#!/usr/bin/env bash
set -euo pipefail

root=$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)
cd "$root"

tag=${IMAGE_TAG:-}
registry=${AI_GATEWAY_IMAGE_REGISTRY:-registry.cn-shanghai.aliyuncs.com/easyaigc}
builder=${AI_GATEWAY_BUILDX_BUILDER:-easyai-gateway-ci}
cache_limit=${AI_GATEWAY_BUILDX_CACHE_LIMIT:-2gb}
platform=${AI_GATEWAY_PLATFORM:-linux/amd64}

if [[ ! $tag =~ ^[0-9a-f]{40}$ ]]; then
  echo 'IMAGE_TAG must be a full lowercase Git SHA' >&2
  exit 1
fi
if [[ ! $registry =~ ^[A-Za-z0-9.-]+(:[0-9]+)?(/[A-Za-z0-9._/-]+)+$ ]]; then
  echo 'AI_GATEWAY_IMAGE_REGISTRY has an invalid format' >&2
  exit 1
fi

if ! docker buildx inspect "$builder" >/dev/null 2>&1; then
  docker buildx create --name "$builder" --driver docker-container --use >/dev/null
fi
docker buildx inspect "$builder" --bootstrap >/dev/null

cleanup_cache() {
  docker buildx prune --builder "$builder" --force --max-used-space "$cache_limit" >/dev/null || true
}
trap cleanup_cache EXIT HUP INT TERM

api_image="$registry/ai-gateway:$tag"
web_image="$registry/ai-gateway-web:$tag"
common_args=(
  --builder "$builder"
  --platform "$platform"
  --file Dockerfile
  --pull
  --load
)

docker buildx build --builder "$builder" \
  "${common_args[@]:2}" \
  --target api \
  --build-arg "GO_BUILD_IMAGE=${AI_GATEWAY_GO_BUILD_IMAGE:-docker.m.daocloud.io/library/golang:1.26.5-alpine}" \
  --build-arg "API_RUNTIME_IMAGE=${AI_GATEWAY_API_RUNTIME_IMAGE:-docker.m.daocloud.io/library/alpine:3.22}" \
  --tag "$api_image" .

docker buildx build --builder "$builder" \
  "${common_args[@]:2}" \
  --target web \
  --build-arg "NODE_BUILD_IMAGE=${AI_GATEWAY_NODE_BUILD_IMAGE:-docker.m.daocloud.io/library/node:24-alpine}" \
  --build-arg "WEB_RUNTIME_IMAGE=${AI_GATEWAY_WEB_RUNTIME_IMAGE:-docker.m.daocloud.io/library/nginx:1.27-alpine}" \
  --tag "$web_image" .

for image in "$api_image" "$web_image"; do
  trivy image --scanners vuln,secret --severity HIGH,CRITICAL --ignore-unfixed \
    --exit-code 1 --timeout 15m "$image"
done

printf 'gateway_images=PASS git_sha=%s api=%s web=%s\n' "$tag" "$api_image" "$web_image"