#!/bin/bash
# enterprise-worktree-manager.sh
# Purpose: Standardized worktree lifecycle management with audit logging

set -euo pipefail

WORKTREE_REGISTRY="${HOME}/.worktree-registry.json"
AUDIT_LOG="/var/log/git-worktrees/audit.log"
COMPANY_EMAIL_DOMAIN="@company.com"

# Initialize registry if not exists
if [ ! -f "$WORKTREE_REGISTRY" ]; then
    echo "[]" > "$WORKTREE_REGISTRY"
fi

# Function: Log audit event
audit_log() {
    local action="$1"
    local worktree_path="$2"
    local metadata="$3"

    local timestamp=$(date -Iseconds)
    local username=$(git config user.name)
    local email=$(git config user.email)

    # Validate corporate email
    if [[ ! "$email" =~ $COMPANY_EMAIL_DOMAIN ]]; then
        echo "❌ ERROR: Git user.email must be corporate address ($COMPANY_EMAIL_DOMAIN)"
        exit 1
    fi

    local log_entry="$timestamp | $username | $email | $action | $worktree_path | $metadata"
    echo "$log_entry" >> "$AUDIT_LOG"
}

# Function: Create worktree with governance
create_worktree() {
    local branch_name="$1"
    local ticket_id="$2"
    local purpose="$3"

    # Validate ticket ID format (e.g., JIRA-1234)
    if [[ ! "$ticket_id" =~ ^[A-Z]+-[0-9]+$ ]]; then
        echo "❌ ERROR: Invalid ticket ID format. Expected: PROJECT-1234"
        exit 1
    fi

    # Generate standardized worktree path
    local worktree_name="worktree-${ticket_id}-${branch_name}"
    local worktree_path="${HOME}/worktrees/${worktree_name}"

    # Check disk quota before creation
    local available_space=$(df -BG "${HOME}" | tail -1 | awk '{print $4}' | sed 's/G//')
    if [ "$available_space" -lt 10 ]; then
        echo "❌ ERROR: Insufficient disk space (${available_space}GB available, minimum 10GB required)"
        exit 1
    fi

    # Create worktree
    git worktree add -b "$branch_name" "$worktree_path"

    # Register in central registry
    local registry_entry=$(jq -n \
        --arg path "$worktree_path" \
        --arg branch "$branch_name" \
        --arg ticket "$ticket_id" \
        --arg purpose "$purpose" \
        --arg created "$(date -Iseconds)" \
        --arg owner "$(git config user.email)" \
        '{
            path: $path,
            branch: $branch,
            ticket_id: $ticket,
            purpose: $purpose,
            created_at: $created,
            owner: $owner,
            status: "active"
        }')

    jq ". += [$registry_entry]" "$WORKTREE_REGISTRY" > "${WORKTREE_REGISTRY}.tmp"
    mv "${WORKTREE_REGISTRY}.tmp" "$WORKTREE_REGISTRY"

    # Audit log
    audit_log "CREATE" "$worktree_path" "ticket=$ticket_id purpose=$purpose"

    # Apply standardized configuration
    cd "$worktree_path"

    # Install pre-approved git hooks
    cp "${HOME}/.git-hooks-enterprise/"* .git/hooks/

    # Configure compliance settings
    git config commit.gpgsign true
    git config user.signingkey "$(git config user.signingkey)"

    echo "✅ Worktree created: $worktree_path"
    echo "   Branch: $branch_name"
    echo "   Ticket: $ticket_id"
    echo "   Purpose: $purpose"
}

# Function: Archive completed worktree
archive_worktree() {
    local worktree_path="$1"
    local resolution="$2"  # merged|abandoned|superseded

    # Verify worktree exists in registry
    local registry_entry=$(jq --arg path "$worktree_path" '.[] | select(.path == $path)' "$WORKTREE_REGISTRY")

    if [ -z "$registry_entry" ]; then
        echo "❌ ERROR: Worktree not found in registry: $worktree_path"
        exit 1
    fi

    # Check for uncommitted changes
    cd "$worktree_path"
    if ! git diff-index --quiet HEAD --; then
        echo "⚠️  WARNING: Uncommitted changes detected"
        read -p "Archive anyway? (y/N) " -n 1 -r
        echo
        if [[ ! $REPLY =~ ^[Yy]$ ]]; then
            exit 1
        fi
    fi

    # Update registry status
    jq --arg path "$worktree_path" \
       --arg resolution "$resolution" \
       --arg archived "$(date -Iseconds)" \
       '(.[] | select(.path == $path)) |= . + {
           status: "archived",
           resolution: $resolution,
           archived_at: $archived
       }' "$WORKTREE_REGISTRY" > "${WORKTREE_REGISTRY}.tmp"
    mv "${WORKTREE_REGISTRY}.tmp" "$WORKTREE_REGISTRY"

