install-github-cli.sh

#!/bin/zsh
# shellcheck shell=bash

################################################################################
# Script:       install-github-cli.sh
# Description:  Installs GitHub CLI (gh) on macOS via direct download of the
#               official GitHub .pkg. Designed for deployment via Microsoft Intune.
#
# Note:         Installomator DOES NOT have a label for GitHub CLI.
#               This script downloads the official .pkg directly from the releases
#               of the cli/cli repository on GitHub.
#
# Author:       IT Team
# Version:      1.0.0
# Date:         2026-08-12
#
# Requirements:
#   - macOS 12.0 or higher
#   - Run as root (Intune: "Run script as signed-in user" = No)
#   - Internet access
#
# Bundle ID:    com.github.gh
# Binary:       /usr/local/bin/gh
#
# Intune Configuration (Shell Script):
#   - Run script as signed-in user: No
#   - Hide script notifications: Yes
#   - Script frequency: Not configured (single execution)
#   - Max retries: 3
################################################################################

set -euo pipefail

# =============================================================================
# CONFIGURATIONS
# =============================================================================

readonly APP_NAME="GitHub CLI"
readonly APP_BINARY="/usr/local/bin/gh"
readonly APP_EXPECTED_TEAM_ID="VEKTX9H2N7"

# GitHub release API
readonly GH_API_URL="https://api.github.com/repos/cli/cli/releases/latest"

# Logging (Intune standard)
readonly LOG_DIR="/Library/Logs/Microsoft/IntuneScripts/githubcli"
readonly LOG_FILE="${LOG_DIR}/githubcli.log"

# Script version
readonly SCRIPT_VERSION="1.0.0"

# =============================================================================
# LOGGING FUNCTIONS
# =============================================================================

setup_logging() {
    if [[ ! -d "${LOG_DIR}" ]]; then
        mkdir -p "${LOG_DIR}"
    fi
    exec > >(tee -a "${LOG_FILE}") 2>&1
}

log_info() {
    echo "[$(date '+%Y-%m-%d %H:%M:%S')] [INFO]    $*"
}

log_warn() {
    echo "[$(date '+%Y-%m-%d %H:%M:%S')] [WARN]    $*"
}

log_error() {
    echo "[$(date '+%Y-%m-%d %H:%M:%S')] [ERROR]   $*"
}

log_success() {
    echo "[$(date '+%Y-%m-%d %H:%M:%S')] [SUCCESS] $*"
}

log_separator() {
    echo "=============================================================================="
}

# =============================================================================
# VALIDATION FUNCTIONS
# =============================================================================

check_root() {
    if [[ "$(id -u)" -ne 0 ]]; then
        log_error "This script must be run as root."
        log_error "Usage: sudo $0"
        exit 1
    fi
    log_info "Privilege check: running as root ✓"
}

check_macos_version() {
    local macos_version
    macos_version=$(sw_vers -productVersion)
    local major_version
    major_version=$(echo "${macos_version}" | cut -d. -f1)

    if [[ "${major_version}" -lt 12 ]]; then
        log_error "macOS ${macos_version} is not supported. Requires macOS 12.0 or higher."
        exit 1
    fi
    log_info "macOS version: ${macos_version} ✓"
}

check_internet() {
    log_info "Checking internet connectivity..."
    local retry_count=0
    local max_retries=3

    while [[ ${retry_count} -lt ${max_retries} ]]; do
        if curl -fsSL --connect-timeout 10 -o /dev/null "https://github.com" 2>/dev/null; then
            log_info "Internet connectivity: OK ✓"
            return 0
        fi
        retry_count=$((retry_count + 1))
        log_warn "Connection attempt ${retry_count}/${max_retries} failed. Waiting 5s..."
        sleep 5
    done

    log_error "No internet connectivity after ${max_retries} attempts."
    exit 1
}

check_existing_installation() {
    if [[ -f "${APP_BINARY}" ]]; then
        local installed_version
        installed_version=$("${APP_BINARY}" --version 2>/dev/null | head -1 | awk '{print $3}' || echo "unknown")
        log_info "${APP_NAME} is already installed (version: ${installed_version})."
        log_info "The script will update to the latest version."
        return 0
    fi
    log_info "${APP_NAME} not found. A new copy will be installed."
    return 1
}

# =============================================================================
# INSTALLATION FUNCTIONS
# =============================================================================

get_download_url() {
    log_info "Fetching download URL for the latest version..."

    local arch
    arch=$(uname -m)
    log_info "Architecture detected: ${arch}"

    # Search for the .pkg URL in the GitHub API
    local api_response
    api_response=$(curl -sfL "${GH_API_URL}" 2>/dev/null) || true

    if [[ -n "${api_response}" ]]; then
        # Extract version via API
        LATEST_VERSION=$(echo "${api_response}" | awk -F'"' '/"tag_name"/ {print $4}' | sed 's/^v//')
        log_info "Latest version (via API): ${LATEST_VERSION}"

        # Extract the .pkg URL (GitHub CLI distributes a universal .pkg for macOS)
        DOWNLOAD_URL=$(echo "${api_response}" | awk -F'"' '/browser_download_url/ && /macOS.*\.pkg"/ {print $4; exit}')

        # Fallback: try any .pkg with "macos" in the name (case insensitive)
        if [[ -z "${DOWNLOAD_URL}" ]]; then
            DOWNLOAD_URL=$(echo "${api_response}" | awk -F'"' '/browser_download_url/ && /macos.*\.pkg"/ {print $4; exit}')
        fi
    fi

    # Fallback: if the API failed (e.g., rate limit 403), resolve via redirect from /releases/latest
    if [[ -z "${DOWNLOAD_URL:-}" ]]; then
        log_warn "GitHub API unavailable (possible rate limit). Using fallback via redirect..."

