#!/usr/bin/env bash
set -euo pipefail
set +x

: "${GITHUB_SHA:?GITHUB_SHA is required}"
: "${IMAGE_NAME:?IMAGE_NAME is required}"
: "${IMAGE_REPOSITORY:?IMAGE_REPOSITORY is required}"
: "${IMAGE_DOCKERFILE:?IMAGE_DOCKERFILE is required}"
: "${PUSH_REGISTRY:?PUSH_REGISTRY is required}"
: "${PULL_REGISTRY:?PULL_REGISTRY is required}"
: "${SPIRE_AGENT_SOCKET:?SPIRE_AGENT_SOCKET is required}"

# Bootstrap the image that first introduces automatic Docker setup. Once that
# runner is deployed, the job-started hook makes this an idempotent no-op.
sudo scripts/setup-job-docker

image_tag="sha-${GITHUB_SHA}"
metadata="${IMAGE_NAME}-metadata.json"
docker_config=$(mktemp -d)
jwt_file=$(mktemp)
cleanup() {
  docker buildx rm ci-builder >/dev/null 2>&1 || true
  rm -rf -- "$docker_config" "$jwt_file"
}
trap cleanup EXIT
export DOCKER_CONFIG="$docker_config"

/opt/spire/bin/spire-agent api fetch jwt \
  -audience zot \
  -socketPath "$SPIRE_AGENT_SOCKET" \
  -output json >"$jwt_file"
# shellcheck disable=SC2016
jq -er '.[0].svids[0].svid' "$jwt_file" | \
  docker login "$PUSH_REGISTRY" --username zot --password-stdin

docker buildx create \
  --name ci-builder \
  --driver docker-container \
  --use

docker buildx build \
  --builder ci-builder \
  --platform linux/amd64 \
  --file "$IMAGE_DOCKERFILE" \
  --tag "${PUSH_REGISTRY}/${IMAGE_REPOSITORY}:${image_tag}" \
  --tag "${PUSH_REGISTRY}/${IMAGE_REPOSITORY}:main" \
  --provenance=mode=max \
  --sbom=true \
  --metadata-file "$metadata" \
  --push \
  .

image_digest=$(
  # shellcheck disable=SC2016
  jq -er '."containerimage.digest"' "$metadata"
)
image_ref="${PULL_REGISTRY}/${IMAGE_REPOSITORY}@${image_digest}"

printf '%s=%s\n' "$IMAGE_NAME" "$image_ref"
if [[ -n "${GITHUB_STEP_SUMMARY:-}" ]]; then
  {
    printf '## Published image\n\n'
    # shellcheck disable=SC2016
    printf -- '- %s: `%s`\n' "$IMAGE_NAME" "$image_ref"
    # shellcheck disable=SC2016
    printf -- '- Source: `%s`\n' "$GITHUB_SHA"
  } >>"$GITHUB_STEP_SUMMARY"
fi