#!/usr/bin/env bash
# Publish one complete Archive Control client OCI image index.
set -euo pipefail

usage() {
  cat <<'EOF'
Usage: scripts/publish-image.sh <semver> [--also-latest]

Builds and pushes sodium/archive-clients for linux/amd64 and linux/arm64.
Docker must already be authenticated to the target registry.
EOF
}

if [[ $# -lt 1 || ${1:-} == '-h' || ${1:-} == '--help' ]]; then
  usage
  exit 2
fi

tag=$1
shift
also_latest=false
if [[ ${1:-} == '--also-latest' ]]; then
  also_latest=true
  shift
fi
if [[ $# -ne 0 ]]; then
  usage
  exit 2
fi

repository=${IMAGE_REPOSITORY:-sodium/archive-clients}
builder=${BUILDER:-archive-control-release}
buildkit_image=${BUILDKIT_IMAGE:-moby/buildkit:rootless}
# Nested Docker hosts can reject default OCI /proc mount masking. Rootless
# BuildKit confines this compatibility flag to the disposable release builder.
buildkitd_flags=${BUILDKITD_FLAGS:---oci-worker-no-process-sandbox}
binfmt_image=${BINFMT_IMAGE:-tonistiigi/binfmt}
host_arch=$(docker version --format '{{.Server.Arch}}')
case ${host_arch} in
  arm64|aarch64) emulated_arch=amd64 ;;
  amd64|x86_64) emulated_arch=arm64 ;;
  *) echo "Unsupported Docker server architecture: ${host_arch}" >&2; exit 1 ;;
esac

builder_created=false
binfmt_installed=false
cleanup() {
  local status=$?
  trap - EXIT
  if [[ ${builder_created} == true ]]; then
    docker buildx rm "${builder}" >/dev/null 2>&1 || true
  fi
  if [[ ${binfmt_installed} == true ]]; then
    docker run --privileged --rm "${binfmt_image}" --uninstall "${emulated_arch}" \
      >/dev/null 2>&1 || true
  fi
  exit "${status}"
}
trap cleanup EXIT

docker run --privileged --rm "${binfmt_image}" --install "${emulated_arch}" \
  >/dev/null
binfmt_installed=true
if docker buildx inspect "${builder}" >/dev/null 2>&1; then
  docker buildx rm "${builder}" >/dev/null
fi
docker buildx create --name "${builder}" --driver docker-container \
  --driver-opt "image=${buildkit_image}" \
  --buildkitd-flags "${buildkitd_flags}" --use >/dev/null
builder_created=true

platforms=$(docker buildx inspect "${builder}" --bootstrap 2>&1)
for platform in linux/amd64 linux/arm64; do
  if ! grep -Fq "${platform}" <<<"${platforms}"; then
    echo "Builder ${builder} does not support ${platform}; refusing partial release." >&2
    exit 1
  fi
done

tags=(--tag "${repository}:${tag}")
if [[ ${also_latest} == true ]]; then
  tags+=(--tag "${repository}:latest")
fi
docker buildx build --pull --platform linux/amd64,linux/arm64 \
  --push "${tags[@]}" .
docker buildx imagetools inspect "${repository}:${tag}"