#!/usr/bin/env bash

set -euo pipefail

repo_root="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd -P)"
dockerfile_context_path="deploy/container/gitea-ci-job.Dockerfile"
image_tag="${GENARRATIVE_GITEA_CI_IMAGE_TAG:-genarrative/gitea-project-ci:20260807.1}"
runner_container="${GENARRATIVE_GITEA_RUNNER_CONTAINER:-gitea-runner}"

write_build_context_file_list() {
  printf '%s\0' \
    deploy/container/gitea-ci-job.Dockerfile \
    deploy/container/gitea-ci-job.Dockerfile.dockerignore \
    deploy/container/gitea-ci-checkout.sh \
    package.json \
    package-lock.json \
    apps/admin-web/package.json \
    apps/ai-game-creator-shell/package.json \
    apps/desktop-shell/package.json \
    apps/mobile-shell/package.json \
    apps/preview-deployer-web/package.json \
    packages/image-canvas-core/package.json \
    packages/image-canvas-react/package.json \
    packages/shared/package.json \
    tools/spine-json-export-validator/package.json \
    apps/ai-game-creator-shell/src-tauri/Cargo.toml \
    apps/ai-game-creator-shell/src-tauri/Cargo.lock \
    server-rs/Cargo.toml \
    server-rs/Cargo.lock \
    apps/desktop-shell/src-tauri/Cargo.toml \
    apps/desktop-shell/src-tauri/Cargo.lock
  find server-rs/crates -name Cargo.toml -print0 | sort -z
}

usage() {
  cat <<'EOF'
用法：
  bash scripts/gitea-ci-job-image.sh build
  bash scripts/gitea-ci-job-image.sh verify [镜像引用]
  bash scripts/gitea-ci-job-image.sh load-runner [镜像引用]
  bash scripts/gitea-ci-job-image.sh export <归档路径> [镜像引用]

环境变量：
  GENARRATIVE_GITEA_CI_IMAGE_TAG       覆盖本地构建 tag
  GENARRATIVE_GITEA_RUNNER_CONTAINER   覆盖 Runner 容器名
EOF
}

image_id() {
  docker image inspect --format '{{.Id}}' "$1"
}

verify_image() {
  local image_ref="$1"
  docker run --rm \
    --mount "type=bind,src=${repo_root}/scripts,dst=/usr/local/scripts,readonly" \
    --mount "type=bind,src=${repo_root}/scripts/check-gitea-ci-job-image.sh,dst=/usr/local/bin/check-gitea-ci-job-image.sh,readonly" \
    --mount "type=bind,src=${repo_root}/rust-toolchain.toml,dst=/usr/local/rust-toolchain.toml,readonly" \
    "${image_ref}" \
    bash /usr/local/bin/check-gitea-ci-job-image.sh
}

command_name="${1:-}"
case "${command_name}" in
  build)
    image_revision="$(
      cd "${repo_root}"
      {
        sha256sum \
          deploy/container/gitea-ci-job.Dockerfile \
          deploy/container/gitea-ci-job.Dockerfile.dockerignore \
          deploy/container/gitea-ci-checkout.sh \
          package.json \
          package-lock.json \
          apps/admin-web/package.json \
          apps/ai-game-creator-shell/package.json \
          apps/desktop-shell/package.json \
          apps/mobile-shell/package.json \
          apps/preview-deployer-web/package.json \
          packages/image-canvas-core/package.json \
          packages/image-canvas-react/package.json \
          packages/shared/package.json \
          tools/spine-json-export-validator/package.json \
          apps/ai-game-creator-shell/src-tauri/Cargo.toml \
          apps/ai-game-creator-shell/src-tauri/Cargo.lock \
          server-rs/Cargo.toml \
          server-rs/Cargo.lock \
          apps/desktop-shell/src-tauri/Cargo.toml \
          apps/desktop-shell/src-tauri/Cargo.lock
        find server-rs/crates -name Cargo.toml -print0 \
          | sort -z \
          | xargs -0 -r sha256sum
      } \
        | sha256sum \
        | awk '{ print $1 }'
    )"
    npm_lock_sha256="$(sha256sum "${repo_root}/package-lock.json")"
    npm_lock_sha256="${npm_lock_sha256%% *}"
    server_rust_lock_sha256="$(sha256sum "${repo_root}/server-rs/Cargo.lock")"
    server_rust_lock_sha256="${server_rust_lock_sha256%% *}"
    desktop_rust_lock_sha256="$(sha256sum "${repo_root}/apps/desktop-shell/src-tauri/Cargo.lock")"
    desktop_rust_lock_sha256="${desktop_rust_lock_sha256%% *}"
    agc_rust_lock_sha256="$(sha256sum "${repo_root}/apps/ai-game-creator-shell/src-tauri/Cargo.lock")"
    agc_rust_lock_sha256="${agc_rust_lock_sha256%% *}"
    (
      cd "${repo_root}"
      write_build_context_file_list \
        | tar --null --create --file - --files-from=- \
        | docker build \
          --pull=false \
          --build-arg "IMAGE_REVISION=${image_revision}" \
          --build-arg "NPM_LOCK_SHA256=${npm_lock_sha256}" \
          --build-arg "SERVER_RUST_LOCK_SHA256=${server_rust_lock_sha256}" \
          --build-arg "DESKTOP_RUST_LOCK_SHA256=${desktop_rust_lock_sha256}" \
          --build-arg "AGC_RUST_LOCK_SHA256=${agc_rust_lock_sha256}" \
          --file "${dockerfile_context_path}" \
          --tag "${image_tag}" \
          -
    )
    verify_image "${image_tag}"
    printf 'image_tag=%s\n' "${image_tag}"
    printf 'image_id=%s\n' "$(image_id "${image_tag}")"
    ;;
  verify)
    image_ref="${2:-${image_tag}}"
    verify_image "${image_ref}"
    printf 'image_ref=%s\n' "${image_ref}"
    printf 'image_id=%s\n' "$(image_id "${image_ref}")"
    ;;
  load-runner)
    image_ref="${2:-${image_tag}}"
    verify_image "${image_ref}"
    expected_image_id="$(image_id "${image_ref}")"
    docker save "${image_ref}" | docker exec -i "${runner_container}" docker load
    loaded_image_id="$(
      docker exec "${runner_container}" \
        docker image inspect --format '{{.Id}}' "${image_ref}"
    )"
    test "${loaded_image_id}" = "${expected_image_id}"
    docker exec -i "${runner_container}" \
      docker run --rm --interactive \
      --security-opt seccomp=unconfined \
      --security-opt systempaths=unconfined \
      "${loaded_image_id}" bash -s \
      < "${repo_root}/scripts/check-gitea-ci-job-runtime.sh"
    printf 'runner_image_tag=%s\n' "${image_ref}"
    printf 'runner_image_id=%s\n' "${loaded_image_id}"
    printf 'runner_label_image=docker://%s\n' "${loaded_image_id}"
    ;;
  export)
    archive_path="${2:-}"
    image_ref="${3:-${image_tag}}"
    test -n "${archive_path}"
    verify_image "${image_ref}"
    docker save "${image_ref}" | zstd --threads=0 --ultra -10 -o "${archive_path}"
    archive_dir="$(cd "$(dirname "${archive_path}")" && pwd -P)"
    archive_name="$(basename "${archive_path}")"
    (
      cd "${archive_dir}"
      sha256sum "${archive_name}" > "${archive_name}.sha256"
    )
    printf 'archive=%s\n' "${archive_path}"
    printf 'image_id=%s\n' "$(image_id "${image_ref}")"
    ;;
  *)
    usage >&2
    exit 2
    ;;
esac