"""Create the Hub webhook that triggers HubAudit auto-audits.

OPS TEMPLATE — run manually ONLY when activating (Jobs cost money once they run).
Edit WATCHLIST to repos YOU control, and fill in the Job/handler target. This file
is intentionally a template: it is NOT executed by the build.

    PYTHONPATH=. python scripts/setup_webhook.py
"""
from __future__ import annotations

import os  # noqa: F401  (used by the commented-out secret example below)

from huggingface_hub import HfApi

# Only repos you own / explicitly opt in. NEVER strangers' repos.
WATCHLIST = ["BBLHesham/hubaudit"]

# The audit Job to trigger on each event (preferred: no always-on handler / no
# sleeping-Space problem). Get this id from `hf jobs run -d ...` (see the runbook).
JOB_ID = "<paste-the-audit-Job-id>"


def main() -> None:
    api = HfApi()
    webhook = api.create_webhook(
        job_id=JOB_ID,
        watched=[{"type": "model", "name": r} for r in WATCHLIST],
        domains=["repo"],
        # secret=os.environ["HUBAUDIT_WEBHOOK_SECRET"],  # optional shared secret
    )
    print("created webhook:", webhook.id, "-> job", JOB_ID)
    print("Next: push to a watched repo; confirm in `hf jobs ps -a` + the repo's Discussions.")


if __name__ == "__main__":
    main()