install.sh

#!/bin/sh
# install.sh — POSIX sh installer for the runcode CLI.
# Downloads the correct archive from GitHub Releases, verifies its sha256
# against checksums.txt, then installs the binary.
# Never eval or pipe downloaded content into a shell.
set -eu

REPO="runcode-io/runcode-cli"

# ── OS detection ─────────────────────────────────────────────────────────────
case "$(uname -s)" in
  Linux)  os=linux  ;;
  Darwin) os=darwin ;;
  *)
    echo "install.sh supports Linux and macOS; on Windows use the .zip from the releases page or Homebrew" >&2
    exit 1
    ;;
esac

# ── Arch detection ────────────────────────────────────────────────────────────
case "$(uname -m)" in
  x86_64|amd64)    arch=amd64 ;;
  aarch64|arm64)   arch=arm64 ;;
  *)
    echo "Unsupported architecture: $(uname -m). Only amd64 and arm64 are supported." >&2
    exit 1
    ;;
esac

# ── Download URL ──────────────────────────────────────────────────────────────
ASSET="runcode_${os}_${arch}.tar.gz"
if [ -n "${VERSION:-}" ]; then
  BASE="https://github.com/${REPO}/releases/download/${VERSION}"
else
  BASE="https://github.com/${REPO}/releases/latest/download"
fi

# ── curl check ───────────────────────────────────────────────────────────────
if ! command -v curl >/dev/null 2>&1; then
  echo "curl is required but not found. Install curl and retry." >&2
  exit 1
fi

# ── Work in a temp dir; clean up on exit ─────────────────────────────────────
WORK_DIR="$(mktemp -d)"
cleanup() { rm -rf "${WORK_DIR}"; }
trap cleanup EXIT

echo "Downloading ${ASSET} ..."
curl -fsSL "${BASE}/${ASSET}" -o "${WORK_DIR}/${ASSET}"
curl -fsSL "${BASE}/checksums.txt" -o "${WORK_DIR}/checksums.txt"

# ── sha256 verification ───────────────────────────────────────────────────────
expected="$(grep " ${ASSET}\$" "${WORK_DIR}/checksums.txt" | awk '{print $1}')"
if [ -z "${expected}" ]; then
  echo "Could not find checksum for ${ASSET} in checksums.txt" >&2
  exit 1
fi

if command -v sha256sum >/dev/null 2>&1; then
  actual="$(sha256sum "${WORK_DIR}/${ASSET}" | awk '{print $1}')"
elif command -v shasum >/dev/null 2>&1; then
  actual="$(shasum -a 256 "${WORK_DIR}/${ASSET}" | awk '{print $1}')"
else
  echo "Neither sha256sum nor shasum found; cannot verify download." >&2
  exit 1
fi

if [ "${actual}" != "${expected}" ]; then
  echo "Checksum mismatch for ${ASSET}!" >&2
  echo "  expected: ${expected}" >&2
  echo "  actual:   ${actual}" >&2
  exit 1
fi

echo "Checksum verified."

# ── Extract ───────────────────────────────────────────────────────────────────
tar -xzf "${WORK_DIR}/${ASSET}" -C "${WORK_DIR}" runcode
chmod +x "${WORK_DIR}/runcode"

# ── Install ───────────────────────────────────────────────────────────────────
INSTALL_DIR="/usr/local/bin"
if [ -w "${INSTALL_DIR}" ]; then
  cp "${WORK_DIR}/runcode" "${INSTALL_DIR}/runcode"
  INSTALLED="${INSTALL_DIR}/runcode"
elif [ "$(id -u)" != "0" ] && command -v sudo >/dev/null 2>&1; then
  sudo install -m 0755 "${WORK_DIR}/runcode" "${INSTALL_DIR}/runcode"
  INSTALLED="${INSTALL_DIR}/runcode"
else
  INSTALL_DIR="${HOME}/.local/bin"
  mkdir -p "${INSTALL_DIR}"
  cp "${WORK_DIR}/runcode" "${INSTALL_DIR}/runcode"
  INSTALLED="${INSTALL_DIR}/runcode"
  case ":${PATH}:" in
    *":${INSTALL_DIR}:"*) ;;
    *)
      echo ""
      echo "NOTE: ${INSTALL_DIR} is not on your PATH."
      echo "Add the following to your shell profile:"
      echo "  export PATH=\"\${HOME}/.local/bin:\${PATH}\""
      ;;
  esac
fi

echo ""
echo "runcode installed to ${INSTALLED}"
echo "Run: runcode --version"