#!/usr/bin/env bash
# Uses the enclosing Forge runner's existing registry login. No credential reads.
set -euo pipefail
revision=${1:?full source revision required}
mode=${2:-legacy}
context=${3:-.}
[[ "$revision" =~ ^[a-f0-9]{40}$ ]] || { echo 'full immutable source revision required' >&2; exit 2; }
[[ "$mode" == legacy || "$mode" == paired ]] || { echo 'unknown publication mode' >&2; exit 2; }
short=${revision:0:7}
registry=forgejo.coulomb.social
legacy="$registry/coulomb/flex-auth"
renamed="$registry/coulomb/access-engine"
docker build -f "$context/Containerfile" --label "org.opencontainers.image.revision=$revision" -t "$legacy:main-$short" "$context"
images=("$legacy")
if [[ "$mode" == paired ]]; then
  docker tag "$legacy:main-$short" "$renamed:main-$short"
  images+=("$renamed")
fi
for image in "${images[@]}"; do
  docker tag "$image:main-$short" "$image:latest"
  docker push "$image:main-$short"
  docker push "$image:latest"
done
# Pull each published immutable tag through the runner's existing registry login.
# RepoDigests then records the registry's top-level digest, including OCI indexes
# and attestations; comparing a local image/config ID would not prove publication.
digests=()
for image in "${images[@]}"; do
  docker pull "$image:main-$short"
  raw=$(docker image inspect --format '{{json .RepoDigests}}' "$image:main-$short")
  digest=$(printf '%s' "$raw" | python3 -c 'import json,re,sys; x=json.load(sys.stdin); assert isinstance(x,list); matches=[v.removeprefix(sys.argv[1]+"@") for v in x if isinstance(v,str) and v.startswith(sys.argv[1]+"@")]; assert len(matches)==1 and re.fullmatch(r"sha256:[a-f0-9]{64}",matches[0]); print(matches[0])' "$image")
  digests+=("$digest")
done
if [[ "$mode" == paired && "${digests[0]}" != "${digests[1]}" ]]; then
  echo 'published registry manifest digests differ' >&2; exit 1
fi
printf 'publication mode=%s revision=%s manifest_digest=%s verified_repositories=%s\n' "$mode" "$revision" "${digests[0]}" "${#images[@]}"