mkdir -p ~/.ssh

# A key pasted from Windows carries CRLF line endings, and some secret stores flatten newlines
# into spaces or literal \n: OpenSSH then fails with "error in libcrypto". Rebuild the PEM layout
key=$(printf '%s' "$SSH_KEY" | tr -d '\r')
key=${key//\\n/$'\n'}
header=$(grep -oE -- '-----BEGIN [A-Z ]+-----' <<< "$key" || true)
if [[ -n $header && $key != *$'\n'* ]]; then
  footer=$(grep -oE -- '-----END [A-Z ]+-----' <<< "$key")
  body=${key#"$header"}
  body=${body%"$footer"}
  key=$(printf '%s\n' "$header"; tr ' ' '\n' <<< "$body" | sed '/^$/d'; printf '%s\n' "$footer")
fi
printf '%s\n' "$key" > ~/.ssh/mirror_key
chmod 600 ~/.ssh/mirror_key

# Fail early with a readable diagnosis (header and line count only, never the key itself)
if ! ssh-keygen -y -f ~/.ssh/mirror_key > /dev/null; then
  first=$(head -n 1 ~/.ssh/mirror_key)
  [[ $first == -----* || $first == ssh-* ]] || first="(neither a PEM header nor a public key)"
  echo "GH_MIRROR_SSH_KEY is not a usable private key: $(wc -l < ~/.ssh/mirror_key) lines, first line: ${first:0:40}"
  echo "Expected the private key, without passphrase, from -----BEGIN OPENSSH PRIVATE KEY----- to -----END OPENSSH PRIVATE KEY-----"
  exit 1
fi
echo "github.com ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOMqqnkVzrm0SdG6UOoqKLsabgH5C9okWi0dh2l9GKJl" > ~/.ssh/known_hosts
export GIT_SSH_COMMAND="ssh -i ~/.ssh/mirror_key -o IdentitiesOnly=yes"

# origin/HEAD would otherwise become a branch named HEAD on GitHub
git remote set-head origin --delete 2>/dev/null || true

git push --force --prune git@github.com:hlassiege/panoplie.git \
  'refs/remotes/origin/*:refs/heads/*' \
  'refs/tags/*:refs/tags/*'