#!/usr/bin/env bash
# Publish one framework-dependent Backend OCI image for the requested arch.
set -euo pipefail

arch="${1:?usage: release-linux.sh <amd64|arm64>}"
root="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
tag="${CI_COMMIT_TAG:-}"
[[ "$tag" =~ ^v[0-9]+\.[0-9]+\.[0-9]+(-[0-9A-Za-z.-]+)?$ ]] || {
  echo "release must run from a vMAJOR.MINOR.PATCH tag" >&2
  exit 2
}
[[ -n "${ZOT_USERNAME:-}" && -n "${ZOT_SECRET:-}" ]] || {
  echo "Zot credentials are required" >&2; exit 2;
}
case "$arch" in
  amd64|arm64) ;;
  *) echo "unsupported architecture: $arch" >&2; exit 2 ;;
esac

version="${tag#v}"
project_version="$(sed -n 's#.*<Version>\(.*\)</Version>.*#\1#p' "$root/backend/Directory.Build.props" | head -1)"
if [[ "$version" != "$project_version" ]]; then
  echo "tag version $version does not match project version $project_version" >&2
  exit 1
fi

registry="${ZOT_REGISTRY:-registry.oeo.one}"
image="$registry/monitor/monitor-backend"
output="$root/.release/linux-$arch/backend"
build_root="$root/.release/build/linux-$arch-backend"
container_context="$root/.release/container/linux-$arch"
mkdir -p "$output" "$build_root" "$container_context/app" "$container_context/data"

(cd "$root/backend" && dotnet publish src/Monitor.Backend \
  -m:3 -c Release --no-self-contained \
  -p:DebugType=none -p:DebugSymbols=false \
  -p:UseAppHost=false -p:OpenApiGenerateDocuments=false \
  --artifacts-path "$build_root" -o "$output")
find "$output" -type f -name '*.pdb' -delete
cp -a "$output/." "$container_context/app/"
: > "$container_context/data/.keep"

# Woodpecker's local backend isolates HOME per workflow. Keep Buildah's image
# store outside that temporary directory so the runtime base image is reusable
# across releases. Separate stores avoid concurrent amd64/arm64 writers.
buildah_home="/home/justme/woodpecker/buildah-home/$arch"
mkdir -p "$buildah_home"
export HOME="$buildah_home"

export REGISTRY_AUTH_FILE="$root/.release/auth/zot-linux-$arch.json"
mkdir -p "$(dirname "$REGISTRY_AUTH_FILE")"
logged_in=false
for attempt in 1 2 3 4; do
  if buildah login --tls-verify=true --username "$ZOT_USERNAME" --password-stdin "$registry" <<< "$ZOT_SECRET" >/dev/null; then
    logged_in=true
    break
  fi
  if [[ "$attempt" -lt 4 ]]; then
    echo "Zot login attempt $attempt failed; retrying in 3 seconds" >&2
    sleep 3
  fi
done
[[ "$logged_in" == true ]] || { echo "could not authenticate to Zot after 4 attempts" >&2; exit 1; }
local_image="localhost/monitor-backend:$version-$arch"
buildah bud --tls-verify=true --arch "$arch" \
  --build-arg "APP_VERSION=$version" \
  -f "$root/packaging/container/Backend.Containerfile" \
  -t "$local_image" "$container_context"
pushed=false
for attempt in 1 2 3; do
  if buildah push --tls-verify=true "$local_image" "docker://$image:$version-$arch"; then
    pushed=true
    break
  fi
  if [[ "$attempt" -lt 3 ]]; then
    echo "Zot push attempt $attempt failed; retrying in 5 seconds" >&2
    sleep 5
  fi
done
[[ "$pushed" == true ]] || { echo "could not push image to Zot after 3 attempts" >&2; exit 1; }
echo "pushed Zot image $image:$version-$arch"