#!/usr/bin/env bash
# One native build/package path for glibc and musl, used by development and tags.
set -euo pipefail
rid="${1:?usage: build-linux-agent.sh <linux-x64|linux-arm64|linux-musl-arm64>}"
case "$rid" in
  linux-x64|linux-arm64) static_msquic=false ;;
  linux-musl-arm64) static_msquic=true ;;
  *) echo "unsupported Linux RID: $rid" >&2; exit 2 ;;
esac
root="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
source "$root/ci/version.sh"
[[ "${CI_COMMIT_SHA:-}" =~ ^[0-9a-fA-F]{40}$ ]] || { echo 'CI_COMMIT_SHA must be a full commit SHA' >&2; exit 2; }
[[ -n "${CI_COMMIT_TAG:-}" || ( "${CI_PIPELINE_EVENT:-}" == push && "${CI_COMMIT_BRANCH:-}" == main && "${CI_COMMIT_MESSAGE:-}" == *'[CI]'* ) ]] || exit 2
work="$root/.release/linux-agent/$rid"
base_home="/home/justme/woodpecker/buildah-home/linux-agent"
mkdir -p "$work" "$base_home"
# Concurrent RIDs share immutable tool layers/package downloads. Cleanup is exclusive.
exec 9> "$base_home/.lock"
flock -s -w 1800 9
exec 8> "$base_home/$rid.lock"
flock -w 1800 8
source "$root/ci/buildah-env.sh"
moshiro_setup_buildah "$base_home"
cleanup() {
  local status=$?
  trap - EXIT
  rm -rf "$work/context" "$work/binaries" "$work/packages"
  flock -u 9
  if flock -n -x 9; then
    bash "$root/ci/cleanup-build-cache.sh" || echo 'warning: build cache cleanup failed' >&2
  fi
  exit "$status"
}
trap cleanup EXIT
context="$work/context"
restore_image="localhost/moshiro-agent-restore:${CI_COMMIT_SHA}-${rid}"
restore_id="$(buildah images --noheading --no-trunc --format '{{.ID}}' "$restore_image" 2>/dev/null || true)"
[[ "${restore_id#sha256:}" =~ ^[0-9a-f]{64}$ ]] || {
  echo "missing prepared restore image $restore_image; run restore-linux-dependencies.sh first" >&2
  exit 1
}

commit_epoch="$(git -C "$root" show -s --format=%ct "$CI_COMMIT_SHA")"
built_at="$(date -u -d "@$commit_epoch" +%Y-%m-%dT%H:%M:%SZ)"
python3 "$root/ci/stage-node-image.py" agent "$rid" "$context"
local_image="localhost/moshiro-agent-binaries:$rid"
# Buildah --jobs runs independent native-link stages concurrently.
python3 "$root/ci/run-with-timeout.py" 1800 buildah bud --layers --force-rm --jobs 2 --network host \
  --tls-verify=true --ulimit nofile=65536:65536 --arch amd64 \
  --build-arg "NATIVEAOT_RESTORE_IMAGE=$restore_image" \
  --build-arg "NODE_RID=$rid" --build-arg "STATIC_MSQUIC=$static_msquic" \
  --build-arg "APP_VERSION=$MOSHIRO_VERSION" --build-arg "MOSHIRO_TAG=$MOSHIRO_TAG" \
  --build-arg "MOSHIRO_COMMIT=${CI_COMMIT_SHA:0:10}" --build-arg "MOSHIRO_BUILT_AT=$built_at" \
  -f "$context/Containerfile" -t "$local_image" "$context"
binaries="$work/binaries"
mkdir -p "$binaries"
python3 "$root/ci/run-with-timeout.py" 120 bash "$root/ci/extract-node-binaries.sh" "$local_image" "$binaries"
if [[ "$static_msquic" == false ]]; then
  arch=amd64
  [[ "$rid" != linux-arm64 ]] || arch=arm64
  bash "$root/ci/fetch-quic-test-runtime.sh" "$base_home/quic-runtime/$rid" "$arch"
  install -m 0644 "$base_home/quic-runtime/$rid/runtime/"*.so.* "$binaries/"
fi
bash "$root/ci/publish-linux-agent.sh" "$rid" "$binaries"