#!/usr/bin/env bash
# Build and push only the linux/amd64 OCI images affected by a main push.
set -euo pipefail

root="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
registry="${ZOT_REGISTRY:-registry.oeo.one}"
work="$root/.release/main-fastlane"
buildah_home="/home/justme/woodpecker/buildah-home/main-fastlane"
mkdir -p "$work" "$buildah_home"
export HOME="$buildah_home"
export BUILDAH_HOME="$buildah_home"
export REGISTRY_AUTH_FILE="$work/zot-auth.json"

if [[ "${CI_PIPELINE_EVENT:-}" == pull_request_closed ]]; then
  [[ "${CI_COMMIT_TARGET_BRANCH:-}" == main && -n "${CI_COMMIT_PULL_REQUEST:-}" ]] || {
    echo "ignoring closed pull request outside main" >&2
    exit 0
  }
  gitea_base="${GITEA_BASE:-http://127.0.0.1:3100}"
  api="$gitea_base/api/v1/repos/justme/MyMonitor"
  pr_json="$(curl --fail-with-body --silent --show-error "$api/pulls/$CI_COMMIT_PULL_REQUEST")"
  read -r merged base_branch <<< "$(python3 -c 'import json,sys; p=json.load(sys.stdin); print(str(p.get("merged", False)).lower(), p.get("base", {}).get("ref", ""))' <<< "$pr_json")"
  if [[ "$merged" != true || "$base_branch" != main ]]; then
    echo "pull request $CI_COMMIT_PULL_REQUEST was closed without merging to main; skipping images"
    exit 0
  fi

  export FASTLANE_MERGED_PR=true
  export FASTLANE_FILES_FROM_PR_API=true
  export CI_PIPELINE_FILES="$(curl --fail-with-body --silent --show-error \
    "$api/pulls/$CI_COMMIT_PULL_REQUEST/files?limit=500" \
    | python3 -c 'import json,sys; print(json.dumps([name for item in json.load(sys.stdin) for name in (item["filename"], item.get("previous_filename")) if name]))')"
  git fetch "$gitea_base/justme/MyMonitor.git" main
  git checkout --detach FETCH_HEAD
  export CI_COMMIT_BRANCH=main
elif [[ "${CI_PIPELINE_EVENT:-}" != push || "${CI_COMMIT_BRANCH:-}" != main ]]; then
  echo "fast-lane images can only be published from a main push or a merged PR into main" >&2
  exit 2
fi

[[ -n "${ZOT_USERNAME:-}" && -n "${ZOT_SECRET:-}" ]] || {
  echo "Zot credentials are required" >&2
  exit 2
}

targets="$(python3 "$root/ci/main-fastlane.py")"
if [[ -z "$targets" ]]; then
  echo "no runtime image changes detected; skipping container builds"
  exit 0
fi
echo "affected linux/amd64 images: ${targets//$'\n'/, }"

logged_in=false
for attempt in 1 2 3 4; do
  if buildah login --tls-verify=true --username "$ZOT_USERNAME" --password-stdin "$registry" <<< "$ZOT_SECRET" >/dev/null; then
    logged_in=true
    break
  fi
  if [[ "$attempt" -lt 4 ]]; then
    echo "Zot login attempt $attempt failed; retrying in 3 seconds" >&2
    sleep 3
  fi
done
[[ "$logged_in" == true ]] || { echo "could not authenticate to Zot after 4 attempts" >&2; exit 1; }

publish_node_image() {
  local component="$1" context="$work/$1" image="$registry/monitor/monitor-$1"
  local local_image="localhost/monitor-$component:main-amd64"

  python3 "$root/ci/main-fastlane.py" --stage "$component" --destination "$context"
  buildah bud --layers --network host --tls-verify=true --arch amd64 \
    --build-arg APP_VERSION=main \
    -f "$context/Containerfile" -t "$local_image" "$context"

  for tag in main-amd64 main; do
    local pushed=false
    for attempt in 1 2 3; do
      if buildah push --tls-verify=true "$local_image" "docker://$image:$tag"; then
        pushed=true
        break
      fi
      if [[ "$attempt" -lt 3 ]]; then
        echo "Zot push for $component:$tag attempt $attempt failed; retrying in 5 seconds" >&2
        sleep 5
      fi
    done
    [[ "$pushed" == true ]] || { echo "could not push $component:$tag after 3 attempts" >&2; return 1; }
    echo "pushed Zot image $image:$tag"
  done
}

while IFS= read -r component; do
  [[ -n "$component" ]] || continue
  case "$component" in
    backend) bash "$root/ci/release-linux.sh" amd64 backend ;;
    agent|probe) publish_node_image "$component" ;;
    *) echo "unknown affected image: $component" >&2; exit 2 ;;
  esac
done <<< "$targets"