#!/usr/bin/env bash
set -euo pipefail
here=$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")" && pwd)
work=${RTC_BUILD_DIR:-"$HOME/.cache/pi-work/matrix-rtc-policy/build"}
mkdir -p "$work"
revision=0e176b1eca44e67b11484d0bdf56999807bf2b8e
source_sha=32f4d1b31c39689c7b8100c1567eacc646763c96c1054513115ae59cd9efabb9
patch_sha=6e21c58c02d68e45c12f053a70001954022b88551a8e3afa620c61c1e0a94791
image=iscg/lk-jwt-service:0.9.0-policy1-${patch_sha:0:12}
if [ ! -f "$work/upstream.tar.gz" ]; then
  curl -fL --retry 3 "https://codeload.github.com/element-hq/lk-jwt-service/tar.gz/$revision" -o "$work/upstream.tar.gz"
fi
printf '%s  %s\n' "$source_sha" "$work/upstream.tar.gz" "$patch_sha" "$here/standalone-publication.patch" | sha256sum -c -
# Fresh context, never build against an unreviewed/dirty upstream checkout.
context=$(mktemp -d "$work/context.XXXXXX")
mkdir "$context/source"
tar -xzf "$work/upstream.tar.gz" --strip-components=1 -C "$context/source"
(cd "$context/source" && patch --batch --fuzz=0 -p1 < "$here/standalone-publication.patch")
cp "$here/Dockerfile" "$context/Dockerfile"
# BuildKit may require separate routing on this host. The legacy builder uses
# Docker's configured bridge egress; build/test containers never mount secrets.
DOCKER_BUILDKIT=0 docker build --network host --memory=3g --memory-swap=4g --cpu-shares=256 -t "$image" "$context"
printf 'Built and test-gated: %s\n' "$image"
docker image inspect "$image" --format '{{.Id}}'
# Context is deliberately kept for audit/retries. Remove only this task's cache
# manually after preserving the release image/source receipt.