#!/usr/bin/env bash
# Baut das Multi-Arch-Image (amd64 + arm64) und schiebt es in die
# Container-Registry (Zot).
#
#   cp deploy/.env.example deploy/.env && $EDITOR deploy/.env   # einmalig: REGISTRY_PASSWORD
#   deploy/push-image.sh                # Tag aus `git describe`
#   LATEST=1 deploy/push-image.sh       # zusätzlich :latest setzen (nur für Releases)
#
# Ergebnis: ${REGISTRY}/${IMAGE_NAME}:<version> (und ggf. :latest)
set -euo pipefail

cd "$(dirname "$0")/.."
ENV_FILE="${ENV_FILE:-deploy/.env}"
if [ -f "$ENV_FILE" ]; then
	set -a
	# shellcheck disable=SC1090
	. "$ENV_FILE"
	set +a
fi

REGISTRY="${REGISTRY:-zot.chmln.de}"
REGISTRY_USER="${REGISTRY_USER:-sultan}"
IMAGE_NAME="${IMAGE_NAME:-sultan}"
IMAGE="${REGISTRY}/${IMAGE_NAME}"
VERSION="${VERSION:-$(git describe --tags --always --dirty)}"
PLATFORMS="${PLATFORMS:-linux/amd64,linux/arm64}"

if [ -z "${REGISTRY_PASSWORD:-}" ]; then
	echo "REGISTRY_PASSWORD fehlt – in ${ENV_FILE} setzen (Vorlage: deploy/.env.example)." >&2
	exit 1
fi

case "$VERSION" in
*-dirty)
	echo "Arbeitsverzeichnis hat uncommittete Änderungen (${VERSION}) – erst committen." >&2
	exit 1
	;;
esac

printf '%s' "$REGISTRY_PASSWORD" | docker login "$REGISTRY" -u "$REGISTRY_USER" --password-stdin

tags=(-t "${IMAGE}:${VERSION}")
if [ "${LATEST:-0}" = 1 ]; then
	tags+=(-t "${IMAGE}:latest")
fi

# Multi-Arch-Builds brauchen einen buildx-Builder mit docker-container-Treiber.
if ! docker buildx inspect sultan-builder >/dev/null 2>&1; then
	docker buildx create --name sultan-builder --driver docker-container >/dev/null
fi

docker buildx build --builder sultan-builder \
	--platform "$PLATFORMS" \
	--build-arg VERSION="$VERSION" \
	"${tags[@]}" \
	--push .

echo "==> gepusht: ${IMAGE}:${VERSION}"
docker buildx imagetools inspect "${IMAGE}:${VERSION}" | head -n 3