#!/usr/bin/env bash
# Build and optionally push the Gitea Actions CI base image locally.
#
# Use when ci-image.yml is not yet on main (e.g. bootstrapping a PR branch) or
# when you need to rebuild without waiting for the nightly workflow.
#
# Build only (smoke test):
#   export CI_RUNNER_TOKEN='ci-bot-personal-access-token'
#   bash scripts/ci/build-ci-image.sh --local
#
# Build and push to Gitea (unblocks python-repositories-ci jobs):
#   export CI_RUNNER_TOKEN='ci-bot-personal-access-token'
#   bash scripts/ci/build-ci-image.sh --push
#
# Optional overrides:
#   REGISTRY=gitea.lille-vemmelund.dk
#   REGISTRY_USER=ci-bot
#   IMAGE_OWNER=brian
#   IMAGE_NAME=python-repositories-ci
set -euo pipefail

SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
REPO_ROOT="$(cd "${SCRIPT_DIR}/../.." && pwd)"

REGISTRY="${REGISTRY:-gitea.lille-vemmelund.dk}"
REGISTRY_USER="${REGISTRY_USER:-ci-bot}"
IMAGE_OWNER="${IMAGE_OWNER:-brian}"
IMAGE_NAME="${IMAGE_NAME:-python-repositories-ci}"
IMAGE="${IMAGE:-${REGISTRY}/${IMAGE_OWNER}/${IMAGE_NAME}}"

MODE="push"
if [[ "${1:-}" == "--local" ]]; then
  MODE="local"
elif [[ "${1:-}" == "--push" || -z "${1:-}" ]]; then
  MODE="push"
elif [[ -n "${1:-}" ]]; then
  echo "Usage: build-ci-image.sh [--local | --push]" >&2
  exit 1
fi

: "${CI_RUNNER_TOKEN:?CI_RUNNER_TOKEN is required (ci-bot token with read/write package access)}"

TOKEN_FILE="$(mktemp)"
cleanup() {
  rm -f "$TOKEN_FILE"
}
trap cleanup EXIT

printf '%s' "$CI_RUNNER_TOKEN" >"$TOKEN_FILE"

cd "$REPO_ROOT"

if [[ "$MODE" == "local" ]]; then
  echo "=== Building local CI image (no push): python-repositories-ci:local ==="
  docker build -f docker/ci/Dockerfile \
    --secret "id=uv_token,src=${TOKEN_FILE}" \
    -t python-repositories-ci:local \
    .
  echo "Built python-repositories-ci:local"
  exit 0
fi

echo "=== Logging in to ${REGISTRY} as ${REGISTRY_USER} ==="
echo "$CI_RUNNER_TOKEN" | docker login "$REGISTRY" -u "$REGISTRY_USER" --password-stdin

echo "=== Building ${IMAGE}:latest ==="
docker build -f docker/ci/Dockerfile \
  --secret "id=uv_token,src=${TOKEN_FILE}" \
  -t "${IMAGE}:latest" \
  .

STAMP="$(date -u +%Y%m%d%H%M)"
echo "=== Pushing ${IMAGE}:latest and ${IMAGE}:${STAMP} ==="
docker tag "${IMAGE}:latest" "${IMAGE}:${STAMP}"
docker push "${IMAGE}:latest"
docker push "${IMAGE}:${STAMP}"

echo "Done. Re-run failing CI jobs — runners pull ${IMAGE}:latest"