## Stop on action error.
$ErrorActionPreference = "Stop"
$ConfirmPreference = "None"

## Use TLS1.2 for HTTPS (fixes an issue where later steps can't connect to github.com)
[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12

## Load PowerShell support for ZIP files.
Write-Host "Loading support for ZIP files..."
Add-Type -AssemblyName "System.IO.Compression.FileSystem"

## Create Buildkite agent working directory (C:\b).
Write-Host "Creating build folder on PD-SSD..."
Remove-Item "C:\b" -Recurse -Force -ErrorAction Ignore
New-Item "C:\b" -ItemType "directory"

## Setup environment variables.
Write-Host "Setting environment variables..."
[Environment]::SetEnvironmentVariable("TEMP", "C:\temp", "Machine")
[Environment]::SetEnvironmentVariable("TMP", "C:\temp", "Machine")
$env:TEMP = [Environment]::GetEnvironmentVariable("TEMP", "Machine")
$env:TMP = [Environment]::GetEnvironmentVariable("TMP", "Machine")
$env:PATH = [Environment]::GetEnvironmentVariable("PATH", "Machine")

# Create a junction to the MSYS2 directory at a default path when installed with the installer.
New-Item -ItemType Junction -Path "C:\msys64" -Target "C:\tools\msys64"

## Create an environment hook for the Buildkite agent.
$myhostname = [System.Net.Dns]::GetHostName()
if ($myhostname -like "*trusted*") {
  $artifact_bucket = "bazel-trusted-buildkite-artifacts"
} elseif ($myhostname -like "*testing*") {
  $artifact_bucket = "bazel-testing-buildkite-artifacts"
} else {
  $artifact_bucket = "bazel-untrusted-buildkite-artifacts"
}

Write-Host "Creating Buildkite agent environment hook..."
$buildkite_environment_hook = @"
SET BUILDKITE_ARTIFACT_UPLOAD_DESTINATION=gs://${artifact_bucket}/%BUILDKITE_JOB_ID%
SET ANDROID_HOME=${env:ANDROID_HOME}
SET ANDROID_NDK_HOME=${env:ANDROID_NDK_HOME}
SET JAVA_HOME=${env:JAVA_HOME}
SET PATH=${env:PATH}
SET TEMP=${env:TEMP}
SET TMP=${env:TEMP}
"@
[System.IO.File]::WriteAllLines("c:\buildkite\hooks\environment.bat", $buildkite_environment_hook)

Write-Host "Creating Buildkite agent pre-exit hook..."
$buildkite_preexit_hook = @"
wmic pagefile list /format:list
"@
[System.IO.File]::WriteAllLines("c:\buildkite\hooks\pre-exit.bat", $buildkite_preexit_hook)

Write-Host "Creating Buildkite agent duration hooks (pre-checkout, post-checkout, pre-command)..."
$buildkite_precheckout_hook = @'
$NOW = [long]([DateTimeOffset]::UtcNow.ToUnixTimeMilliseconds())
Write-Host "JOB_START_TIME: $NOW"
buildkite-agent env set "JOB_START_TIME=$NOW"
'@
[System.IO.File]::WriteAllLines("c:\buildkite\hooks\pre-checkout.ps1", $buildkite_precheckout_hook)

$buildkite_postcheckout_hook = @'
$CHECKOUT_END_TIME = [long]([DateTimeOffset]::UtcNow.ToUnixTimeMilliseconds())
$START_TIME_STR = buildkite-agent env get JOB_START_TIME
if ([string]::IsNullOrWhiteSpace($START_TIME_STR)) {
  Write-Warning "JOB_START_TIME is missing; skipping checkout duration calculation."
  return
}
$START_TIME = 0
if (-not [long]::TryParse($START_TIME_STR.Trim(), [ref]$START_TIME)) {
  Write-Warning "JOB_START_TIME '$START_TIME_STR' is not a valid Unix-ms timestamp; skipping checkout duration calculation."
  return
}
$DIFF = $CHECKOUT_END_TIME - $START_TIME
$CHECKOUT_DURATION_S = [math]::Round($DIFF / 1000.0, 3).ToString([cultureinfo]::InvariantCulture)
Write-Host "CHECKOUT_END_TIME: $CHECKOUT_END_TIME"
Write-Host "CHECKOUT_DURATION_S: $CHECKOUT_DURATION_S"
buildkite-agent env set "CHECKOUT_END_TIME=$CHECKOUT_END_TIME"
buildkite-agent env set "CHECKOUT_DURATION_S=$CHECKOUT_DURATION_S"
'@
[System.IO.File]::WriteAllLines("c:\buildkite\hooks\post-checkout.ps1", $buildkite_postcheckout_hook)


