#!/usr/bin/env bash
# One-shot deploy: GitHub (private) + HuggingFace Space (private) + CI secret.
#
# Usage:
#   export HF_TOKEN=hf_xxxxxxxx        # your (rotated!) HuggingFace token
#   bash deploy.sh
#
# Prereqs already done: private repo HERPESME/MuleGuard exists with 'origin'
# set; private Space EeshanSingh/MuleGuard exists. The token is read from the
# environment and never written to any file.
set -euo pipefail

: "${HF_TOKEN:?Set HF_TOKEN first:  export HF_TOKEN=hf_xxxxxxxx}"

HF_USER="EeshanSingh"
HF_SPACE="EeshanSingh/MuleGuard"

echo "==> 1/3  Push code to GitHub (HERPESME/MuleGuard)"
git push -u origin main

echo "==> 2/3  Store HF_TOKEN as an encrypted GitHub Actions secret (for auto-sync)"
printf '%s' "$HF_TOKEN" | gh secret set HF_TOKEN

echo "==> 3/3  Push to the HuggingFace Space (private)"
git push --force "https://${HF_USER}:${HF_TOKEN}@huggingface.co/spaces/${HF_SPACE}" main

echo ""
echo "Done."
echo "  GitHub : https://github.com/HERPESME/MuleGuard  (private)"
echo "  Space  : https://huggingface.co/spaces/${HF_SPACE}  (private; builds the Docker image)"
echo "From now on every 'git push' to main auto-syncs to the Space via GitHub Actions."