#!/usr/bin/env bash
# Caller holds its store lock. Keep recent image layers and the host NuGet cache.
set -euo pipefail
: "${CONTAINERS_STORAGE_CONF:?an explicit, locked CI Buildah store is required}"
# No build is active while the caller holds the exclusive store lock. Remove
# working containers left by canceled builds before considering old image layers.
buildah unshare buildah rm --all >/dev/null 2>&1 || true
buildah rmi localhost/moshiro-agent-binaries:linux-musl-x64 >/dev/null 2>&1 || true
# Remove only expired intermediate layers and versioned application images.
mapfile -t expired < <(buildah images --all --no-trunc --format '{{.ID}} {{.Created}} {{.Name}}:{{.Tag}}' | python3 -c '
import re,sys,time
cutoff=time.time()-7*86400
for line in sys.stdin:
    fields=line.split()
    if len(fields)!=3 or float(fields[1]) >= cutoff:
        continue
    name=fields[2]
    if name in ("<none>:<none>", ":") or re.fullmatch(r"localhost/moshiro-(agent|backend):[0-9][A-Za-z0-9._-]*",name) or re.fullmatch(r"localhost/moshiro-agent-restore:[0-9a-f]{40}-linux-(x64|arm64|musl-arm64)",name):
        print(fields[0])
')
for image in "${expired[@]}"; do
  # No force: a layer still referenced by another image/container is retained.
  buildah rmi "$image" >/dev/null 2>&1 || true
done
echo "expired build layers considered: ${#expired[@]} (retention: 7 days; NuGet cache retained)"
root="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
# 旧的 Buildah 存储目录需要在 buildah unshare 里删（属主是映射后的 uid）；这台主机上 unshare 失败时（memfd_create 之类）只警告，下次再试，不影响调用方。
if ! buildah unshare python3 "$root/ci/cleanup-retired-stores.py" /home/justme/woodpecker/buildah-home; then
  echo 'warning: retired Buildah stores were not cleaned (buildah unshare failed); the next run retries' >&2
fi