#!/bin/sh
# Run only on the designated remote CI host, never on the developer's machine.
set -eu
cd "$(CDPATH= cd -- "$(dirname -- "$0")/.." && pwd)"

release_sha=${ASTER_RELEASE_SHA:?ASTER_RELEASE_SHA is required}
case "$release_sha" in *[!0-9a-f]*|'') echo "Invalid release SHA" >&2; exit 1;; esac
test "${#release_sha}" -eq 40

ci_id="${GITHUB_RUN_ID:-manual}-$$"
network="endorphin-aster-vm-ci-$ci_id"
postgres="endorphin-aster-vm-ci-pg-$ci_id"
checks="endorphin-aster-vm-ci-checks-$ci_id"
image="endorphin-aster-vm-ci:$release_sha"
cleanup() {
    docker rm -f "$checks" "$postgres" >/dev/null 2>&1 || true
    docker network rm "$network" >/dev/null 2>&1 || true
}
trap cleanup EXIT
trap 'exit 130' INT
trap 'exit 143' TERM

docker build --target ci -t "$image" .
docker network create "$network" >/dev/null
# Disposable test database: no production mounts and no published ports.
docker run -d --name "$postgres" --network "$network" --network-alias postgres \
    --env POSTGRES_USER=aster --env POSTGRES_DB=aster \
    --env POSTGRES_PASSWORD=aster-ci-only \
    --tmpfs /var/lib/postgresql/data postgres:17-bookworm >/dev/null

ready=false
for attempt in $(seq 1 60); do
    if docker exec "$postgres" pg_isready -h 127.0.0.1 -U aster -d aster >/dev/null 2>&1; then
        ready=true
        break
    fi
    sleep 1
done
if [ "$ready" != true ]; then
    echo "CI PostgreSQL did not become ready" >&2
    exit 1
fi

docker run --name "$checks" --init --network "$network" \
    --mount type=volume,src=endorphin-aster-vm-ci-cargo,dst=/usr/local/cargo/registry \
    --mount type=volume,src=endorphin-aster-vm-ci-target,dst=/build/target \
    --env ASTER_TEST_POSTGRES_URL='postgres://aster:aster-ci-only@postgres:5432/aster?sslmode=disable' \
    "$image" sh -eu -c '
        sh scripts/check.sh
        cargo test -p aster-storage --test postgres --locked -- --ignored
        python3 scripts/smoke.py
    '