#!/usr/bin/env sh
# Resolve upstream before mirroring; never reuse a stale mutable mirror silently.
set -eu
REGISTRY="${REGISTRY:?REGISTRY required (git.shx.one/<owner>)}"
SOURCE="${BASE_NODE_SOURCE:-docker.io/library/node:22-alpine}"
PLATFORM="${MIRROR_PLATFORM:-linux/amd64}"
resolve_digest() {
  digest="$(docker buildx imagetools inspect "$1" | awk '/^Digest:/ {print $2; exit}')"
  printf '%s\n' "$digest" | grep -Eq '^sha256:[0-9a-f]{64}$' || { echo "Cannot resolve verified digest: $1" >&2; return 1; }
  printf '%s' "$digest"
}
source_digest="$(resolve_digest "$SOURCE")"
source_repo="${SOURCE%@*}"
# Tags may remain before @; repo:tag@digest is a valid immutable reference.
source_ref="$source_repo@$source_digest"
suffix="$(printf '%s' "${source_digest#sha256:}" | cut -c1-16)"
destination="$REGISTRY/evofw-buildcache:base-node-22-alpine-$suffix"
if ! docker buildx imagetools inspect "$destination" >/dev/null 2>&1; then
  attempt=0
  until docker buildx imagetools create --platform "$PLATFORM" --tag "$destination" "$source_ref"; do
    attempt=$((attempt + 1))
    [ "$attempt" -lt 4 ] || exit 1
    sleep 30
  done
fi
mirror_digest="$(resolve_digest "$destination")"
# Existing tags are untrusted: compare the selected platform descriptor against
# the immutable upstream index, even when no copy was necessary this run.
tmp="$(mktemp -d)"
trap 'rm -rf "$tmp"' EXIT HUP INT TERM
docker buildx imagetools inspect --raw "$source_ref" >"$tmp/source.json"
docker buildx imagetools inspect --raw "$destination@$mirror_digest" >"$tmp/mirror.json"
source_platform="$(node scripts/ci/manifest-platform.mjs "$tmp/source.json" "$source_digest" "$PLATFORM")"
mirror_platform="$(node scripts/ci/manifest-platform.mjs "$tmp/mirror.json" "$mirror_digest" "$PLATFORM")"
[ "$source_platform" = "$mirror_platform" ] || { echo 'Mirror platform digest differs from upstream; refusing existing tag' >&2; exit 1; }
reference="$destination@$mirror_digest"
printf 'BASE_NODE=%s\n' "$reference"
if [ -n "${MIRROR_ENV_FILE:-}" ]; then
  printf 'BASE_NODE=%s\n' "$reference" >"$MIRROR_ENV_FILE"
fi