"""Build a release from an explicit allowlist, excluding local secrets and caches."""
import hashlib
from pathlib import Path
import tarfile

ROOT = Path(__file__).resolve().parents[1]


def build_release(destination=None):
    destination = Path(destination or ROOT / "dist" / "lottery.tar.gz")
    destination.parent.mkdir(parents=True, exist_ok=True)
    allowed = ["src", "migrations", "scripts", "main.py", "requirements.txt", "alembic.ini",
               "Dockerfile", "docker-compose.yml", ".dockerignore"]
    with tarfile.open(destination, "w:gz") as archive:
        for name in allowed:
            entry = ROOT / name
            paths = entry.rglob("*") if entry.is_dir() else [entry]
            for path in sorted(paths):
                if not path.is_file() or path.is_symlink() or "__pycache__" in path.parts or path.suffix == ".pyc":
                    continue
                archive.add(path, arcname=path.relative_to(ROOT).as_posix(), recursive=False)
    print(f"Release SHA256: {hashlib.sha256(destination.read_bytes()).hexdigest()}")
    return destination


if __name__ == "__main__":
    build_release()