    # Create archive
    local archive_name="$(basename $worktree_path)-$(date +%Y%m%d).tar.gz"
    tar -czf "${HOME}/worktree-archives/${archive_name}" "$worktree_path"

    # Remove worktree
    git worktree remove "$worktree_path"

    # Audit log
    audit_log "ARCHIVE" "$worktree_path" "resolution=$resolution"

    echo "✅ Worktree archived: ${HOME}/worktree-archives/${archive_name}"
}

# Function: List active worktrees
list_worktrees() {
    echo "Active Worktrees:"
    echo "================="

    jq -r '.[] | select(.status == "active") |
        "\(.ticket_id) | \(.branch) | \(.owner) | \(.created_at)"' \
        "$WORKTREE_REGISTRY" | column -t -s '|'
}

# Function: Cleanup stale worktrees (automated maintenance)
cleanup_stale() {
    local max_age_days="${1:-30}"

    echo "Identifying stale worktrees (inactive > ${max_age_days} days)..."

    jq -r --arg max_age "$max_age_days" '.[] | select(.status == "active") |
        select((now - (.created_at | fromdateiso8601)) > ($max_age | tonumber * 86400)) |
        .path' "$WORKTREE_REGISTRY" | while read -r worktree; do

        if [ -d "$worktree" ]; then
            local owner=$(jq -r --arg path "$worktree" '.[] | select(.path == $path) | .owner' "$WORKTREE_REGISTRY")

            echo "Stale worktree detected: $worktree (owner: $owner)"
            echo "  Sending notification to $owner..."

            # Send email notification (integrate with company mail system)
            # mail -s "Stale Worktree Cleanup" "$owner" << EOF
            # Your worktree at $worktree has been inactive for >$max_age_days days.
            # Please archive or provide justification for retention within 7 days.
            # EOF
        fi
    done
}

# CLI interface
case "${1:-}" in
    create)
        create_worktree "${2}" "${3}" "${4}"
        ;;
    archive)
        archive_worktree "${2}" "${3}"
        ;;
    list)
        list_worktrees
        ;;
    cleanup)
        cleanup_stale "${2:-30}"
        ;;
    *)
        cat << EOF
Enterprise Worktree Manager

Usage: $0 {create|archive|list|cleanup}

Commands:
  create <branch> <ticket-id> <purpose>   Create standardized worktree
  archive <path> <resolution>             Archive completed worktree
  list                                    List all active worktrees
  cleanup [max-age-days]                  Identify stale worktrees (default: 30 days)

Examples:
  $0 create feature-auth JIRA-1234 "Implement OAuth2 authentication"
  $0 archive ~/worktrees/worktree-JIRA-1234-feature-auth merged
  $0 list
  $0 cleanup 45
EOF
        exit 1
        ;;
esac

# Developer creates worktree for JIRA ticket
./enterprise-worktree-manager.sh create \
    feature-payment-gateway \
    JIRA-5678 \
    "Integrate Stripe payment processing"

# Output:
# ✅ Worktree created: /home/developer/worktrees/worktree-JIRA-5678-feature-payment-gateway
#    Branch: feature-payment-gateway
#    Ticket: JIRA-5678
#    Purpose: Integrate Stripe payment processing

# After feature completion
./enterprise-worktree-manager.sh archive \
    /home/developer/worktrees/worktree-JIRA-5678-feature-payment-gateway \
    merged

# List all active worktrees
./enterprise-worktree-manager.sh list

# Output:
# Active Worktrees:
# =================
# JIRA-1234  feature-auth            [email protected]  2024-10-15T14:23:00Z
# JIRA-5678  feature-payment-gateway [email protected]    2024-10-20T09:15:00Z

# Dedicated server for review worktrees
# Hostname: review-server.company.internal

# Create shared review workspace
sudo mkdir -p /opt/review-worktrees
sudo chown -R git-reviews:developers /opt/review-worktrees
sudo chmod 2775 /opt/review-worktrees  # setgid for group inheritance

# Clone main repository
cd /opt/review-worktrees
git clone --bare [email protected]:company/application.git application.git
cd application.git
git config core.sharedRepository group

#!/bin/bash
# create-review-worktree.sh (runs on review server)

PR_NUMBER="$1"
AUTHOR="$2"

REVIEW_BASE="/opt/review-worktrees"
REPO_PATH="${REVIEW_BASE}/application.git"
WORKTREE_PATH="${REVIEW_BASE}/pr-${PR_NUMBER}"

cd "$REPO_PATH"

