#!/usr/bin/env bash
# Label the sensitive files changed since a base revision. Usage: scripts/verify-release-gates origin/main
set -euo pipefail
cd "$(dirname "$0")/.."
base="${1:-origin/main}"

git diff --name-only "$base"...HEAD | while read -r file; do
  case "$file" in
    */AndroidManifest.xml|AndroidManifest.xml) echo "MANIFEST        $file" ;;
    *.gradle.kts|*.gradle|gradle.properties)    echo "BUILD SCRIPT     $file" ;;
    gradle/libs.versions.toml)                  echo "DEPENDENCY PINS  $file" ;;
    gradle/wrapper/*|gradlew|gradlew.bat)       echo "WRAPPER         $file" ;;
    *network_security_config*|*assetlinks.json) echo "NETWORK CONFIG  $file" ;;
    .github/workflows/*)                        echo "WORKFLOW        $file" ;;
    *proguard*|*-rules.pro)                     echo "R8 RULES        $file" ;;
    *.jks|*.keystore|keystore.properties)       echo "SIGNING         $file" ;;
  esac
done
