#!/usr/bin/env bash
# ====================================================================================
# Nexo Runtime Image Publish Wrapper
#
# This script builds and publishes nexo-owned core (mattermost) and push-proxy images
# for linux/arm64 architecture to the toki-labs.com:5050 registry.
#
# Since the local environment does not have docker installed, all docker build and
# push operations are executed on the remote Mac build machine (toki@toki-labs.com)
# using /usr/local/bin/docker.
#
# Stable tag 'latest' is only promoted after verifying the successfully pushed
# immutable images.
# ====================================================================================

set -euo pipefail

# Configurations
REMOTE_HOST="toki@toki-labs.com"
REGISTRY="toki-labs.com:5050"
PLATFORM="linux/arm64"

# Set remote environment variables (specifically ensuring Docker Desktop helper binaries are in PATH)
REMOTE_ENV="export PATH=\"/Applications/Docker.app/Contents/Resources/bin:/usr/local/bin:\$PATH\""

# Image Tags
CORE_IMAGE_NAME="${REGISTRY}/nexo/mattermost"
PUSH_PROXY_IMAGE_NAME="${REGISTRY}/nexo/push-proxy"
IMMUTABLE_TAG="v11.4.2-arm64"

# Locate workspace root
WORKSPACE_ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"

echo "========================================================"
echo "🚀 Starting Nexo Runtime Image Publish Wrapper (Stable Gate)"
echo "========================================================"
echo "Remote Host:  ${REMOTE_HOST}"
echo "Registry:     ${REGISTRY}"
echo "Architecture: ${PLATFORM}"
echo "========================================================"

# ------------------------------------------------------------------------------------
# 1. Build, Publish and Verify Core (Mattermost) Image
# ------------------------------------------------------------------------------------
echo "📦 [1/2] Processing Core (Mattermost) Image..."
CORE_BUILD_DIR="/tmp/nexo-core-build"

echo "Creating remote directory for Core build..."
ssh "${REMOTE_HOST}" "${REMOTE_ENV} && rm -rf ${CORE_BUILD_DIR} && mkdir -p ${CORE_BUILD_DIR}"

echo "Copying Core Dockerfile and passwd to remote..."
scp "${WORKSPACE_ROOT}/services/core/server/build/Dockerfile" "${REMOTE_HOST}:${CORE_BUILD_DIR}/Dockerfile"
scp "${WORKSPACE_ROOT}/services/core/server/build/passwd" "${REMOTE_HOST}:${CORE_BUILD_DIR}/passwd"

echo "Building Core Immutable Image on remote Mac..."
ssh "${REMOTE_HOST}" "${REMOTE_ENV} && cd ${CORE_BUILD_DIR} && docker build --platform ${PLATFORM} \
  --build-arg MM_PACKAGE=\"https://releases.mattermost.com/11.4.2/mattermost-team-11.4.2-linux-arm64.tar.gz\" \
  -t ${CORE_IMAGE_NAME}:${IMMUTABLE_TAG} \
  ."

echo "Pushing Core Immutable Image to registry..."
ssh "${REMOTE_HOST}" "${REMOTE_ENV} && docker push ${CORE_IMAGE_NAME}:${IMMUTABLE_TAG}"

echo "Cleaning up Core build temporary files..."
ssh "${REMOTE_HOST}" "${REMOTE_ENV} && rm -rf ${CORE_BUILD_DIR}"

echo "🔍 Verifying Core Immutable Image..."
# Verify locally from the registry via exact Docker Registry V2 API path
curl -fsSI -H "Accept: application/vnd.docker.distribution.manifest.v2+json" "https://${REGISTRY}/v2/nexo/mattermost/manifests/${IMMUTABLE_TAG}" > /dev/null
# Verify remotely on the build host
ssh "${REMOTE_HOST}" "${REMOTE_ENV} && docker image inspect ${CORE_IMAGE_NAME}:${IMMUTABLE_TAG} --format '{{.Os}}/{{.Architecture}}' | grep -q 'linux/arm64'"

echo "🎯 Promoting Core Immutable Image to stable 'latest'..."
ssh "${REMOTE_HOST}" "${REMOTE_ENV} && docker tag ${CORE_IMAGE_NAME}:${IMMUTABLE_TAG} ${CORE_IMAGE_NAME}:latest && docker push ${CORE_IMAGE_NAME}:latest"
echo "✅ Core (Mattermost) Image published and verified successfully!"
echo ""

# ------------------------------------------------------------------------------------
# 2. Build, Publish and Verify Push-Proxy Image
# ------------------------------------------------------------------------------------
echo "📦 [2/2] Processing Push-Proxy Image..."
PUSH_PROXY_TAR="/tmp/push-proxy.tar.gz"
PUSH_PROXY_BUILD_DIR="/tmp/push-proxy-build"

echo "Archiving Push-Proxy source files locally..."
tar -czf "${PUSH_PROXY_TAR}" -C "${WORKSPACE_ROOT}/services/push-proxy" .