# Fetch PR reference
git fetch origin "pull/${PR_NUMBER}/head:pr-${PR_NUMBER}"

# Create dedicated review worktree
git worktree add "$WORKTREE_PATH" "pr-${PR_NUMBER}"

# Setup review environment
cd "$WORKTREE_PATH"

# Install dependencies (using shared cache)
PNPM_HOME="${REVIEW_BASE}/.pnpm-store" pnpm install

# Run automated checks
npm run lint > "${WORKTREE_PATH}/lint-report.txt" 2>&1
npm run test > "${WORKTREE_PATH}/test-report.txt" 2>&1

# Generate review metadata
cat > "${WORKTREE_PATH}/REVIEW_INFO.md" << EOF
# Code Review Environment

**PR Number**: #${PR_NUMBER}
**Author**: ${AUTHOR}
**Created**: $(date -Iseconds)
**Access URL**: https://review-server.company.internal/pr-${PR_NUMBER}/

## Quick Access Commands

\`\`\`bash
# SSH into review server
ssh review-server.company.internal

# Navigate to review worktree
cd /opt/review-worktrees/pr-${PR_NUMBER}

# Run application locally
npm run dev

# Run tests
npm test

# View lint results
cat lint-report.txt
\`\`\`

## Automated Check Results

- **Linting**: See \`lint-report.txt\`
- **Tests**: See \`test-report.txt\`
EOF

echo "✅ Review worktree created: $WORKTREE_PATH"
echo "   Accessible at: https://review-server.company.internal/pr-${PR_NUMBER}/"

# .github/workflows/create-review-worktree.yml
name: Create Review Worktree

on:
  pull_request:
    types: [opened, synchronize]

jobs:
  create-review-env:
    runs-on: [self-hosted, review-server]
    steps:
      - name: Create review worktree
        run: |
          /opt/scripts/create-review-worktree.sh \
            ${{ github.event.pull_request.number }} \
            ${{ github.event.pull_request.user.login }}

      - name: Comment on PR with review link
        uses: actions/github-script@v6
        with:
          script: |
            github.rest.issues.createComment({
              owner: context.repo.owner,
              repo: context.repo.repo,
              issue_number: context.issue.number,
              body: `🔍 Review environment ready!\n\nAccess at: https://review-server.company.internal/pr-${context.issue.number}/\n\nSee REVIEW_INFO.md for details.`
            })

# .gitlab-ci.yml

variables:
  GIT_STRATEGY: clone
  WORKTREE_BASE: /builds/worktrees

stages:
  - setup
  - build
  - test
  - deploy

# Setup job: Create worktrees for parallel builds
setup:worktrees:
  stage: setup
  script:
    - mkdir -p $WORKTREE_BASE

    # Create worktree for each package
    - git worktree add ${WORKTREE_BASE}/frontend packages/frontend
    - git worktree add ${WORKTREE_BASE}/backend packages/backend
    - git worktree add ${WORKTREE_BASE}/mobile packages/mobile

    # Each worktree uses sparse checkout for efficiency
    - cd ${WORKTREE_BASE}/frontend
    - git sparse-checkout set packages/frontend packages/shared

    - cd ${WORKTREE_BASE}/backend
    - git sparse-checkout set packages/backend packages/shared

    - cd ${WORKTREE_BASE}/mobile
    - git sparse-checkout set packages/mobile packages/shared
  artifacts:
    paths:
      - $WORKTREE_BASE
    expire_in: 1 hour

# Parallel builds using worktrees
build:frontend:
  stage: build
  needs: [setup:worktrees]
  script:
    - cd ${WORKTREE_BASE}/frontend
    - pnpm install
    - pnpm run build
  artifacts:
    paths:
      - ${WORKTREE_BASE}/frontend/dist
    expire_in: 1 day

build:backend:
  stage: build
  needs: [setup:worktrees]
  script:
    - cd ${WORKTREE_BASE}/backend
    - pnpm install
    - pnpm run build
  artifacts:
    paths:
      - ${WORKTREE_BASE}/backend/dist
    expire_in: 1 day

build:mobile:
  stage: build
  needs: [setup:worktrees]
  script:
    - cd ${WORKTREE_BASE}/mobile
    - pnpm install
    - pnpm run build
  artifacts:
    paths:
      - ${WORKTREE_BASE}/mobile/dist
    expire_in: 1 day

