#!/usr/bin/env bash
set -euo pipefail

: "${CI_SPIFFE_ID:?CI_SPIFFE_ID is required}"
: "${SPIFFE_ENDPOINT_SOCKET:?SPIFFE_ENDPOINT_SOCKET is required}"
: "${GITEA_RUNNER_REGISTRATION_TOKEN_URL:?GITEA_RUNNER_REGISTRATION_TOKEN_URL is required}"

socket_path=${SPIFFE_ENDPOINT_SOCKET#unix://}
token_file=$(mktemp)
trap 'rm -f -- "$token_file"' EXIT
export GITEA_RUNNER_REGISTRATION_TOKEN_FILE="$token_file"
deadline=$((SECONDS + 120))
while (( SECONDS < deadline )); do
  if /opt/spire/bin/spire-agent api fetch x509 \
    -socketPath "$socket_path" \
    -output json 2>/dev/null | \
    jq -e --arg id "$CI_SPIFFE_ID" \
      'any(.svids[]?; .spiffe_id == $id)' >/dev/null; then
    umask 077
    curl --fail --silent --show-error --retry 10 --retry-all-errors \
      --connect-timeout 2 --max-time 30 \
      "$GITEA_RUNNER_REGISTRATION_TOKEN_URL" >"$token_file"
    /usr/local/bin/run.sh
    exit $?
  fi
  sleep 1
done

printf 'timed out waiting for OpenSandbox SPIFFE identity %s\n' "$CI_SPIFFE_ID" >&2
exit 1