echo "Transferring Push-Proxy archive to remote..."
scp "${PUSH_PROXY_TAR}" "${REMOTE_HOST}:/tmp/push-proxy.tar.gz"
rm -f "${PUSH_PROXY_TAR}"

echo "Extracting Push-Proxy source on remote..."
ssh "${REMOTE_HOST}" "${REMOTE_ENV} && rm -rf ${PUSH_PROXY_BUILD_DIR} && mkdir -p ${PUSH_PROXY_BUILD_DIR} && tar -xzf /tmp/push-proxy.tar.gz -C ${PUSH_PROXY_BUILD_DIR}"

echo "Running Manual Dockerized Go Build on remote Mac (avoids Makefile Git and Shell dependency issues)..."
ssh "${REMOTE_HOST}" "${REMOTE_ENV} && cd ${PUSH_PROXY_BUILD_DIR} && docker run --rm \
  -v ${PUSH_PROXY_BUILD_DIR}:/app -w /app \
  golang:1.24.6-bookworm \
  /bin/sh -c \"mkdir -p /app/dist && CGO_ENABLED=0 GOOS=linux GOARCH=arm64 go build -trimpath -ldflags '-X github.com/mattermost/mattermost-push-proxy/internal/version.gitVersion=v11.4.2-arm64' -o /app/dist/mattermost-push-proxy ./main.go\""

echo "Structuring and Packaging Push-Proxy software on remote Mac..."
ssh "${REMOTE_HOST}" "${REMOTE_ENV} && cd ${PUSH_PROXY_BUILD_DIR} && \
  mkdir -p dist/mattermost-push-proxy-linux-arm64/bin && \
  mkdir -p dist/mattermost-push-proxy-linux-arm64/config && \
  mkdir -p dist/mattermost-push-proxy-linux-arm64/logs && \
  cp dist/mattermost-push-proxy dist/mattermost-push-proxy-linux-arm64/bin/mattermost-push-proxy && \
  cp -RL config/* dist/mattermost-push-proxy-linux-arm64/config/ && \
  cp LICENSE.txt NOTICE.txt README.md dist/mattermost-push-proxy-linux-arm64/ && \
  tar -czf dist/mattermost-push-proxy-linux-arm64.tar.gz -C dist mattermost-push-proxy-linux-arm64"

echo "Building Push-Proxy Immutable Image on remote Mac..."
ssh "${REMOTE_HOST}" "${REMOTE_ENV} && cd ${PUSH_PROXY_BUILD_DIR} && docker build --platform ${PLATFORM} \
  --build-arg TARGETARCH=arm64 \
  -f docker/Dockerfile \
  -t ${PUSH_PROXY_IMAGE_NAME}:${IMMUTABLE_TAG} \
  ."

echo "Pushing Push-Proxy Immutable Image to registry..."
ssh "${REMOTE_HOST}" "${REMOTE_ENV} && docker push ${PUSH_PROXY_IMAGE_NAME}:${IMMUTABLE_TAG}"

echo "Cleaning up Push-Proxy build temporary files..."
ssh "${REMOTE_HOST}" "${REMOTE_ENV} && rm -rf ${PUSH_PROXY_BUILD_DIR} && rm -f /tmp/push-proxy.tar.gz"

echo "🔍 Verifying Push-Proxy Immutable Image..."
# Verify locally from the registry via exact Docker Registry V2 API path
curl -fsSI -H "Accept: application/vnd.docker.distribution.manifest.v2+json" "https://${REGISTRY}/v2/nexo/push-proxy/manifests/${IMMUTABLE_TAG}" > /dev/null
# Verify remotely on the build host
ssh "${REMOTE_HOST}" "${REMOTE_ENV} && docker image inspect ${PUSH_PROXY_IMAGE_NAME}:${IMMUTABLE_TAG} --format '{{.Os}}/{{.Architecture}}' | grep -q 'linux/arm64'"

echo "🎯 Promoting Push-Proxy Immutable Image to stable 'latest'..."
ssh "${REMOTE_HOST}" "${REMOTE_ENV} && docker tag ${PUSH_PROXY_IMAGE_NAME}:${IMMUTABLE_TAG} ${PUSH_PROXY_IMAGE_NAME}:latest && docker push ${PUSH_PROXY_IMAGE_NAME}:latest"
echo "✅ Push-Proxy Image published and verified successfully!"
echo ""

echo "========================================================"
echo "🎉 All Nexo Runtime Images Verified and Published!"
echo "========================================================"