# Parallel tests
test:frontend:
  stage: test
  needs: [build:frontend]
  script:
    - cd ${WORKTREE_BASE}/frontend
    - pnpm run test:ci
  coverage: '/Coverage: \d+\.\d+/'

test:backend:
  stage: test
  needs: [build:backend]
  script:
    - cd ${WORKTREE_BASE}/backend
    - pnpm run test:ci
  coverage: '/Coverage: \d+\.\d+/'

# Cleanup: Remove worktrees after pipeline
cleanup:worktrees:
  stage: .post
  when: always
  script:
    - git worktree prune
    - rm -rf $WORKTREE_BASE

# Release engineering workspace
releases/
├── v1.5-lts/              # Worktree: Long-term support (v1.5.x)
├── v2.0-current/          # Worktree: Current stable (v2.0.x)
├── v2.1-next/             # Worktree: Next release (v2.1.0-beta)
└── hotfix-staging/        # Worktree: Hotfix preparation

#!/bin/bash
# release-manager.sh

RELEASE_BASE="${HOME}/releases"

create_release_worktree() {
    local version="$1"
    local worktree_name="v${version}-release"
    local worktree_path="${RELEASE_BASE}/${worktree_name}"

    # Create release branch if doesn't exist
    git branch -l | grep -q "release/${version}" || git branch "release/${version}"

    # Create worktree
    git worktree add "$worktree_path" "release/${version}"

    cd "$worktree_path"

    # Update version in package.json
    jq ".version = \"${version}\"" package.json > package.json.tmp
    mv package.json.tmp package.json

    # Generate changelog
    git log --oneline "v$(echo $version | awk -F. '{print $1"."$2-1}')..HEAD" > CHANGELOG-${version}.md

    # Commit version bump
    git add package.json CHANGELOG-${version}.md
    git commit -m "chore: Prepare release v${version}"

    # Create annotated tag
    git tag -a "v${version}" -m "Release version ${version}"

    echo "✅ Release worktree prepared: $worktree_path"
    echo "   Version: ${version}"
    echo "   Tag: v${version}"
    echo ""
    echo "Next steps:"
    echo "  1. Review CHANGELOG-${version}.md"
    echo "  2. Run final tests: npm run test:all"
    echo "  3. Build production assets: npm run build:prod"
    echo "  4. Push release: git push origin release/${version} --tags"
}

# Create hotfix for specific version
create_hotfix_worktree() {
    local base_version="$1"
    local hotfix_name="$2"

    local worktree_name="hotfix-${base_version}-${hotfix_name}"
    local worktree_path="${RELEASE_BASE}/${worktree_name}"

    # Create hotfix branch from release tag
    git worktree add -b "hotfix/${base_version}/${hotfix_name}" \
        "$worktree_path" "v${base_version}"

    cd "$worktree_path"

    # Increment patch version
    local new_version=$(echo "$base_version" | awk -F. '{print $1"."$2"."$3+1}')
    jq ".version = \"${new_version}\"" package.json > package.json.tmp
    mv package.json.tmp package.json

    echo "✅ Hotfix worktree created: $worktree_path"
    echo "   Base version: ${base_version}"
    echo "   New version: ${new_version}"
    echo "   Hotfix: ${hotfix_name}"
}

case "${1:-}" in
    release)
        create_release_worktree "${2}"
        ;;
    hotfix)
        create_hotfix_worktree "${2}" "${3}"
        ;;
    *)
        echo "Usage: $0 {release|hotfix}"
        echo ""
        echo "Examples:"
        echo "  $0 release 2.1.0"
        echo "  $0 hotfix 2.0.3 security-patch"
        exit 1
        ;;
esac

# Prepare new minor release
./release-manager.sh release 2.1.0

# Create hotfix for v2.0.3
./release-manager.sh hotfix 2.0.3 critical-security-fix

# Concurrent release management
ls -la ~/releases/
# drwxr-xr-x  v1.5-lts/              # LTS maintenance
# drwxr-xr-x  v2.0-current/          # Current stable
# drwxr-xr-x  v2.1-release/          # Next release prep
# drwxr-xr-x  hotfix-2.0.3-security/ # Urgent hotfix

#!/bin/bash
# secure-worktree-manager.sh

AUDIT_DB="/var/lib/git-audit/worktrees.db"
SYSLOG_TAG="git-worktree-audit"

# Initialize SQLite audit database
init_audit_db() {
    sqlite3 "$AUDIT_DB" << 'EOF'
CREATE TABLE IF NOT EXISTS worktree_events (
    id INTEGER PRIMARY KEY AUTOINCREMENT,
    timestamp TEXT NOT NULL,
    user TEXT NOT NULL,
    user_email TEXT NOT NULL,
    action TEXT NOT NULL,
    worktree_path TEXT NOT NULL,
    branch_name TEXT,
    ticket_id TEXT,
    justification TEXT,
    ip_address TEXT,
    hostname TEXT
);

