#!/usr/bin/env bash

set -euo pipefail

repo_root="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd -P)"
dockerfile_context_path="deploy/container/gitea-ci-job.Dockerfile"
image_tag="${GENARRATIVE_GITEA_CI_IMAGE_TAG:-genarrative/gitea-project-ci:20260920.2}"
runner_container="${GENARRATIVE_GITEA_RUNNER_CONTAINER:-gitea-runner}"
builder_name="genarrative-ci-images"

prepare_builder() {
  if ! docker buildx version >/dev/null 2>&1; then
    echo 'Gitea CI image builds require the Docker Buildx plugin; see deploy/container/README.md.' >&2
    return 1
  fi
  if ! docker buildx inspect "${builder_name}" >/dev/null 2>&1; then
    docker buildx create --name "${builder_name}" --driver docker-container \
      --driver-opt image=moby/buildkit:v0.23.2@sha256:ddd1ca44b21eda906e81ab14a3d467fa6c39cd73b9a39df1196210edcb8db59e \
      --buildkitd-config "${repo_root}/deploy/container/gitea-ci-buildkitd.toml"
  fi
  if [[ "$(docker buildx inspect "${builder_name}" | awk '$1 == "Driver:" { print $2 }')" != docker-container ]]; then
    echo "${builder_name} must use the isolated docker-container driver" >&2
    return 1
  fi
}

write_build_context_file_list() {
  printf '%s\0' \
    deploy/container/gitea-ci-job.Dockerfile \
    deploy/container/gitea-ci-job.Dockerfile.dockerignore \
    deploy/container/gitea-ci-buildkitd.toml \
    deploy/container/gitea-ci-checkout.sh \
    scripts/export-ci-npm-download-cache.mjs \
    package.json \
    package-lock.json \
    apps/admin-web/package.json \
    apps/ai-game-creator-shell/package.json \
    apps/desktop-shell/package.json \
    apps/mobile-shell/package.json \
    apps/preview-deployer-web/package.json \
    packages/image-canvas-core/package.json \
    packages/image-canvas-react/package.json \
    packages/shared/package.json \
    tools/spine-json-export-validator/package.json \
    apps/ai-game-creator-shell/src-tauri/Cargo.toml \
    apps/ai-game-creator-shell/src-tauri/Cargo.lock \
    server-rs/Cargo.toml \
    server-rs/Cargo.lock \
    apps/desktop-shell/src-tauri/Cargo.toml \
    apps/desktop-shell/src-tauri/Cargo.lock
  find server-rs/crates apps/ai-game-creator-shell/src-tauri/vendor \
    plugins/agc-*-editor/native/*-editor-bridge \
    -name Cargo.toml \
    -type f -print0 \
    | sort -z
}

usage() {
  cat <<'EOF'
用法：
  bash scripts/gitea-ci-job-image.sh build
  bash scripts/gitea-ci-job-image.sh seed-downloads <可信 CI 镜像完整 Image ID>
  bash scripts/gitea-ci-job-image.sh revision
  bash scripts/gitea-ci-job-image.sh verify [镜像引用]
  bash scripts/gitea-ci-job-image.sh load-runner [镜像引用]
  bash scripts/gitea-ci-job-image.sh export <归档路径> [镜像引用]

环境变量：
  GENARRATIVE_GITEA_CI_IMAGE_TAG       覆盖本地构建 tag
  GENARRATIVE_GITEA_RUNNER_CONTAINER   覆盖 Runner 容器名
EOF
}

image_id() {
  docker image inspect --format '{{.Id}}' "$1"
}

verify_image() {
  local image_ref="$1"
  docker run --rm \
    --mount "type=bind,src=${repo_root}/scripts,dst=/usr/local/scripts,readonly" \
    --mount "type=bind,src=${repo_root}/scripts/check-gitea-ci-job-image.sh,dst=/usr/local/bin/check-gitea-ci-job-image.sh,readonly" \
    --mount "type=bind,src=${repo_root}/rust-toolchain.toml,dst=/usr/local/rust-toolchain.toml,readonly" \
    "${image_ref}" \
    bash /usr/local/bin/check-gitea-ci-job-image.sh
}

