#!/usr/bin/env bash
set -euo pipefail

ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
TARGET_IMAGE="${1:-geointel-ci:local}"
OUTPUT="${2:-artifacts/geointel-sbom.spdx.json}"
IMAGE_ARCHIVE="${GEOINTEL_IMAGE_ARCHIVE:-artifacts/geointel-image.tar}"
ARCHIVE_ID_FILE="${IMAGE_ARCHIVE}.image-id"
KEEP_ARCHIVE="${GEOINTEL_KEEP_IMAGE_ARCHIVE:-false}"
SYFT_IMAGE="anchore/syft:v1.44.0@sha256:86fde6445b483d902fe011dd9f68c4987dd94e07da1e9edc004e3c2422650de6"
ARCHIVE_CREATED=false
PARTIAL_ARCHIVE=""

cleanup() {
  if [ -n "$PARTIAL_ARCHIVE" ]; then
    rm -f -- "$PARTIAL_ARCHIVE"
  fi
  if [ "$ARCHIVE_CREATED" = true ] && [ "$KEEP_ARCHIVE" != true ]; then
    rm -f -- "$ROOT/$IMAGE_ARCHIVE" "$ROOT/$ARCHIVE_ID_FILE"
  fi
}
trap cleanup EXIT

for candidate in "$OUTPUT" "$IMAGE_ARCHIVE"; do
  case "$candidate" in
    /*|*..*)
      echo "SBOM paths must be repository-relative and may not contain '..'." >&2
      exit 1
      ;;
  esac
done

IMAGE_ID="$(docker image inspect --format '{{.Id}}' "$TARGET_IMAGE")"
test -n "$IMAGE_ID"
mkdir -p "$ROOT/$(dirname "$OUTPUT")" "$ROOT/$(dirname "$IMAGE_ARCHIVE")"

ARCHIVE_ID=""
if [ -s "$ROOT/$ARCHIVE_ID_FILE" ]; then
  ARCHIVE_ID="$(tr -d '[:space:]' < "$ROOT/$ARCHIVE_ID_FILE")"
fi
if [ ! -s "$ROOT/$IMAGE_ARCHIVE" ] || [ "$ARCHIVE_ID" != "$IMAGE_ID" ]; then
  rm -f -- "$ROOT/$IMAGE_ARCHIVE" "$ROOT/$ARCHIVE_ID_FILE"
  PARTIAL_ARCHIVE="$ROOT/${IMAGE_ARCHIVE}.partial.$$"
  docker save "$IMAGE_ID" --output "$PARTIAL_ARCHIVE"
  mv "$PARTIAL_ARCHIVE" "$ROOT/$IMAGE_ARCHIVE"
  PARTIAL_ARCHIVE=""
  printf '%s\n' "$IMAGE_ID" > "$ROOT/$ARCHIVE_ID_FILE"
  ARCHIVE_CREATED=true
fi

WORKDIR="/workspace"
WORKSPACE_ARGS=(-v "$ROOT:/workspace")
if [[ -n "${HOSTNAME:-}" ]] && docker inspect --type container "$HOSTNAME" >/dev/null 2>&1; then
  # The Gitea job runs against TCP DinD. Reusing its workspace mounts keeps
  # the archive inside the job boundary and avoids a privileged Docker API hop.
  WORKDIR="$ROOT"
  WORKSPACE_ARGS=(--volumes-from "$HOSTNAME")
fi

# CUDA and PyTorch ship several gigabytes of native binaries. Keep Syft's Go
# heap below the isolated runner's 8 GiB limit and collect garbage proactively;
# otherwise the Docker-in-Docker job can be OOM-killed even with one cataloger
# worker. Authoritative dpkg, Python, npm and other installed-package catalogers
# remain enabled; Trivy still scans the complete immutable archive independently.
docker run --rm \
  --user 0:0 \
  -e "SYFT_PARALLELISM=${SYFT_PARALLELISM:-1}" \
  -e "GOMEMLIMIT=${SYFT_GOMEMLIMIT:-4GiB}" \
  -e "GOGC=${SYFT_GOGC:-25}" \
  "${WORKSPACE_ARGS[@]}" \
  -w "$WORKDIR" \
  "$SYFT_IMAGE" \
  "docker-archive:$WORKDIR/$IMAGE_ARCHIVE" \
  --select-catalogers=-binary \
  -o "spdx-json=$OUTPUT"

test -s "$ROOT/$OUTPUT"
echo "SBOM written to $OUTPUT for $IMAGE_ID"