#!/usr/bin/env bash
set -Eeuo pipefail
: "${REGISTRY_SERVER:?Missing Gitea server URL}"
: "${REGISTRY_REPOSITORY:?Missing owner/repository}"
: "${REGISTRY_USER:?Configure CONTAINER_REGISTRY_USER}"
: "${REGISTRY_TOKEN:?Configure CONTAINER_REGISTRY_TOKEN with package write access}"
sha="$(git rev-parse HEAD)"
[[ "$sha" =~ ^[0-9a-f]{40}$ ]] || exit 1
registry="${REGISTRY_SERVER#https://}"
registry="${registry%/}"
[[ "$REGISTRY_SERVER" = https://* && "$registry" != */* ]] || { echo "Registry must use HTTPS at the Gitea server root" >&2; exit 1; }
repository="${REGISTRY_REPOSITORY,,}"
[[ "$repository" =~ ^[a-z0-9._-]+/[a-z0-9._-]+$ ]] || exit 1
# Gitea packages belong to a user/organization, independently of repository ACLs.
# A collaborator token cannot publish to another user's personal namespace.
namespace="${REGISTRY_NAMESPACE:-$REGISTRY_USER}"
namespace="${namespace,,}"
[[ "$namespace" =~ ^[a-z0-9][a-z0-9._-]*$ ]] || { echo "Invalid registry namespace; use a Gitea username or organization" >&2; exit 1; }
repository="$namespace/${repository#*/}"
image="$registry/$repository:$sha"
# Isolate credentials from the self-hosted runner's normal Docker configuration.
export DOCKER_CONFIG
DOCKER_CONFIG="$(mktemp -d)"
context="$(mktemp -d)"
trap 'rm -rf -- "$DOCKER_CONFIG" "$context"' EXIT
# Build only the committed source, never untracked files from a shared runner.
git archive HEAD | tar -x -C "$context"
printf '%s' "$REGISTRY_TOKEN" | docker login "$registry" --username "$REGISTRY_USER" --password-stdin
unset REGISTRY_TOKEN
# On the shared runner, publish the exact image already verified by deployment.
local_image="epicnext-cms:$sha"
local_revision="$(docker image inspect --format '{{index .Config.Labels "org.opencontainers.image.revision"}}' "$local_image" 2>/dev/null || true)"
local_id="$(docker image inspect --format '{{.Id}}' "$local_image" 2>/dev/null || true)"
verified_id="$(docker image inspect --format '{{.Id}}' "epicnext-cms:verified-$sha" 2>/dev/null || true)"
if [[ "$local_revision" = "$sha" && -n "$local_id" && "$local_id" = "$verified_id" ]]; then
  docker tag "$verified_id" "$image"
  echo "Reusing verified release image $local_image"
else
  docker build --network=host --build-arg NEXT_DEPLOYMENT_ID="$sha" -t "$image" "$context"
fi
docker build --network=host --target migrations -t "$image-migrations" "$context"
node scripts/verify-portable-image.mjs "$image" "$sha"
# Publish only after the same application image passed both runtime configurations.
# Bound each blob request below reverse-proxy upload limits. Pin the uploader
# and verify its checksum before giving it access to the temporary Docker login.
case "$(uname -m)" in
  x86_64) arch=amd64; checksum=8e0e62a497fcdb8048d18aa927a139613176ba0531f412bc541044e28f9856bd ;;
  aarch64|arm64) arch=arm64; checksum=a9b71a3ee79b2d1dbbd7d51fd5e8fa214722c192864235d3d8764463c751a1ff ;;
  *) echo "Unsupported registry uploader architecture" >&2; exit 1 ;;
esac
curl --fail --silent --show-error --location --retry 3 --connect-timeout 15 --max-time 120 \
  "https://github.com/regclient/regclient/releases/download/v0.11.6/regctl-linux-$arch" -o "$context/regctl"
printf '%s  %s\n' "$checksum" "$context/regctl" | sha256sum --check --status
chmod 700 "$context/regctl"
export REGCTL_CONFIG="$DOCKER_CONFIG/regctl.json"
regctl() { "$context/regctl" "$@"; }
regctl registry set "$registry" --blob-chunk 8388608 --blob-max 8388608
for target in "$image-migrations" "$image"; do
  echo "Publishing $target with blob requests up to 8 MiB"
  docker image save --output "$context/image.tar" "$target"
  # Normalize the saved archive locally before copying it unchanged to Gitea.
  # Docker engine IDs and OCI index IDs are not interchangeable with config IDs.
  local_ref="ocidir://$context/oci:verified"
  regctl image import "$local_ref" "$context/image.tar"
  expected_config="$(regctl manifest get "$local_ref" --platform "linux/$arch" --format '{{.GetConfig.Digest}}')"
  [[ "$expected_config" =~ ^sha256:[0-9a-f]{64}$ ]] || { echo "Invalid local image config digest" >&2; exit 1; }
  regctl image copy "$local_ref" "$target"
  remote_config="$(regctl manifest get "$target" --platform "linux/$arch" --format '{{.GetConfig.Digest}}')"
  [[ "$remote_config" = "$expected_config" ]] || { echo "Published image config does not match verified local image" >&2; exit 1; }
  rm -f -- "$context/image.tar"
  rm -rf -- "$context/oci"
done
echo "Published application and migrations: $image"