# Force-rebuild the conformance Docker image and upload it to S3 under the
# current Dockerfile-content hash. Use when the cached image needs refresh
# without a Dockerfile change (base-image CVE pickup, host docker upgrade,
# corrupted upload). Auto-submit is disabled — invoke manually:
#
#   hut --instance srht.bigb.es builds submit .builds/conformance-image-rebuild.yml
#
# Normal CI uses .builds/conformance.yml, which lazy-fills the same S3 key
# on the first push after a Dockerfile change.
image: ubuntu/noble
packages:
  - curl
  - ca-certificates
  - docker.io
  - unzip
  - zstd
secrets:
  - 7dde4219-0783-4581-a67d-c94749de3600   # ~/.s3-cache-key-id
  - 0e5b3530-6f19-4f30-9b73-9339dd382e46   # ~/.s3-cache-key-secret
sources:
  - https://git.srht.bigb.es/~bigbes/tarantool-protobuf
environment:
  AWS_DEFAULT_REGION: garage
  AWS_ENDPOINT_URL: https://s3.bigb.es
  S3_BUCKET: docker-cache
  S3_PREFIX: tarantool-protobuf/conformance-images
submitter:
  git.sr.ht:
    enabled: false
    allow-refs: []
tasks:
  - install_awscli: |
      curl -sSL "https://awscli.amazonaws.com/awscli-exe-linux-x86_64.zip" \
        -o /tmp/awscliv2.zip
      unzip -q /tmp/awscliv2.zip -d /tmp
      sudo /tmp/aws/install
      aws --version
  - aws_credentials: |
      mkdir -p ~/.aws
      cat > ~/.aws/config <<EOF
      [default]
      region = $AWS_DEFAULT_REGION
      s3 =
          addressing_style = path
          signature_version = s3v4
      EOF
      echo 'export AWS_REQUEST_CHECKSUM_CALCULATION=when_required'  >> ~/.buildenv
      echo 'export AWS_RESPONSE_CHECKSUM_VALIDATION=when_required' >> ~/.buildenv
      set +x
      export AWS_ACCESS_KEY_ID=$(tr -d '[:space:]' < ~/.s3-cache-key-id)
      export AWS_SECRET_ACCESS_KEY=$(tr -d '[:space:]' < ~/.s3-cache-key-secret)
      {
        printf 'export AWS_ACCESS_KEY_ID=%q\n'     "$AWS_ACCESS_KEY_ID"
        printf 'export AWS_SECRET_ACCESS_KEY=%q\n' "$AWS_SECRET_ACCESS_KEY"
      } >> ~/.buildenv
      echo "key_id_len=${#AWS_ACCESS_KEY_ID} key_id_prefix=${AWS_ACCESS_KEY_ID:0:2}"
      echo "secret_len=${#AWS_SECRET_ACCESS_KEY}"
      set -x
  - docker_start: |
      sudo systemctl start docker
      sudo usermod -aG docker build
      sudo chmod 666 /var/run/docker.sock
      docker version
  - rebuild: |
      cd tarantool-protobuf
      HASH=$(sha256sum docker/conformance.Dockerfile | cut -c1-16)
      OBJECT_KEY="$S3_PREFIX/$HASH.tar.zst"
      S3_URI="s3://$S3_BUCKET/$OBJECT_KEY"
      echo "Image hash: $HASH"
      echo "S3 URI:     $S3_URI"
      docker build --no-cache --pull \
        -t tarantool-protobuf-conformance:latest \
        -f docker/conformance.Dockerfile docker/
      docker save tarantool-protobuf-conformance:latest \
        | zstd -T0 -3 \
        | aws --endpoint-url="$AWS_ENDPOINT_URL" s3 cp - "$S3_URI"
      aws --endpoint-url="$AWS_ENDPOINT_URL" s3api head-object \
        --bucket "$S3_BUCKET" --key "$OBJECT_KEY"