@echo off
setlocal

rem Push a branch to the internal git server, from Windows.
rem
rem     tools\git-push.cmd              push the current branch
rem     tools\git-push.cmd wj           push a named branch
rem
rem CREDENTIALS ARE NOT THIS SCRIPT'S JOB HERE.
rem
rem The bash version of this script reads a token out of secrets.md and feeds it
rem to git through GIT_ASKPASS, because that box has no credential store. Windows
rem does: Git for Windows installs Git Credential Manager and enables it by
rem default, so `git push` prompts once and Windows Credential Manager keeps it
rem after that.
rem
rem So do NOT port the token handling here. Copying a token into a script, an
rem environment variable or a remote URL on a machine that already has a
rem credential store is strictly worse than the thing it replaces.
rem
rem If a push here asks for a password every time, the fix is to check the
rem credential helper, not to embed a token:
rem     git config --global credential.helper manager

cd /d "%~dp0.."

set "BRANCH=%~1"
if "%BRANCH%"=="" (
  for /f "delims=" %%b in ('git rev-parse --abbrev-ref HEAD') do set "BRANCH=%%b"
)

if "%BRANCH%"=="HEAD" (
  echo ERROR: detached HEAD. Check out a branch, or name one.
  exit /b 1
)

git show-ref --verify --quiet "refs/heads/%BRANCH%"
if errorlevel 1 (
  echo ERROR: no such local branch: %BRANCH%
  exit /b 1
)

rem A push of a dirty tree pushes the LAST commit, not what is in front of you.
rem That reads as a successful push and is found out much later.
for /f "delims=" %%s in ('git status --porcelain') do (
  echo Working tree is not clean:
  git status --short
  echo.
  echo Commit or stash first - a push of a dirty tree pushes the LAST commit,
  echo not what you are looking at.
  exit /b 1
)

echo Pushing %BRANCH% ...
git push origin "%BRANCH%"
if errorlevel 1 (
  echo.
  echo Push failed.
  exit /b 1
)

echo Pushed %BRANCH%.
endlocal