# Force-rebuild the conformance Docker image and upload it to S3 under the
# current Dockerfile-content hash. Use when the cached image needs refresh
# without a Dockerfile change (base-image CVE pickup, host docker upgrade,
# corrupted upload). Auto-submit is disabled — invoke manually:
#
#   hut --instance srht.bigb.es builds submit .builds/conformance-image-rebuild.yml
#
# Normal CI uses .builds/conformance.yml, which lazy-fills the same S3 key
# on the first push after a Dockerfile change.
image: ubuntu/noble
packages:
  - curl
  - ca-certificates
  - docker.io
  - awscli
  - zstd
secrets:
  - a42011da-a362-40da-9db6-1bf1f9be8be3   # ~/.s3-cache-key-id
  - c0cf5f2d-5d63-4d50-a324-5eaecaa992dd   # ~/.s3-cache-key-secret
sources:
  - https://git.srht.bigb.es/~bigbes/tarantool-protobuf
environment:
  AWS_DEFAULT_REGION: garage
  AWS_ENDPOINT_URL: https://s3.bigb.es
  S3_BUCKET: docker-cache
  S3_PREFIX: tarantool-protobuf/conformance-images
submitter:
  git.sr.ht:
    enabled: false
    allow-refs: []
tasks:
  - aws_credentials: |
      mkdir -p ~/.aws
      cat > ~/.aws/config <<EOF
      [default]
      region = $AWS_DEFAULT_REGION
      s3 =
          addressing_style = path
          signature_version = s3v4
      EOF
      set +x
      export AWS_ACCESS_KEY_ID=$(cat ~/.s3-cache-key-id)
      export AWS_SECRET_ACCESS_KEY=$(cat ~/.s3-cache-key-secret)
      {
        printf 'export AWS_ACCESS_KEY_ID=%q\n'     "$AWS_ACCESS_KEY_ID"
        printf 'export AWS_SECRET_ACCESS_KEY=%q\n' "$AWS_SECRET_ACCESS_KEY"
      } >> ~/.buildenv
      set -x
  - docker_start: |
      sudo systemctl start docker
      sudo usermod -aG docker build
      sudo chmod 666 /var/run/docker.sock
      docker version
  - rebuild: |
      cd tarantool-protobuf
      HASH=$(sha256sum docker/conformance.Dockerfile | cut -c1-16)
      OBJECT_KEY="$S3_PREFIX/$HASH.tar.zst"
      S3_URI="s3://$S3_BUCKET/$OBJECT_KEY"
      echo "Image hash: $HASH"
      echo "S3 URI:     $S3_URI"
      docker build --no-cache --pull \
        -t tarantool-protobuf-conformance:latest \
        -f docker/conformance.Dockerfile docker/
      docker save tarantool-protobuf-conformance:latest \
        | zstd -T0 -3 \
        | aws --endpoint-url="$AWS_ENDPOINT_URL" s3 cp - "$S3_URI"
      aws --endpoint-url="$AWS_ENDPOINT_URL" s3api head-object \
        --bucket "$S3_BUCKET" --key "$OBJECT_KEY"