#!/usr/bin/env bash
# fleet/check.sh — the ONLY sanctioned way to run this playbook against real
# hosts in check mode. Fail-closed: refuses to run any argv that would drop
# --check. Never mutates a host. For a real apply, see fleet/apply.sh.
#
# usage: fleet/check.sh [--limit <group-or-host>] [--tags <role-tags>] [extra ansible-playbook args]
set -euo pipefail

FLEET_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"

for arg in "$@"; do
  case "$arg" in
    --check) echo "fleet/check.sh: ERROR: --check is implicit; do not pass it explicitly" >&2; exit 2 ;;
    -C) echo "fleet/check.sh: ERROR: -C is implicit; do not pass it explicitly" >&2; exit 2 ;;
  esac
done

export LANG="${LANG:-C.UTF-8}"
export LC_ALL="${LC_ALL:-C.UTF-8}"
ANSIBLE_PLAYBOOK="${ANSIBLE_PLAYBOOK_BIN:-ansible-playbook}"
command -v "$ANSIBLE_PLAYBOOK" >/dev/null 2>&1 || {
  echo "fleet/check.sh: ERROR: ansible-playbook not found; install per fleet/README.md" >&2
  exit 1
}

bash "$FLEET_DIR/gen-inventory.sh"

exec "$ANSIBLE_PLAYBOOK" \
  -i "$FLEET_DIR/inventory.yml" \
  "$FLEET_DIR/site.yml" \
  --check --diff \
  "$@"