# Push sanitized main to GitHub without leaving secrets on local main (kalinamall workflow).
# Usage: .\scripts\Push-GitHubMirror.ps1
param(
    [string]$Remote = 'github',
    [string]$Branch = 'main'
)

$ErrorActionPreference = 'Stop'
$Root = Split-Path -Parent $PSScriptRoot
Set-Location $Root

git remote get-url $Remote 2>$null | Out-Null
if ($LASTEXITCODE -ne 0) {
    throw "remote not configured: $Remote"
}

if ((git status --porcelain)) {
    throw 'working tree not clean; commit or stash first'
}

$before = (git rev-parse HEAD).Trim()
Write-Output "local HEAD before GitHub push: $before"

& "$PSScriptRoot\Sanitize-ForGitHub.ps1"
& "$PSScriptRoot\Rewrite-GitHostUrls.ps1" -Target github
& "$PSScriptRoot\Test-NoSecretsForGitHub.ps1"

$status = git status --porcelain
if (-not $status) {
    Write-Output 'no changes after sanitize; pushing current HEAD to GitHub'
    git push $Remote $Branch
    exit 0
}

git add -A
git commit -m "chore(github): sanitize secrets and sync public mirror URLs"
git push --force-with-lease $Remote $Branch
git reset --hard $before
Write-Output "pushed $Remote/$Branch (force-with-lease mirror); local main restored to $before (production/kalinamall)"