#!/usr/bin/env bash
# Print the ARC listener watchdog's latest verdict.
#
# The watchdog heals silently, which is the point — but "silent" must not mean
# "unknowable". This is the one command to run when CI looks wedged, and it
# answers the two questions that cost nine hours on 2026-08-21: is there a Ready
# listener, and were any runs queued during an outage (those are never assigned
# retroactively and need `gh run cancel <id> && gh run rerun <id>`).
#
# Exits 1 when the invariant is currently broken, so it can be used as a gate.
set -euo pipefail

kubectl_bin=${KUBECTL:-kubectl}
ns=${ARC_SYSTEMS_NAMESPACE:-arc-systems}
state_cm=arc-listener-watchdog-state

command -v "$kubectl_bin" >/dev/null || {
  printf 'arc-watchdog-status: kubectl is required\n' >&2
  exit 2
}

field() {
  "$kubectl_bin" get configmap "$state_cm" -n "$ns" \
    -o "go-template={{index .data \"$1\"}}" 2>/dev/null || printf ''
}

if ! "$kubectl_bin" get configmap "$state_cm" -n "$ns" >/dev/null 2>&1; then
  # No state at all is itself a finding: either the CronJob was never installed
  # or it has never completed a single tick.
  printf 'arc-watchdog: NO STATE — the watchdog has never run.\n'
  printf '  install: bash modules/ci/install-arc.sh\n'
  printf '  or apply just this piece: kubectl apply -f modules/ci/k8s/listener-watchdog.yaml\n'
  exit 1
fi

printf 'arc-watchdog verdict : %s\n' "$(field verdict)"
printf 'last run             : %s\n' "$(field lastRun)"
printf 'actions taken        : %s\n' "$(field actions)"

recovered=$(field listenerRecoveredAt)
if [[ -n "$recovered" ]]; then
  printf 'last recovery        : %s\n' "$recovered"
  printf '  Runs queued before that moment were never assigned to a runner.\n'
  printf '  Re-dispatch each one: gh run cancel <id> && gh run rerun <id>\n'
fi

# Failed Jobs are the alarm the CronJob raises when its own remedy did not work.
failed=$("$kubectl_bin" get jobs -n "$ns" -l batch.kubernetes.io/job-name \
  -o go-template='{{range .items}}{{if .status.failed}}{{.metadata.name}}{{"\n"}}{{end}}{{end}}' 2>/dev/null \
  | grep -c 'arc-listener-watchdog' || true)
[[ -n "$failed" && "$failed" != 0 ]] && printf 'failed watchdog jobs : %s (remedy did not restore the listener)\n' "$failed"

[[ "$(field verdict)" == healthy:* ]]