command_name="${1:-}"
case "${command_name}" in
  seed-downloads)
    # 运维显式指定的可信镜像只贡献下载包，不作为新基础镜像的父层。
    seed_image="${2:-}"
    [[ "${seed_image}" =~ ^sha256:[0-9a-f]{64}$ ]] || { echo 'seed requires a full trusted Image ID' >&2; exit 2; }
    prepare_builder
    seed_dir="$(mktemp -d)"
    seed_container=""
    cleanup_seed() {
      if [[ -n "${seed_container}" ]]; then docker rm --volumes "${seed_container}" >/dev/null; fi
      rm -rf -- "${seed_dir}"
    }
    trap cleanup_seed EXIT
    seed_container="$(docker create "${seed_image}")"
    mkdir -p "${seed_dir}/cargo-cache" "${seed_dir}/cargo-index" "${seed_dir}/npm"
    docker cp "${seed_container}:/usr/local/cargo/registry/cache/." "${seed_dir}/cargo-cache/"
    docker cp "${seed_container}:/usr/local/cargo/registry/index/." "${seed_dir}/cargo-index/"
    docker cp "${seed_container}:/root/.npm/_cacache/." "${seed_dir}/npm/"
    docker buildx build --builder "${builder_name}" --progress plain \
      --target download-cache-seed --no-cache-filter download-cache-seed \
      --build-context "download-seed=${seed_dir}" \
      --file "${repo_root}/${dockerfile_context_path}" "${seed_dir}"
    ;;
  revision)
    # 与 build 的 IMAGE_REVISION 使用同一份输入顺序，用于维护器判断基础镜像是否过期。
    (
      cd "${repo_root}"
      write_build_context_file_list | xargs -0 -r sha256sum | sha256sum | awk '{ print $1 }'
    )
    ;;
  build)
    prepare_builder
    image_revision="$(bash "${BASH_SOURCE[0]}" revision)"
    npm_lock_sha256="$(sha256sum "${repo_root}/package-lock.json")"
    npm_lock_sha256="${npm_lock_sha256%% *}"
    server_rust_lock_sha256="$(sha256sum "${repo_root}/server-rs/Cargo.lock")"
    server_rust_lock_sha256="${server_rust_lock_sha256%% *}"
    desktop_rust_lock_sha256="$(sha256sum "${repo_root}/apps/desktop-shell/src-tauri/Cargo.lock")"
    desktop_rust_lock_sha256="${desktop_rust_lock_sha256%% *}"
    agc_rust_lock_sha256="$(sha256sum "${repo_root}/apps/ai-game-creator-shell/src-tauri/Cargo.lock")"
    agc_rust_lock_sha256="${agc_rust_lock_sha256%% *}"
    (
      cd "${repo_root}"
      write_build_context_file_list \
        | tar --null --create --file - --files-from=- \
        | docker buildx build --builder "${builder_name}" --load --progress plain \
          --pull=false \
          --build-arg "IMAGE_REVISION=${image_revision}" \
          --build-arg "NPM_LOCK_SHA256=${npm_lock_sha256}" \
          --build-arg "SERVER_RUST_LOCK_SHA256=${server_rust_lock_sha256}" \
          --build-arg "DESKTOP_RUST_LOCK_SHA256=${desktop_rust_lock_sha256}" \
          --build-arg "AGC_RUST_LOCK_SHA256=${agc_rust_lock_sha256}" \
          --file "${dockerfile_context_path}" \
          --tag "${image_tag}" \
          -
    )
    verify_image "${image_tag}"
    printf 'image_tag=%s\n' "${image_tag}"
    printf 'image_id=%s\n' "$(image_id "${image_tag}")"
    ;;
  verify)
    image_ref="${2:-${image_tag}}"
    verify_image "${image_ref}"
    printf 'image_ref=%s\n' "${image_ref}"
    printf 'image_id=%s\n' "$(image_id "${image_ref}")"
    ;;
  load-runner)
    image_ref="${2:-${image_tag}}"
    verify_image "${image_ref}"
    expected_image_id="$(image_id "${image_ref}")"
    docker save "${image_ref}" | docker exec -i "${runner_container}" docker load
    loaded_image_id="$(
      docker exec "${runner_container}" \
        docker image inspect --format '{{.Id}}' "${image_ref}"
    )"
    test "${loaded_image_id}" = "${expected_image_id}"
    docker exec -i "${runner_container}" \
      docker run --rm --interactive \
      --security-opt seccomp=unconfined \
      --security-opt systempaths=unconfined \
      "${loaded_image_id}" bash -s \
      < "${repo_root}/scripts/check-gitea-ci-job-runtime.sh"
    printf 'runner_image_tag=%s\n' "${image_ref}"
    printf 'runner_image_id=%s\n' "${loaded_image_id}"
    printf 'runner_label_image=docker://%s\n' "${loaded_image_id}"
    ;;
  export)
    archive_path="${2:-}"
    image_ref="${3:-${image_tag}}"
    test -n "${archive_path}"
    verify_image "${image_ref}"
    docker save "${image_ref}" | zstd --threads=0 --ultra -10 -o "${archive_path}"
    archive_dir="$(cd "$(dirname "${archive_path}")" && pwd -P)"
    archive_name="$(basename "${archive_path}")"
    (
      cd "${archive_dir}"
      sha256sum "${archive_name}" > "${archive_name}.sha256"
    )
    printf 'archive=%s\n' "${archive_path}"
    printf 'image_id=%s\n' "$(image_id "${image_ref}")"
    ;;
  *)
    usage >&2
    exit 2
    ;;
esac