src scripts app.py run.py
    if errorlevel 1 goto :validation_failed
    pushd frontend >nul
    if errorlevel 1 goto :validation_failed
    call npm test
    if errorlevel 1 (
        popd
        goto :validation_failed
    )
    call npm run typecheck
    if errorlevel 1 (
        popd
        goto :validation_failed
    )
    call npm run lint
    if errorlevel 1 (
        popd
        goto :validation_failed
    )
    call npm run build
    if errorlevel 1 (
        popd
        goto :validation_failed
    )
    popd
)

call :check_remote_main
if errorlevel 1 (
    popd
    exit /b 1
)

git add .
if errorlevel 1 (
    echo Staging failed.
    popd
    exit /b 1
)

git diff --cached --quiet
set "DIFF_EXIT=%ERRORLEVEL%"
if "%DIFF_EXIT%"=="0" (
    echo Nothing to commit. Working tree is up to date.
    popd
    exit /b 0
)
if not "%DIFF_EXIT%"=="1" (
    echo Could not inspect staged changes.
    popd
    exit /b 1
)

echo.
echo Commit message:
echo %COMMIT_MESSAGE%
echo.
echo Git status:
git status --short
if errorlevel 1 (
    echo Could not display Git status.
    popd
    exit /b 1
)
echo.
echo Files staged:
git diff --cached --name-status
if errorlevel 1 (
    echo Could not display staged files.
    popd
    exit /b 1
)
echo.
call :confirm_publish
if errorlevel 1 goto :cancelled

git commit -m "%COMMIT_MESSAGE%"
if errorlevel 1 (
    echo Commit failed. Nothing was pushed.
    popd
    exit /b 1
)

git rev-parse --abbrev-ref --symbolic-full-name "@{upstream}" >nul 2>&1
if errorlevel 1 (
    git push -u origin main
) else (
    git push origin main
)
if errorlevel 1 (
    echo Push failed. The local commit is preserved.
    echo The remote may have changed or authentication may be required.
    echo Review the remote history and retry without rewriting it.
    popd
    exit /b 1
)

echo Publish complete.
popd
exit /b 0

:usage
echo Usage: publish.cmd ["commit message"] [--check]
popd
exit /b 1

:cancelled
echo Publish cancelled. No commit or push was created.
popd
exit /b 0

:safety_failed
echo Publishing safety checks failed. Nothing was staged or published.
popd
exit /b 1

:validation_failed
echo Project validation failed. Nothing was staged or published.
popd
exit /b 1

:confirm_publish
set "CONFIRM="
set /p "CONFIRM=Continue with commit and push? [Y/N] "
if /I "%CONFIRM%"=="Y" exit /b 0
exit /b 1

:ensure_origin
git remote get-url origin >nul 2>&1
if errorlevel 1 goto :add_origin
set "ORIGIN_URL="
for /f "delims=" %%R in ('git remote get-url origin 2^>nul') do set "ORIGIN_URL=%%R"
if /I "%ORIGIN_URL%"=="%REPO_URL%" (
    echo Existing origin is correct: %ORIGIN_URL%
    exit /b 0
)
echo Error: Existing origin points to a different repository.
echo Existing origin: %ORIGIN_URL%
echo Expected origin: %REPO_URL%
echo No remote configuration was changed.
exit /b 1

:add_origin
git remote add origin "%REPO_URL%"
if errorlevel 1 (
    echo Failed to configure the origin remote.
    exit /b 1
)
echo Configured origin: %REPO_URL%
exit /b 0

:reject_tracked_private
set "TRACKED_PRIVATE_FILE=%TEMP%\visioncart-tracked-%RANDOM%-%RANDOM%.txt"
git ls-files -- ".env" ".local" "data/raw" "data/processed" "models/*.pt" "models/*.pth" "models/*.ckpt" "models/*.onnx" "models/*.engine" "frontend/node_modules" "frontend/dist" "outputs" "transactions" "transactions.jsonl" "transactions.csv" "local_transactions" "logs" "runs" "wandb" "checkpoints" "*.mp3" >"%TRACKED_PRIVATE_FILE%"
if errorlevel 1 (
    del "%TRACKED_PRIVATE_FILE%" >nul 2>&1
    echo Could not inspect tracked private files.
    exit /b 1
)
for %%F in ("%TRACKED_PRIVATE_FILE%") do set "TRACKED_PRIVATE_SIZE=%%~zF"
if "%TRACKED_PRIVATE_SIZE%"=="0" (
    del "%TRACKED_PRIVATE_FILE%" >nul 2>&1
    exit /b 0
)
echo Error: Private or generated files are already tracked:
type "%TRACKED_PRIVATE_FILE%"
del "%TRACKED_PRIVATE_FILE%" >nul 2>&1
echo Remove these paths from the Git index without deleting local files, then retry.
exit /b 1

:check_remote_main
set "REMOTE_HEAD_FILE=%TEMP%\visioncart-publish-%RANDOM%-%RANDOM%.txt"
git ls-remote --heads origin refs/heads/main >"%REMOTE_HEAD_FILE%" 2>nul
if errorlevel 1 (
    del "%REMOTE_HEAD_FILE%" >nul 2>&1
    echo Remote history check failed. Verify network access and GitHub authentication.
    exit /b 1
)
for %%F in ("%REMOTE_HEAD_FILE%") do set "REMOTE_HEAD_SIZE=%%~zF"
del "%REMOTE_HEAD_FILE%" >nul 2>&1
if "%REMOTE_HEAD_SIZE%"=="0" exit /b 0

git fetch --quiet origin main
if errorlevel 1 (
    echo Remote history fetch failed. Nothing was staged or published.
    exit /b 1
)
git rev-parse --verify HEAD >nul 2>&1
if errorlevel 1 (
    echo Error: origin/main already has history but this local repository has no commits.
    echo Integrate the remote history manually before publishing.
    exit /b 1
)
git merge-base --is-ancestor origin/main HEAD >nul 2>&1
if not errorlevel 1 exit /b 0
git merge-base --is-ancestor HEAD origin/main >nul 2>&1
if not errorlevel 1 (
    echo Error: origin/main contains commits that are not present locally.
    echo Update the local branch manually before publishing.
    exit /b 1
)
echo Error: Local main and origin/main have diverged.
echo Resolve the history manually before publishing.
exit /b 1