#!/usr/bin/env bash
# Run the upstream wrapper with a persistent cache and read-only build credentials.
set -euo pipefail
mode=$1
shift
root=$(git rev-parse --show-toplevel)
git_common=$(git rev-parse --path-format=absolute --git-common-dir)
image=${WOLFSKIN_BUILD_IMAGE:-wolfskin-build:sdk37-jdk21}
cache=${WOLFSKIN_GRADLE_VOLUME:-wolfskin-gradle}
secrets=${WOLFSKIN_SECRETS_DIR:-/opt/stacks/ventoy/machine-parity/manifest-tank/secrets/wolfskin}
lock=${WOLFSKIN_GRADLE_LOCK_FILE:-/var/tmp/${cache}.gradle.lock}
exec {lock_fd}>"$lock"
if ! flock --exclusive --nonblock "$lock_fd"; then
    printf 'Waiting for Gradle cache lock: %s\n' "$lock" >&2
    flock --exclusive "$lock_fd"
fi
arguments=(--rm --platform linux/amd64 --user "$(id -u):$(id -g)"
    --mount "type=bind,src=$root,dst=$root" --workdir "$root"
    --mount "type=volume,src=$cache,dst=/gradle"
    --mount "type=bind,src=$git_common,dst=$git_common,readonly")
gradle_arguments=(--no-daemon --console=plain --max-workers=4)
if [[ $mode == release ]]; then
    for name in release.jks release.properties github-packages-token; do
        if [[ ! -s $secrets/$name ]]; then
            printf 'Missing build credential: %s/%s\n' "$secrets" "$name" >&2
            exit 1
        fi
    done
    arguments+=(--mount "type=bind,src=$secrets,dst=/run/wolfskin,readonly"
        --mount "type=bind,src=$root/docker/release-signing.properties,dst=$root/local.properties,readonly")
    gradle_arguments+=(--init-script /opt/wolfskin/signing.init.gradle)
    docker run "${arguments[@]}" "$image" bash -euc '
        export ORG_GRADLE_PROJECT_WholphinExtensionsUsername=JustinZeus
        export ORG_GRADLE_PROJECT_WholphinExtensionsPassword=$(cat /run/wolfskin/github-packages-token)
        exec ./gradlew "$@"
    ' bash "${gradle_arguments[@]}" "$@"
else
    docker run "${arguments[@]}" "$image" ./gradlew "${gradle_arguments[@]}" "$@"
fi