drye macOS bootstrap door (mirrors drye/shared-bin install.sh on main)

install.sh

#!/bin/bash
# Thin entry for a blank macOS machine: auth → clone private stack → bootstrap-mac.sh.
#
# Source of truth: drye/shared-bin (toolbox) on main.
# Public door (curl one-liner): see BOOTSTRAP.md — gist must mirror this file.
#
# Auth: try GitHub SSH first; fall back to interactive `gh auth login`.
#
# One-liner (public gist door — keep in sync with this file; see BOOTSTRAP.md):
#   /bin/bash -c "$(curl -fsSL https://gist.githubusercontent.com/drye/22e0c0264f11f4f027f071b3ccbbc143/raw/install.sh)"
#
# SSH already works (no gist needed):
#   git clone git@github.com:drye/shared-bin.git ~/Documents/Development/toolbox \
#     && bash ~/Documents/Development/toolbox/bootstrap-mac.sh
#
# Idempotent — safe to re-run.

set -euo pipefail

export DOTFILES_ROOT="${DOTFILES_ROOT:-${HOME}/.dotfiles}"
export TOOLBOX_ROOT="${TOOLBOX_ROOT:-${HOME}/Documents/Development/toolbox}"
export TANGO_ROOT="${TANGO_ROOT:-${HOME}/Documents/Development/tango}"

TOOLBOX_GITHUB="${TOOLBOX_GITHUB:-drye/shared-bin}"
DOTFILES_GITHUB="${DOTFILES_GITHUB:-drye/shared-dotfiles}"
TANGO_GITHUB="${TANGO_GITHUB:-drye/tango}"

log() { printf '==> %s\n' "$*"; }
warn() { printf 'warning: %s\n' "$*" >&2; }

ensure_homebrew() {
    if command -v brew &>/dev/null; then
        log "Homebrew present"
        return 0
    fi
    log "Installing Homebrew..."
    /bin/bash -c "$(curl -fsSL https://raw.githubusercontent.com/Homebrew/install/HEAD/install.sh)"
    if [[ -x /opt/homebrew/bin/brew ]]; then
        eval "$(/opt/homebrew/bin/brew shellenv)"
    elif [[ -x /usr/local/bin/brew ]]; then
        eval "$(/usr/local/bin/brew shellenv)"
    fi
    command -v brew &>/dev/null || {
        echo "error: Homebrew installed but brew not on PATH" >&2
        exit 1
    }
}

github_ssh_ok() {
    local out
    # GitHub returns exit 1 even on success ("successfully authenticated").
    out="$(ssh -o BatchMode=yes -o ConnectTimeout=5 -T git@github.com 2>&1)" || true
    [[ "$out" == *"successfully authenticated"* ]]
}

resolve_clone_mode() {
    if github_ssh_ok; then
        log "GitHub SSH OK — cloning via git@github.com"
        CLONE_MODE=ssh
        TOOLBOX_REPO="git@github.com:${TOOLBOX_GITHUB}.git"
        DOTFILES_REPO="git@github.com:${DOTFILES_GITHUB}.git"
        TANGO_REPO="git@github.com:${TANGO_GITHUB}.git"
        return 0
    fi

    log "GitHub SSH not available — interactive gh auth login next"
    if ! command -v gh &>/dev/null; then
        echo "error: gh required for HTTPS fallback but not found after brew install" >&2
        exit 1
    fi
    if ! gh auth status &>/dev/null; then
        gh auth login
    else
        log "gh already authenticated"
    fi
    gh auth status >/dev/null
    CLONE_MODE=gh
    # Prefer SSH remotes if gh configured SSH; else HTTPS.
    local git_proto
    git_proto="$(gh config get git_protocol 2>/dev/null || echo https)"
    if [[ "$git_proto" == "ssh" ]]; then
        TOOLBOX_REPO="git@github.com:${TOOLBOX_GITHUB}.git"
        DOTFILES_REPO="git@github.com:${DOTFILES_GITHUB}.git"
        TANGO_REPO="git@github.com:${TANGO_GITHUB}.git"
    else
        TOOLBOX_REPO="https://github.com/${TOOLBOX_GITHUB}.git"
        DOTFILES_REPO="https://github.com/${DOTFILES_GITHUB}.git"
        TANGO_REPO="https://github.com/${TANGO_GITHUB}.git"
    fi
    log "Clone mode: gh (git_protocol=${git_proto})"
}

clone_or_pull() {
    local repo_url="$1"
    local dest="$2"
    local gh_slug="$3"

    if [[ -d "$dest/.git" ]]; then
        log "Updating $(basename "$dest")..."
        git -C "$dest" pull --rebase origin main
        return 0
    fi
    if [[ -d "$dest" ]]; then
        warn "$dest exists but is not a git repo — skipping"
        return 0
    fi

    log "Cloning ${gh_slug} → ${dest}..."
    mkdir -p "$(dirname "$dest")"
    if [[ "${CLONE_MODE}" == "gh" ]] && command -v gh &>/dev/null; then
        gh repo clone "$gh_slug" "$dest"
    else
        git clone "$repo_url" "$dest"
    fi
}

# --- main -------------------------------------------------------------------

HOST_SHORT="$(hostname -s | tr '[:upper:]' '[:lower:]')"
log "Host: ${HOST_SHORT}"
log "install.sh — auth, clone private stack, then bootstrap-mac.sh"

ensure_homebrew
log "Ensuring git + gh..."
brew install git gh

resolve_clone_mode
export CLONE_MODE
export TOOLBOX_REPO DOTFILES_REPO TANGO_REPO

clone_or_pull "$TOOLBOX_REPO" "$TOOLBOX_ROOT" "$TOOLBOX_GITHUB"
clone_or_pull "$DOTFILES_REPO" "$DOTFILES_ROOT" "$DOTFILES_GITHUB"
clone_or_pull "$TANGO_REPO" "$TANGO_ROOT" "$TANGO_GITHUB"

ln -sfn "$TOOLBOX_ROOT" "${HOME}/bin"
log "~/bin -> ${TOOLBOX_ROOT}"

if [[ ! -f "${TOOLBOX_ROOT}/bootstrap-mac.sh" ]]; then
    echo "error: ${TOOLBOX_ROOT}/bootstrap-mac.sh missing after clone" >&2
    exit 1
fi

log "Handing off to bootstrap-mac.sh..."
exec bash "${TOOLBOX_ROOT}/bootstrap-mac.sh"