#!/usr/bin/env bash
# Run the upstream wrapper with a persistent cache and read-only build credentials.
set -euo pipefail
mode=$1
shift
root=$(git rev-parse --show-toplevel)
git_common=$(git rev-parse --path-format=absolute --git-common-dir)
image=${WOLFSKIN_BUILD_IMAGE:-wolfskin-build:sdk37-jdk21}
cache=${WOLFSKIN_GRADLE_VOLUME:-wolfskin-gradle}
secrets=${WOLFSKIN_SECRETS_DIR:-/opt/stacks/ventoy/machine-parity/manifest-tank/secrets/wolfskin}
lock=${WOLFSKIN_GRADLE_LOCK_FILE:-/var/tmp/${cache}.gradle.lock}
exec {lock_fd}>"$lock"
if ! flock --exclusive --nonblock "$lock_fd"; then
    printf 'Waiting for Gradle cache lock: %s\n' "$lock" >&2
    flock --exclusive "$lock_fd"
fi
arguments=(--rm --platform linux/amd64 --user "$(id -u):$(id -g)"
    --mount "type=bind,src=$root,dst=$root" --workdir "$root"
    --mount "type=volume,src=$cache,dst=/gradle"
    --mount "type=bind,src=$git_common,dst=$git_common,readonly")
gradle_arguments=(--no-daemon --console=plain --max-workers=4)
if [[ $mode == release ]]; then
    for name in release.jks release.properties github-packages-token; do
        if [[ ! -s $secrets/$name ]]; then
            printf 'Missing build credential: %s/%s\n' "$secrets" "$name" >&2
            exit 1
        fi
    done
    arguments+=(--mount "type=bind,src=$secrets,dst=/run/wolfskin,readonly"
        --mount "type=bind,src=$root/docker/release-signing.properties,dst=$root/local.properties,readonly")
    gradle_arguments+=(--init-script /opt/wolfskin/signing.init.gradle)
    docker run "${arguments[@]}" "$image" bash -euc '
        export ORG_GRADLE_PROJECT_WholphinExtensionsUsername=JustinZeus
        export ORG_GRADLE_PROJECT_WholphinExtensionsPassword=$(cat /run/wolfskin/github-packages-token)
        exec ./gradlew "$@"
    ' bash "${gradle_arguments[@]}" "$@"
else
    debug_keystore=$(realpath -m "${WOLFSKIN_DEBUG_KEYSTORE:-/root/.treehouse/firstmate-7bab20/2/firstmate/data/signing/debug.keystore}")
    case "$debug_keystore" in
        "$root"|"$root"/*)
            printf 'Debug keystore must be outside the checkout: %s\n' "$debug_keystore" >&2
            exit 1
            ;;
    esac
    signing_directory=$(dirname "$debug_keystore")
    mkdir -p "$signing_directory"
    chmod 700 "$signing_directory"
    if [[ ! -e $debug_keystore ]]; then
        temporary_directory=$(mktemp -d "$signing_directory/.debug-keystore.XXXXXX")
        trap 'rm -rf -- "$temporary_directory"' EXIT
        if ! docker run --rm --platform linux/amd64 --user "$(id -u):$(id -g)" \
            --mount "type=bind,src=$temporary_directory,dst=/run/signing" \
            "$image" keytool -genkeypair -noprompt -keystore /run/signing/debug.keystore \
            -storetype JKS -storepass android -keypass android -alias androiddebugkey \
            -keyalg RSA -keysize 2048 -validity 10000 -dname "CN=Android Debug"; then
            printf 'Failed to generate persistent debug keystore: %s\n' "$debug_keystore" >&2
            exit 1
        fi
        chmod 600 "$temporary_directory/debug.keystore"
        mv "$temporary_directory/debug.keystore" "$debug_keystore"
    fi
    if [[ ! -s $debug_keystore ]]; then
        printf 'Missing or empty persistent debug keystore: %s\n' "$debug_keystore" >&2
        exit 1
    fi
    chmod 600 "$debug_keystore"
    arguments+=(--env ANDROID_USER_HOME=/tmp/.android
        --mount "type=bind,src=$debug_keystore,dst=/tmp/.android/debug.keystore,readonly")
    docker run "${arguments[@]}" "$image" ./gradlew "${gradle_arguments[@]}" "$@"
fi