#!/bin/sh
# Build the production image on Cloud Build, for a machine that cannot build it
# locally.
#
# `ops/deploy/build-image.sh` builds and then *runs* the amd64 image to check
# that its packaged revision equals the Git SHA. On an Apple Silicon machine
# that run happens under amd64 emulation, and the Erlang VM cannot start there:
# it dies at kernel start with
#
#     failed_to_start_child,user,nouser
#
# reproducible on the bare `hexpm/elixir` base image, and unaffected by
# `-noinput` or `TERM=dumb`. So the local path cannot produce a production image
# on such a machine at all. Cloud Build workers are native amd64, so the same
# build and the same check run for real rather than emulated.
#
# The revision check is kept rather than dropped to get past the wall. An image
# whose packaged BuildInfo does not equal the exact Git SHA must not reach the
# registry, because the release path identifies what the fleet runs by that SHA.
#
# Usage: ops/deploy/build-image-cloud.sh <git-sha>
set -eu

sha=${1:-}
[ -n "$sha" ] || { echo "usage: $0 <git-sha>" >&2; exit 2; }

script_dir=$(CDPATH= cd -- "$(dirname -- "$0")" && pwd)
repo_root=$(CDPATH= cd -- "$script_dir/../.." && pwd)

project=${OPENAGENTS_BUILD_PROJECT:-openagentsgemini}
service_account=${OPENAGENTS_BUILD_SERVICE_ACCOUNT:-projects/openagentsgemini/serviceAccounts/oa-mvp-automation@openagentsgemini.iam.gserviceaccount.com}
image=${OPENAGENTS_IMAGE_REPOSITORY:-us-central1-docker.pkg.dev/openagents-staging-20260820/openagents-staging/openagents}

# The checks below exist because skipping them cost a real deploy.
#
# The first attempt at this ran `gcloud builds submit .` after a `cd` that had
# silently failed, so it uploaded a *different* checkout — one commit behind,
# with untracked files — and tagged the result with the SHA that was asked for.
# The packaged-revision check did not catch it: the revision is passed in as a
# build argument, so it reported the SHA it was told regardless of the source.
# The registry has tag immutability, so that tag could not be corrected and the
# SHA is unusable forever.
#
# A build argument can only ever confirm what it was handed. What the source
# actually is has to be checked here, before a build is spent on it.

head=$(git -C "$repo_root" rev-parse HEAD)
if [ "$head" != "$sha" ]; then
    echo "refusing: $repo_root is at $head, not $sha" >&2
    echo "  Build from a worktree checked out at the exact revision:" >&2
    echo "    git worktree add --detach <path> $sha" >&2
    exit 1
fi

dirty=$(git -C "$repo_root" status --porcelain --untracked-files=all |
    grep -v '^?? \.gcloudignore$' || true)
if [ -n "$dirty" ]; then
    echo "refusing: the worktree is not clean, so the image would not be $sha" >&2
    echo "$dirty" >&2
    exit 1
fi

# A tag in this repository cannot be moved, so a wrong image is permanent.
# Refuse before building rather than discovering it at push time.
existing=$(gcloud artifacts docker images describe "$image:$sha" \
    --format='value(image_summary.digest)' 2>/dev/null || true)
if [ -n "$existing" ]; then
    echo "refusing: $image:$sha already exists ($existing)" >&2
    echo "  Tags here are immutable. If that image is wrong, it cannot be" >&2
    echo "  replaced -- land another commit and build that SHA instead." >&2
    exit 1
fi

release_version=$(tr -d '\n' <"$repo_root/VERSION")
source_date_epoch=$(git -C "$repo_root" show -s --format=%ct "$sha")

# Keep the upload to the sources the Dockerfile copies.
cat >"$repo_root/.gcloudignore" <<'IGNORE'
.git
.gcloudignore
deps
_build
node_modules
assets/node_modules
erl_crash.dump
IGNORE

config=$(mktemp /tmp/openagents-cloudbuild.XXXXXX.yaml)
trap 'rm -f "$config"' EXIT INT TERM

cat >"$config" <<'BUILD'
steps:
  - id: build
    name: gcr.io/cloud-builders/docker
    args:
      - build
      - --build-arg
      - OPENAGENTS_BUILD_REVISION=${_SHA}
      - --build-arg
      - OPENAGENTS_RELEASE_VSN=${_RELEASE_VSN}
      - --build-arg
      - SOURCE_DATE_EPOCH=${_SOURCE_DATE_EPOCH}
      - --label
      - org.opencontainers.image.revision=${_SHA}
      - --tag
      - ${_IMAGE}:${_SHA}
      - --target
      - final
      - .

  # The assertion ops/deploy/build-image.sh makes locally. The erl invocation
  # lives in a file so its quoting survives YAML and two shells.
  - id: verify-revision
    name: gcr.io/cloud-builders/docker
    entrypoint: bash
    args:
      - -c
      - |
        set -eu
        cat > /workspace/packaged-revision.sh <<'CHECK'
        release_version=$$(awk '{print $$2}' /app/releases/start_erl.data)
        exec /app/erts-*/bin/erl \
          -boot_var RELEASE_LIB /app/lib \
          -boot "/app/releases/$$release_version/start_clean" \
          -noshell \
          -pa /app/lib/openagents-*/ebin \
          -eval "io:put_chars('Elixir.OpenAgents.BuildInfo':revision()), halt()."
        CHECK
        packaged=$$(docker run --rm \
          -v /workspace:/workspace \
          --entrypoint /bin/sh \
          "${_IMAGE}:${_SHA}" /workspace/packaged-revision.sh | tail -n 1)
        if [ "$$packaged" != "${_SHA}" ]; then
          echo "packaged BuildInfo revision '$$packaged' does not match the Git SHA '${_SHA}'" >&2
          exit 1
        fi
        echo "packaged revision matches: $$packaged"

images:
  - ${_IMAGE}:${_SHA}

options:
  machineType: E2_HIGHCPU_8
  logging: CLOUD_LOGGING_ONLY

timeout: 3600s
BUILD

echo "==> building $sha on Cloud Build (project $project)"
gcloud builds submit "$repo_root" \
    --project "$project" \
    --service-account "$service_account" \
    --config "$config" \
    --substitutions "_SHA=$sha,_RELEASE_VSN=$release_version,_SOURCE_DATE_EPOCH=$source_date_epoch,_IMAGE=$image"

rm -f "$repo_root/.gcloudignore"
echo "Built and pushed $image:$sha"