setup.sh

#!/usr/bin/env bash
set -Eeuo pipefail

ROOT="$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")" && pwd)"
DOTFILES=(.zshrc .aliases .gitconfig)
APPLY_MACOS_DEFAULTS=false

info() { printf '==> %s\n' "$*"; }
warn() { printf 'warning: %s\n' "$*" >&2; }
die() { printf 'error: %s\n' "$*" >&2; exit 1; }
trap 'printf "error: setup failed at line %s\n" "$LINENO" >&2' ERR

usage() {
  cat <<'EOF'
Usage: ./setup.sh [--macos | --check]

  --macos  Install everything, then apply the included macOS defaults.
  --check  Validate this repository without changing the machine.
EOF
}

check_repo() {
  bash -n "$ROOT/setup.sh"
  zsh -n "$ROOT/.zshrc"
  git -C "$ROOT" diff --check

  if command -v brew >/dev/null 2>&1; then
    HOMEBREW_NO_AUTO_UPDATE=1 brew bundle list --file="$ROOT/Brewfile" >/dev/null
  fi

  if git -C "$ROOT" grep -IqE '^[[:space:]]*(export[[:space:]]+)?[A-Za-z_][A-Za-z0-9_]*(KEY|TOKEN|PASSWORD|SECRET)[A-Za-z0-9_]*='; then
    die "tracked shell files contain a likely secret assignment"
  fi

  if git -C "$ROOT" grep -IqE 'BEGIN (RSA |OPENSSH )?PRIVATE KEY'; then
    die "repository contains private key material"
  fi

  info "Checks passed"
}

check_macos() {
  [[ "$(uname -s)" == Darwin ]] || die "This setup supports macOS only"
}

install_xcode_tools() {
  if xcode-select -p >/dev/null 2>&1; then
    return
  fi

  xcode-select --install >/dev/null 2>&1 || true
  die "Finish the Xcode Command Line Tools installer, then run this script again"
}

install_homebrew() {
  if ! command -v brew >/dev/null 2>&1; then
    info "Installing Homebrew"
    /bin/bash -c "$(curl -fsSL https://raw.githubusercontent.com/Homebrew/install/HEAD/install.sh)"
  fi

  if [[ -x /opt/homebrew/bin/brew ]]; then
    eval "$(/opt/homebrew/bin/brew shellenv)"
  elif [[ -x /usr/local/bin/brew ]]; then
    eval "$(/usr/local/bin/brew shellenv)"
  else
    die "Homebrew was not found after installation"
  fi
}

install_packages() {
  info "Installing the Brewfile"
  brew bundle install --file="$ROOT/Brewfile"

  # compinit rejects group-writable ancestors of completion directories.
  chmod go-w "$(brew --prefix)/share"

  info "Installing the current Node.js LTS and Bun with mise"
  mise use --global node@lts bun@latest
}

link_dotfile() {
  local name="$1" source="$ROOT/$1" target="$HOME/$1" backup

  if [[ -L "$target" && "$(readlink "$target")" == "$source" ]]; then
    return
  fi

  if [[ -e "$target" || -L "$target" ]]; then
    backup="$target.backup.$(date +%Y%m%d-%H%M%S)"
    mv "$target" "$backup"
    warn "Moved existing $target to $backup"
  fi

  ln -s "$source" "$target"
}

setup_dotfiles() {
  info "Linking dotfiles"
  local name
  for name in "${DOTFILES[@]}"; do
    link_dotfile "$name"
  done

  for name in .zshrc.local .gitconfig.local; do
    [[ -e "$HOME/$name" ]] || : >"$HOME/$name"
    chmod 600 "$HOME/$name"
  done
}

setup_github() {
  if gh auth status >/dev/null 2>&1; then
    GIT_CONFIG_GLOBAL="$HOME/.gitconfig.local" gh auth setup-git
    return
  fi

  if [[ -t 0 ]]; then
    info "Authenticating GitHub CLI"
    GIT_CONFIG_GLOBAL="$HOME/.gitconfig.local" gh auth login --git-protocol ssh --web
    GIT_CONFIG_GLOBAL="$HOME/.gitconfig.local" gh auth setup-git
  else
    warn "GitHub CLI is not authenticated; run: gh auth login"
  fi
}

setup_git() {
  local config="$HOME/.gitconfig.local" name email key="$HOME/.ssh/id_ed25519.pub"

  name="$(git config --get user.name || true)"
  if [[ -z "$name" && -t 0 ]]; then
    read -r -p "Git name: " name
    [[ -z "$name" ]] || git config --file "$config" user.name "$name"
  fi

  email="$(git config --get user.email || true)"
  if [[ -z "$email" && -t 0 ]]; then
    read -r -p "Git email: " email
    [[ -z "$email" ]] || git config --file "$config" user.email "$email"
  fi

  if [[ -f "$key" && -z "$(git config --get user.signingkey || true)" ]]; then
    git config --file "$config" gpg.format ssh
    git config --file "$config" user.signingkey "$key"
    git config --file "$config" commit.gpgsign true
    warn "SSH commit signing is enabled locally; add $key to GitHub as a signing key"
  fi
}

configure_macos() {
  info "Applying macOS defaults"
  defaults write com.apple.finder AppleShowAllFiles -bool true
  defaults write NSGlobalDomain AppleShowAllExtensions -bool true
  defaults write com.apple.finder ShowPathbar -bool true
  defaults write com.apple.dock autohide -bool true
  defaults write NSGlobalDomain KeyRepeat -int 2
  defaults write NSGlobalDomain InitialKeyRepeat -int 15
  defaults write com.apple.AppleMultitouchTrackpad Clicking -bool true
  killall Finder 2>/dev/null || true
  killall Dock 2>/dev/null || true
}

main() {
  case "${1:-}" in
    "") ;;
    --macos) APPLY_MACOS_DEFAULTS=true ;;
    --check) check_repo; exit ;;
    -h|--help) usage; exit ;;
    *) usage; exit 2 ;;
  esac

  check_macos
  install_xcode_tools
  install_homebrew
  install_packages
  setup_dotfiles
  setup_github
  setup_git
  $APPLY_MACOS_DEFAULTS && configure_macos

  info "Done. Open a new terminal. Put private shell settings in ~/.zshrc.local."
}

main "$@"