        LATEST_VERSION=$(curl -sLI "https://github.com/cli/cli/releases/latest" 2>/dev/null \
            | grep -i "^location" | tr "/" "\n" | tail -1 | sed 's/[^0-9.]//g')

        if [[ -z "${LATEST_VERSION}" ]]; then
            log_error "Could not determine the latest version."
            log_error "Verify: https://github.com/cli/cli/releases/latest"
            exit 1
        fi

        log_info "Latest version (via redirect): ${LATEST_VERSION}"
        DOWNLOAD_URL="https://github.com/cli/cli/releases/download/v${LATEST_VERSION}/gh_${LATEST_VERSION}_macOS_universal.pkg"
        log_info "URL constructed by fallback: ${DOWNLOAD_URL}"
    fi

    if [[ -z "${DOWNLOAD_URL}" ]]; then
        log_error "Could not find .pkg download URL."
        log_error "Verify: https://github.com/cli/cli/releases/latest"
        exit 1
    fi

    log_info "Download URL: ${DOWNLOAD_URL}"
}

download_and_install() {
    local tmp_dir
    tmp_dir="$(mktemp -d)"
    local pkg_path="${tmp_dir}/${APP_NAME}.pkg"

    log_info "Downloading ${APP_NAME} v${LATEST_VERSION}..."

    local attempt=0
    local max_attempts=3
    local exit_code=1

    while [[ ${attempt} -lt ${max_attempts} && ${exit_code} -ne 0 ]]; do
        attempt=$((attempt + 1))
        log_info "Attempt ${attempt}/${max_attempts}..."

        if curl -Ls "${DOWNLOAD_URL}" -o "${pkg_path}" 2>&1; then
            # Verify if the download is a valid .pkg
            local file_type
            file_type=$(file -b "${pkg_path}" | head -1)

            if echo "${file_type}" | grep -qi "xar\|package\|data"; then
                log_info "Download complete. Type: ${file_type}"

                # Verify Team ID
                local team_id
                team_id=$(spctl -a -vv -t install "${pkg_path}" 2>&1 \
                    | awk '/origin=/ {print $NF}' | tr -d '()' || true)
                log_info "Package Team ID: ${team_id}"

                if [[ "${APP_EXPECTED_TEAM_ID}" == "${team_id}" || -z "${APP_EXPECTED_TEAM_ID}" ]]; then
                    log_info "Team ID verified ✓ Installing..."

                    if installer -verbose -dumplog -pkg "${pkg_path}" -target "/" 2>&1; then
                        log_success "${APP_NAME} installed successfully."
                        exit_code=0
                    else
                        log_error "Package installation failed."
                    fi
                else
                    log_warn "Team ID does not match (expected: '${APP_EXPECTED_TEAM_ID}', received: '${team_id}')."
                    log_warn "Installing anyway (Team ID may vary between releases)."

                    if installer -verbose -dumplog -pkg "${pkg_path}" -target "/" 2>&1; then
                        log_success "${APP_NAME} installed successfully."
                        exit_code=0
                    else
                        log_error "Package installation failed."
                    fi
                fi
            else
                log_error "Downloaded file is not a valid .pkg: ${file_type}"
            fi
        else
            log_warn "Download failed (attempt ${attempt})."
        fi

        if [[ ${attempt} -lt ${max_attempts} && ${exit_code} -ne 0 ]]; then
            log_info "Waiting 3s before retrying..."
            rm -f "${pkg_path}" 2>/dev/null || true
            sleep 3
        fi
    done

    # Cleanup
    rm -rf "${tmp_dir}" 2>/dev/null || true

    if [[ ${exit_code} -ne 0 ]]; then
        log_error "Installation failed after ${max_attempts} attempts."
        exit 1
    fi
}

verify_installation() {
    log_info "Verifying ${APP_NAME} installation..."

    if [[ -f "${APP_BINARY}" ]]; then
        local installed_version
        installed_version=$("${APP_BINARY}" --version 2>/dev/null | head -1 || echo "unknown")
        log_success "${APP_NAME} installed successfully!"
        log_info "  Binary:  ${APP_BINARY}"
        log_info "  Version: ${installed_version}"

        # Verify permissions
        local bin_perms
        bin_perms=$(ls -la "${APP_BINARY}" | awk '{print $1, $3, $4}')
        log_info "  Perms:   ${bin_perms}"

        return 0
    else
        log_error "${APP_NAME} NOT found at ${APP_BINARY} after installation."
        return 1
    fi
}

# =============================================================================
# MAIN EXECUTION
# =============================================================================

main() {
    setup_logging

    log_separator
    log_info "=== ${APP_NAME} Installation ==="
    log_info "Script version: ${SCRIPT_VERSION}"
    log_info "Date/Time: $(date '+%Y-%m-%d %H:%M:%S %Z')"
    log_info "Hostname: $(hostname)"
    log_info "Executing user: $(whoami)"
    log_info "macOS: $(sw_vers -productVersion) ($(sw_vers -buildVersion))"
    log_info "Architecture: $(uname -m)"
    log_separator

    # Pre-checks
    check_root
    check_macos_version
    check_internet

    # Check existing installation (informative)
    check_existing_installation || true

    # Download and installation
    get_download_url
    download_and_install

    # Post-installation verification
    if verify_installation; then
        log_separator
        log_success "=== Installation completed successfully! ==="
        log_separator
        exit 0
    else
        log_separator
        log_error "=== Installation failed during verification! ==="
        log_separator
        exit 1
    fi
}

main "$@"