.deploy_setup_ci_tools: &deploy_setup_ci_tools |
  set -euo pipefail 2>/dev/null || set -eu
  curl -sSL "${CIT_LOADER_URL}" | sh
  source citools/import_functions
  cit_add_ssh_key "${GH_PUSH_KEY}"

.deploy_set_target_branch: &deploy_set_target_branch |
  git remote remove github 2>/dev/null || true
  git remote add github "${GH_PUSH_REPO}"
  BR="${CI_COMMIT_BRANCH:-${CI_COMMIT_REF_NAME}}"; export BR
  if [ -z "${BR}" ]; then echo "[diag] No branch context; aborting"; exit 0; fi

.deploy_print_diagnostics: &deploy_print_diagnostics |
  echo "Deploying commit ${CI_COMMIT_SHA} to ${BR}"
  echo "[diag] pipeline SHA: ${CI_COMMIT_SHA}"
  echo "[diag] branch name: ${BR}"
  echo "[diag] github ls-remote:" && git ls-remote github "refs/heads/${BR}" || true

.deploy_check_github_fast_forward: &deploy_check_github_fast_forward |
  TARGET="${GITHUB_TARGET:-${CI_MERGE_REQUEST_TARGET_BRANCH_NAME:-${BR:-master}}}"
  # Ensure we have enough history for ancestry checks (avoid shallow false positives)
  if git rev-parse --is-shallow-repository 2>/dev/null | grep -q true; then
    echo "[diag] Repository is shallow; deepening origin/${TARGET} for ancestry checks"
    git fetch --no-tags --prune --unshallow origin "${TARGET}" \
      || git fetch --no-tags --prune --deepen=50 origin "${TARGET}"
    if git ls-remote --exit-code --heads github "refs/heads/${TARGET}" >/dev/null 2>&1; then
      echo "[diag] Repository is shallow; deepening github/${TARGET} for ancestry checks"
      git fetch --no-tags --prune --unshallow github "${TARGET}" \
        || git fetch --no-tags --prune --deepen=50 github "${TARGET}" || true
    else
      echo "[diag] github/${TARGET} missing; skip deepening on github"
    fi
  fi
  if git ls-remote --exit-code --heads github "refs/heads/${TARGET}" >/dev/null 2>&1; then
    git fetch --no-tags --prune github "${TARGET}" || true
    GH_TIP=$(git rev-parse "github/${TARGET}" 2>/dev/null || true); echo "[diag] github/${TARGET} tip: ${GH_TIP:-none}"
    if [ -n "${GH_TIP:-}" ]; then git rev-list --left-right --count "github/${TARGET}...${CI_COMMIT_SHA}" || true; fi
    if [ -n "${GH_TIP:-}" ] && ! git merge-base --is-ancestor "github/${TARGET}" "${CI_COMMIT_SHA}"; then echo "[diag] GitHub is ahead/diverged on ${TARGET}; aborting"; exit 1; fi
  else
    echo "[diag] github/${TARGET} missing; aborting (non-mirrored target branch?)"
    exit 1
  fi


.deploy_push_commit: &deploy_push_commit |
  git push github "${CI_COMMIT_SHA}:refs/heads/${BR}"

.github_deploy_base:
  image: ${CI_DOCKER_REGISTRY}/esp32-ci-env
  tags:
    - build
  variables:
    GIT_STRATEGY: clone
    GIT_DEPTH: 0
  before_script:
    - *deploy_setup_ci_tools
    - *deploy_set_target_branch
    - *deploy_print_diagnostics

push_to_github:
  extends: .github_deploy_base
  stage: deploy
  only:
    refs:
      - master
      - idf
  when: on_success
  script:
    - *deploy_check_github_fast_forward
    - *deploy_push_commit

pre_release_validate_push:
  extends: .github_deploy_base
  stage: test_deploy
  tags:
    - build
    - internet
  needs: []
  except:
    - master
  when: on_success
  allow_failure: false
  script:
    - *deploy_check_github_fast_forward
    - echo "[diag] Performing dry-run push to validate fast-forward"
    - git push --dry-run github "${CI_COMMIT_SHA}:refs/heads/${BR}"
    - echo "[diag] Dry-run push succeeded; real deploy would succeed"