#!/usr/bin/env bash
# Shared by host-runner scripts. No credentials are persisted in the workspace.
set -Eeuo pipefail
CI_ROOT=$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")/.." && pwd)
cd "$CI_ROOT"
ARTIFACTS="$CI_ROOT/ci/artifacts"
mkdir -p "$ARTIFACTS"
: "${CI_COMMIT:=$(git rev-parse HEAD)}"
: "${CI_RUN_ID:=local}"
: "${CI_RUN_ATTEMPT:=1}"
[[ "$CI_COMMIT" =~ ^[0-9a-f]{40}$ ]] || { echo 'Invalid commit SHA' >&2; exit 1; }
[[ "$CI_RUN_ID-$CI_RUN_ATTEMPT" =~ ^[a-zA-Z0-9-]+$ ]] || { echo 'Invalid run identifier' >&2; exit 1; }
RUN_NAME="agiledancers-${CI_RUN_ID}-${CI_RUN_ATTEMPT}"
BACKEND_IMAGE="agiledancers-ci-backend:${CI_COMMIT}-${CI_RUN_ID}-${CI_RUN_ATTEMPT}"
FRONTEND_IMAGE="agiledancers-ci-frontend:${CI_COMMIT}-${CI_RUN_ID}-${CI_RUN_ATTEMPT}"

require_platform() {
    : "${TARGET_PLATFORM:?Set TARGET_PLATFORM to the verified Synology platform (for example linux/amd64)}"
    local arch native
    arch=$(docker info --format '{{.Architecture}}')
    case "$arch" in x86_64|amd64) arch=amd64;; aarch64|arm64) arch=arm64;; esac
    native="$(docker info --format '{{.OSType}}')/$arch"
    [[ "$TARGET_PLATFORM" == "$native" ]] || {
        echo "Target $TARGET_PLATFORM differs from Docker host $native. Resolve and test the architecture before running CI." >&2
        return 1
    }
}

# Anonymous build pulls must not invoke the developer's desktop credential helper.
# Publication uses the same isolation and logs in only to our registry.
isolate_docker_config() {
    if [[ -z "${DOCKER_HOST:-}" ]]; then
        DOCKER_HOST=$(docker context inspect --format '{{.Endpoints.docker.Host}}')
        export DOCKER_HOST
    fi
    unset DOCKER_CONTEXT
    CI_DOCKER_CONFIG=$(mktemp -d)
    DOCKER_CONFIG=$CI_DOCKER_CONFIG
    export DOCKER_CONFIG
}