#!/bin/sh
# Run only on the designated remote CI host, never on the developer's machine.
set -eu
cd "$(CDPATH= cd -- "$(dirname -- "$0")/.." && pwd)"

release_sha=${ASTER_RELEASE_SHA:?ASTER_RELEASE_SHA is required}
case "$release_sha" in *[!0-9a-f]*|'') echo "Invalid release SHA" >&2; exit 1;; esac
test "${#release_sha}" -eq 40

ci_id="${GITHUB_RUN_ID:-manual}-$$"
network="endorphin-aster-vm-ci-$ci_id"
postgres="endorphin-aster-vm-ci-pg-$ci_id"
checks="endorphin-aster-vm-ci-checks-$ci_id"
image="endorphin-aster-vm-ci:$release_sha"
report_dir="$PWD/ci-output"
mkdir -p "$report_dir"
# Reset both outputs before any build, so even an early failure has an honest
# NOT_RUN artifact rather than a previous attempt's example results.
printf '# Endor 示例实际运行结果\n\n提交：%s\n\n状态：NOT_RUN\n\nCI 尚未完成示例执行；请查看验证步骤日志。\n' "$release_sha" > "$report_dir/endor-examples.md"
printf '{"format_version":1,"commit":"%s","status":"NOT_RUN","error":"CI did not finish example execution; inspect the verification log.","cases":[]}\n' "$release_sha" > "$report_dir/endor-examples.json"
cleanup() {
    docker rm -f "$checks" "$postgres" >/dev/null 2>&1 || true
    docker network rm "$network" >/dev/null 2>&1 || true
}
trap cleanup EXIT
trap 'exit 130' INT
trap 'exit 143' TERM

docker build --target ci -t "$image" .
docker network create "$network" >/dev/null
# Disposable test database: no production mounts and no published ports.
docker run -d --name "$postgres" --network "$network" --network-alias postgres \
    --env POSTGRES_USER=aster --env POSTGRES_DB=aster \
    --env POSTGRES_PASSWORD=aster-ci-only \
    --tmpfs /var/lib/postgresql/data postgres:17-bookworm >/dev/null

ready=false
for attempt in $(seq 1 60); do
    if docker exec "$postgres" pg_isready -h 127.0.0.1 -U aster -d aster >/dev/null 2>&1; then
        ready=true
        break
    fi
    sleep 1
done
if [ "$ready" != true ]; then
    echo "CI PostgreSQL did not become ready" >&2
    exit 1
fi

check_status=0
docker run --name "$checks" --init --network "$network" \
    --mount type=volume,src=endorphin-aster-vm-ci-cargo,dst=/usr/local/cargo/registry \
    --mount type=volume,src=endorphin-aster-vm-ci-target,dst=/build/target \
    --env ASTER_TEST_POSTGRES_URL='postgres://aster:aster-ci-only@postgres:5432/aster?sslmode=disable' \
    --env ASTER_RELEASE_SHA="$release_sha" \
    "$image" sh -eu -c '
        checks=0
        sh scripts/check.sh || checks=$?
        examples=0
        python3 scripts/endor_examples.py --output-dir /build/ci-output || examples=$?
        test "$checks" -eq 0
        test "$examples" -eq 0
        cargo test -p storage --test postgres --locked -- --ignored
        python3 scripts/smoke.py
    ' || check_status=$?

# Copy reports before the EXIT trap removes the stopped checks container.
# Keep the original validation failure status if report extraction also fails.
copy_status=0
docker cp "$checks:/build/ci-output/endor-examples.md" "$report_dir/endor-examples.md" || copy_status=$?
docker cp "$checks:/build/ci-output/endor-examples.json" "$report_dir/endor-examples.json" || copy_status=$?
if [ "$check_status" -ne 0 ]; then
    exit "$check_status"
fi
exit "$copy_status"