#!/usr/bin/env bash
# Publish the pullable multi-architecture development tags for Agent or Probe.
set -euo pipefail

component="${1:?usage: publish-dev-node-index.sh <agent|probe>}"
case "$component" in
  agent|probe) ;;
  *) echo "unsupported component: $component" >&2; exit 2 ;;
esac
[[ "${CI_PIPELINE_EVENT:-}" == push && "${CI_COMMIT_BRANCH:-}" == main && "${CI_COMMIT_MESSAGE:-}" == *"[CI]"* ]] || {
  echo "development node indexes require a main push with [CI] in the commit message" >&2
  exit 2
}
[[ "${CI_COMMIT_SHA:-}" =~ ^[0-9a-fA-F]{40}$ ]] || {
  echo "CI_COMMIT_SHA must be a full commit SHA" >&2
  exit 2
}
[[ -n "${ZOT_USERNAME:-}" && -n "${ZOT_SECRET:-}" ]] || {
  echo "Zot credentials are required" >&2
  exit 2
}

root="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
source "$root/ci/version.sh"
registry="${ZOT_REGISTRY:-registry.oeo.one}"
repository="$registry/moshiro-dev/moshiro-$component"
work="$root/.release/dev-image-index/$component"
home="/home/justme/woodpecker/buildah-home/dev-node-index-$component"
export HOME="$home"
export REGISTRY_AUTH_FILE="$work/auth.json"
mkdir -p "$work" "$home"

logged_in=false
for attempt in 1 2 3 4; do
  if buildah login --tls-verify=true --username "$ZOT_USERNAME" --password-stdin "$registry" <<< "$ZOT_SECRET" >/dev/null; then
    logged_in=true
    break
  fi
  if [[ "$attempt" -lt 4 ]]; then
    echo "Zot login attempt $attempt failed; retrying in 3 seconds" >&2
    sleep 3
  fi
done
[[ "$logged_in" == true ]] || { echo "could not authenticate to Zot after 4 attempts" >&2; exit 1; }

manifest="localhost/moshiro-$component:$MOSHIRO_VERSION-multiarch"
buildah manifest rm "$manifest" >/dev/null 2>&1 || true
buildah manifest create "$manifest" >/dev/null
buildah manifest add "$manifest" "docker://$repository:$MOSHIRO_VERSION-amd64" >/dev/null
buildah manifest add "$manifest" "docker://$repository:$MOSHIRO_VERSION-arm64" >/dev/null

push_tag() {
  local tag="$1"
  buildah manifest push --all --format oci --digestfile "$work/$component.digest" \
    "$manifest" "docker://$repository:$tag" >/dev/null
  echo "published multi-architecture development image $repository:$tag"
}

push_tag "$MOSHIRO_VERSION"
push_tag latest
buildah manifest rm "$manifest" >/dev/null

if [[ -n "${RELEASE_SIGNING_KEY:-}" ]]; then
  bash "$root/ci/publish-release-offer.sh" "$component" "$repository" \
    "$(cat "$work/$component.digest")" "$MOSHIRO_TAG" dev "$work/release"
fi