CREATE INDEX idx_user ON worktree_events(user);
CREATE INDEX idx_timestamp ON worktree_events(timestamp);
CREATE INDEX idx_action ON worktree_events(action);
EOF
}

# Log event to audit database and syslog
audit_event() {
    local action="$1"
    local worktree_path="$2"
    local branch_name="$3"
    local ticket_id="$4"
    local justification="$5"

    local timestamp=$(date -Iseconds)
    local user=$(git config user.name)
    local user_email=$(git config user.email)
    local ip_address=$(hostname -I | awk '{print $1}')
    local hostname=$(hostname)

    # Insert into audit database
    sqlite3 "$AUDIT_DB" << EOF
INSERT INTO worktree_events (
    timestamp, user, user_email, action, worktree_path,
    branch_name, ticket_id, justification, ip_address, hostname
) VALUES (
    '$timestamp', '$user', '$user_email', '$action', '$worktree_path',
    '$branch_name', '$ticket_id', '$justification', '$ip_address', '$hostname'
);
EOF

    # Log to syslog for tamper-evident audit trail
    logger -t "$SYSLOG_TAG" -p local0.info \
        "ACTION=$action USER=$user EMAIL=$user_email WORKTREE=$worktree_path TICKET=$ticket_id"
}

# Create secure worktree with mandatory compliance checks
create_secure_worktree() {
    local branch_name="$1"
    local ticket_id="$2"
    local justification="$3"

    # Verify GPG key is configured
    if ! git config user.signingkey > /dev/null; then
        echo "❌ ERROR: GPG signing key not configured"
        echo "   Configure with: git config --global user.signingkey <KEY_ID>"
        exit 1
    fi

    # Verify user has authorization (check LDAP/AD group membership)
    if ! groups | grep -q "git-developers"; then
        echo "❌ ERROR: User not authorized for worktree creation"
        exit 1
    fi

    local worktree_path="${HOME}/worktrees/${ticket_id}-${branch_name}"

    # Create worktree
    git worktree add -b "$branch_name" "$worktree_path"

    cd "$worktree_path"

    # Enforce GPG signing
    git config commit.gpgsign true
    git config user.signingkey "$(git config --global user.signingkey)"

    # Install mandatory pre-commit hooks (security checks)
    cp /opt/git-compliance/hooks/* .git/hooks/

    # Audit log
    audit_event "CREATE" "$worktree_path" "$branch_name" "$ticket_id" "$justification"

    echo "✅ Secure worktree created: $worktree_path"
    echo "   All commits will be GPG-signed"
    echo "   Audit logged to: $AUDIT_DB"
}

# Generate compliance report
generate_compliance_report() {
    local start_date="$1"
    local end_date="$2"

    echo "Git Worktree Compliance Report"
    echo "==============================="
    echo "Period: $start_date to $end_date"
    echo ""

    sqlite3 -header -column "$AUDIT_DB" << EOF
SELECT
    strftime('%Y-%m-%d', timestamp) as Date,
    COUNT(*) as Total_Events,
    SUM(CASE WHEN action='CREATE' THEN 1 ELSE 0 END) as Created,
    SUM(CASE WHEN action='DELETE' THEN 1 ELSE 0 END) as Deleted
FROM worktree_events
WHERE date(timestamp) BETWEEN '$start_date' AND '$end_date'
GROUP BY date(timestamp)
ORDER BY date(timestamp);

SELECT
    user,
    COUNT(*) as Actions,
    GROUP_CONCAT(DISTINCT action) as Action_Types
FROM worktree_events
WHERE date(timestamp) BETWEEN '$start_date' AND '$end_date'
GROUP BY user
ORDER BY Actions DESC;
EOF
}

init_audit_db

case "${1:-}" in
    create)
        create_secure_worktree "${2}" "${3}" "${4}"
        ;;
    report)
        generate_compliance_report "${2}" "${3}"
        ;;
    *)
        echo "Usage: $0 {create|report}"
        exit 1
        ;;
esac

./secure-worktree-manager.sh report 2024-10-01 2024-10-31

# Output:
# Git Worktree Compliance Report
# ===============================
# Period: 2024-10-01 to 2024-10-31
#
# Date        Total_Events  Created  Deleted
# ----------  ------------  -------  -------
# 2024-10-15  12            8        4
# 2024-10-16  18            10       8
# 2024-10-17  24            15       9
#
# user          Actions  Action_Types
# ------------  -------  ------------------
# alice         45       CREATE,DELETE
# bob           38       CREATE,DELETE
# charlie       29       CREATE