## Enable support for symlinks.
Write-Host "Enabling SECreateSymbolicLinkPrivilege permission..."
$ntprincipal = New-Object System.Security.Principal.NTAccount "b"
$sid = $ntprincipal.Translate([System.Security.Principal.SecurityIdentifier])
$sidstr = $sid.Value.ToString()

$tmp = [System.IO.Path]::GetTempFileName()
& secedit.exe /export /cfg "$($tmp)"
$currentConfig = Get-Content -Path "$tmp"
$currentSetting = ""
foreach ($s in $currentConfig) {
    if ($s -like "SECreateSymbolicLinkPrivilege*") {
        $x = $s.split("=",[System.StringSplitOptions]::RemoveEmptyEntries)
        $currentSetting = $x[1].Trim()
    }
}

if ([string]::IsNullOrEmpty($currentSetting)) {
    $currentSetting = "*$($sidstr)"
} else {
    $currentSetting = "*$($sidstr),$($currentSetting)"
}
$outfile = @"
[Unicode]
Unicode=yes
[Version]
signature="`$CHICAGO`$"
Revision=1
[Privilege Rights]
SECreateSymbolicLinkPrivilege = $($currentSetting)
"@
$outfile | Set-Content -Path $tmp -Encoding Unicode -Force
& secedit.exe /configure /db "secedit.sdb" /cfg "$($tmp)" /areas USER_RIGHTS
Remove-Item -Path "$tmp"

## Write encrypted buildkite agent token into a file.
$myhostname = [System.Net.Dns]::GetHostName()
if ($myhostname -like "*trusted*") {
  $project = "bazel-public"
  $secret = "bazel-trusted-buildkite-agent-token"
} elseif ($myhostname -like "*testing*") {
  $project = "bazel-untrusted"
  $secret = "bazel-testing-buildkite-agent-token"
} else {
  $project = "bazel-untrusted"
  $secret = "bazel-buildkite-agent-token"
}

# Fix ssl.SSLCertVerificationError: [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: unable to get local issuer certificate (_ssl.c:1129)
# Apply changes from https://github.com/bazelbuild/rules_foreign_cc/pull/1171
cd $env:USERPROFILE;
Invoke-WebRequest https://curl.haxx.se/ca/cacert.pem -OutFile $env:USERPROFILE\cacert.pem;
$plaintext_pw = 'PASSWORD';
$secure_pw = ConvertTo-SecureString $plaintext_pw -AsPlainText -Force;
& openssl.exe pkcs12 -export -nokeys -out certs.pfx -in cacert.pem -passout pass:$plaintext_pw;
Import-PfxCertificate -Password $secure_pw  -CertStoreLocation Cert:\LocalMachine\Root -FilePath certs.pfx;

## Get the Buildkite agent token.
Write-Host "Retrieving Buildkite Agent token from Secret Manager..."
$buildkite_agent_token = & gcloud secrets versions access latest --secret=$secret --project $project

## Configure the Buildkite agent.
Write-Host "Configuring Buildkite Agent..."
$buildkite_agent_root = "c:\buildkite"
$buildkite_agent_config = @"
token="${buildkite_agent_token}"
name="%hostname"
tags="queue=windows,kind=worker,os=windows"
build-path="c:\b"
hooks-path="c:\buildkite\hooks"
plugins-path="c:\buildkite\plugins"
git-mirrors-path="c:\buildkite\bazelbuild"
git-clone-mirror-flags="-v --bare"
disconnect-after-job=true
health-check-addr=0.0.0.0:8080
"@
[System.IO.File]::WriteAllLines("${buildkite_agent_root}\buildkite-agent.cfg", $buildkite_agent_config)

## Start the Buildkite agent service.
try {
  Write-Host "Starting Buildkite agent..."
  Start-Service -Name "buildkite-agent"

  Write-Host "Waiting for Buildkite agent to start..."
  (Get-Service -Name "buildkite-agent").WaitForStatus([ServiceProcess.ServiceControllerStatus]::Running)
  Write-Host "Waiting for Buildkite agent to exit..."
  (Get-Service -Name "buildkite-agent").WaitForStatus([ServiceProcess.ServiceControllerStatus]::Stopped)
  Write-Host "Buildkite agent has exited."
} finally {
  Write-Host "Waiting for at least one minute of uptime..."
  ## Wait until the machine has been running for at least one minute, in order to
  ## prevent exponential backoff from happening when it terminates too early.
  $up = (Get-CimInstance -ClassName win32_operatingsystem).LastBootUpTime
  $uptime = ((Get-Date) - $up).TotalSeconds
  $timetosleep = 60 - $uptime
  if ($timetosleep -gt 0) {
    Start-Sleep -Seconds $timetosleep
  }

  Write-Host "Shutting down..."
  Stop-Computer
}