#!/usr/bin/env bash
# Uses the enclosing Forge runner's existing registry login. No credential reads.
set -euo pipefail
revision=${1:?full source revision required}
mode=${2:-legacy}
context=${3:-.}
[[ "$revision" =~ ^[a-f0-9]{40}$ ]] || { echo 'full immutable source revision required' >&2; exit 2; }
[[ "$mode" == legacy || "$mode" == paired ]] || { echo 'unknown publication mode' >&2; exit 2; }
short=${revision:0:7}
registry=forgejo.coulomb.social
legacy="$registry/coulomb/flex-auth"
renamed="$registry/coulomb/access-engine"
docker build -f "$context/Containerfile" --label "org.opencontainers.image.revision=$revision" -t "$legacy:main-$short" "$context"
images=("$legacy")
if [[ "$mode" == paired ]]; then
  docker tag "$legacy:main-$short" "$renamed:main-$short"
  images+=("$renamed")
fi
for image in "${images[@]}"; do
  docker tag "$image:main-$short" "$image:latest"
  docker push "$image:main-$short"
  docker push "$image:latest"
done
# Pull each published immutable tag through the runner's existing registry login.
# RepoDigests then records the registry's top-level digest, including OCI indexes
# and attestations; comparing a local image/config ID would not prove publication.
digests=()
for image in "${images[@]}"; do
  docker pull "$image:main-$short"
  # The existing container-build runner supplies Bash and Docker, not Python.
  # Capture inspect first so command failure is not hidden by process substitution.
  raw=$(docker image inspect --format '{{range .RepoDigests}}{{println .}}{{end}}' "$image:main-$short")
  digest=""
  matches=0
  while IFS= read -r reference; do
    if [[ "$reference" == "$image@"* ]]; then
      candidate=${reference#"$image@"}
      [[ "$candidate" =~ ^sha256:[a-f0-9]{64}$ ]] || { echo 'invalid published registry manifest digest' >&2; exit 1; }
      digest=$candidate
      matches=$((matches + 1))
    fi
  done <<< "$raw"
  [[ "$matches" == 1 ]] || { echo 'expected exactly one published repository digest' >&2; exit 1; }
  actual_revision=$(docker image inspect --format '{{index .Config.Labels "org.opencontainers.image.revision"}}' "$image:main-$short")
  [[ "$actual_revision" == "$revision" ]] || { echo 'published image revision differs from exact source' >&2; exit 1; }
  digests+=("$digest")
done
if [[ "$mode" == paired && "${digests[0]}" != "${digests[1]}" ]]; then
  echo 'published registry manifest digests differ' >&2; exit 1
fi
printf 'publication mode=%s revision=%s manifest_digest=%s verified_repositories=%s\n' "$mode" "$revision" "${digests[0]}" "${#images[@]}"