#!/usr/bin/env bash
set -euo pipefail

ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
CONTAINER="geointel-lockgen-$$"
PYTHON_IMAGE="python:3.11-bookworm@sha256:5c34b355088846dddc8afb7442c20b9433dccdc8d66192dc52c616adeaa106a3"
PIP_TOOLS_VERSION="7.5.3"

cleanup() {
  docker rm -f "$CONTAINER" >/dev/null 2>&1 || true
}
trap cleanup EXIT

command -v docker >/dev/null 2>&1 || {
  echo "Docker is required to generate the Linux Python lock." >&2
  exit 1
}

docker run -d \
  --name "$CONTAINER" \
  -v "$ROOT:/workspace" \
  -w /workspace/backend \
  "$PYTHON_IMAGE" \
  sleep infinity >/dev/null

docker exec "$CONTAINER" \
  python -m pip install --disable-pip-version-check "pip-tools==$PIP_TOOLS_VERSION"
docker exec "$CONTAINER" \
  python -m piptools compile pyproject.toml \
    --extra gis \
    --output-file requirements-runtime.lock \
    --strip-extras \
    --generate-hashes \
    --quiet
docker exec "$CONTAINER" \
  python -m piptools compile pyproject.toml \
    --extra gis \
    --extra dev \
    --output-file requirements-ci.lock \
    --strip-extras \
    --generate-hashes \
    --quiet
docker exec "$CONTAINER" \
  python /workspace/scripts/verify_python_lock.py --stamp

echo "Generated runtime and CI locks in pinned Linux/Python 3.11."