#!/usr/bin/env bash
# Build and push one opt-in main Linux amd64 image to the dev repository in Zot.
set -euo pipefail

[[ "${CI_PIPELINE_EVENT:-}" == push && "${CI_COMMIT_BRANCH:-}" == main && "${CI_COMMIT_MESSAGE:-}" == *"[CI]"* ]] || {
  echo "main amd64 builds require a main push with [CI] in the commit message" >&2
  exit 2
}

component="${1:?usage: build-main-amd64.sh <backend|agent|probe>}"
case "$component" in
  backend|agent|probe) ;;
  *) echo "unsupported component: $component" >&2; exit 2 ;;
esac
[[ -n "${ZOT_USERNAME:-}" && -n "${ZOT_SECRET:-}" ]] || {
  echo "Zot credentials are required" >&2
  exit 2
}
[[ "${CI_COMMIT_SHA:-}" =~ ^[0-9a-fA-F]{40}$ ]] || {
  echo "CI_COMMIT_SHA must be a full commit SHA" >&2
  exit 2
}

root="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
registry="${ZOT_REGISTRY:-registry.oeo.one}"
repository="$registry/moshiro-dev/moshiro-$component"
work="$root/.release/main-amd64-build"
base_home="/home/justme/woodpecker/buildah-home/main-amd64-build-$component"
short_sha="${CI_COMMIT_SHA:0:12}"
dev_tag="dev-$short_sha"
mkdir -p "$work" "$base_home"

if [[ "$component" == backend ]]; then
  export MOSHIRO_TAG="$dev_tag"
  BUILDAH_HOME="$base_home" \
    ZOT_REGISTRY="$registry" \
    ZOT_IMAGE_REPOSITORY="$repository" \
    IMAGE_TAGS="latest,$dev_tag" \
    IMAGE_PUBLISH=true \
    bash "$root/ci/release-linux.sh" amd64 backend
  exit 0
fi

export HOME="$base_home"
export BUILDAH_HOME="$base_home"
export REGISTRY_AUTH_FILE="$work/$component-auth.json"
context="$work/$component"
local_image="localhost/moshiro-$component:main-amd64-check"

python3 "$root/ci/stage-node-image.py" "$component" "$context"
buildah bud --layers --network host --tls-verify=true --arch amd64 \
  --build-arg APP_VERSION=main \
  --build-arg "MOSHIRO_TAG=$dev_tag" --build-arg "MOSHIRO_COMMIT=${CI_COMMIT_SHA:0:10}" --build-arg "MOSHIRO_BUILT_AT=$(date -u +%Y-%m-%dT%H:%M:%SZ)" \
  -f "$context/Containerfile" \
  -t "$local_image" "$context"

logged_in=false
for attempt in 1 2 3 4; do
  if buildah login --tls-verify=true --username "$ZOT_USERNAME" --password-stdin "$registry" <<< "$ZOT_SECRET" >/dev/null; then
    logged_in=true
    break
  fi
  if [[ "$attempt" -lt 4 ]]; then
    echo "Zot login attempt $attempt failed; retrying in 3 seconds" >&2
    sleep 3
  fi
done
[[ "$logged_in" == true ]] || { echo "could not authenticate to Zot after 4 attempts" >&2; exit 1; }

for tag in latest "$dev_tag"; do
  pushed=false
  for attempt in 1 2 3; do
    if buildah push --tls-verify=true --digestfile "$work/$component.digest" "$local_image" "docker://$repository:$tag"; then
      pushed=true
      break
    fi
    if [[ "$attempt" -lt 3 ]]; then
      echo "Zot push for $component:$tag attempt $attempt failed; retrying in 5 seconds" >&2
      sleep 5
    fi
  done
  [[ "$pushed" == true ]] || { echo "could not push $repository:$tag after 3 attempts" >&2; exit 1; }
  echo "pushed development image $repository:$tag"
done

# 发布清单：给镜像的 digest 签名（私钥只在 CI 密钥里），再登记到面板；面板把它原样转给在线的节点，节点宿主机上的更新器用本机的公钥验签后才会更新。
# 没有配置签名密钥（例如 fork）就只构建镜像、不发清单。
if [[ -n "${RELEASE_SIGNING_KEY:-}" ]]; then
  digest="$(cat "$work/$component.digest")"
  release_dir="$work/$component-release"
  bash "$root/ci/release-manifest.sh" "$component" "$repository" "$digest" "$dev_tag" dev "$release_dir"
  if [[ -n "${RELEASE_API_URL:-}" && -n "${RELEASE_API_TOKEN:-}" ]]; then
    python3 -c 'import json,sys; print(json.dumps({"manifest": open(sys.argv[1]).read(), "signature": open(sys.argv[2]).read()}))'       "$release_dir/manifest.json" "$release_dir/manifest.sig"       | curl --fail-with-body --silent --show-error --retry 3 -X POST "${RELEASE_API_URL%/}/api/admin/releases"           -H "Authorization: Bearer $RELEASE_API_TOKEN" -H 'Content-Type: application/json' --data-binary @- >/dev/null
    echo "registered the signed $component release with the panel"
  fi
fi