#!/usr/bin/env bash
set -euo pipefail

ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
TARGET_IMAGE="${1:-geointel-ci:local}"
OUTPUT="${2:-artifacts/geointel-sbom.spdx.json}"
SYFT_IMAGE="anchore/syft:v1.44.0@sha256:86fde6445b483d902fe011dd9f68c4987dd94e07da1e9edc004e3c2422650de6"
SCANNER_ENGINE_ARGS=()

case "$OUTPUT" in
  /*|*..*)
    echo "SBOM output must be a repository-relative path without '..'." >&2
    exit 1
    ;;
esac

configure_scanner_engine() {
  local docker_host="${DOCKER_HOST:-}"
  if [[ "$docker_host" == tcp://* ]]; then
    local port="${docker_host##*:}"
    if ! [[ "$port" =~ ^[0-9]+$ ]] || (( port < 1 || port > 65535 )); then
      echo "Unsupported TCP Docker host for nested scanner: $docker_host" >&2
      exit 1
    fi
    SCANNER_ENGINE_ARGS=(
      --add-host host.docker.internal:host-gateway
      -e "DOCKER_HOST=tcp://host.docker.internal:${port}"
    )
  elif [[ -z "$docker_host" || "$docker_host" == unix:///var/run/docker.sock ]]; then
    SCANNER_ENGINE_ARGS=(-v /var/run/docker.sock:/var/run/docker.sock)
  else
    echo "Unsupported Docker host for nested scanner: $docker_host" >&2
    exit 1
  fi
}

docker image inspect "$TARGET_IMAGE" >/dev/null
mkdir -p "$ROOT/$(dirname "$OUTPUT")"
configure_scanner_engine

# Native/local runs use the normal Unix socket. Gitea jobs can target the
# isolated TCP DinD daemon; scanner containers then reach that same daemon via
# Docker's host-gateway alias instead of receiving the Unraid host socket.
docker run --rm \
  "${SCANNER_ENGINE_ARGS[@]}" \
  "$SYFT_IMAGE" \
  "$TARGET_IMAGE" \
  --from docker \
  -o spdx-json > "$ROOT/$OUTPUT"

test -s "$ROOT/$OUTPUT"
echo "SBOM written to $OUTPUT"