#!/bin/sh
# Run only on the Linux CI host with Docker; never bake source into cache images.
set -eu
scope=${CI_CACHE_SCOPE:-manual}
case "$scope" in *[!a-zA-Z0-9_-]*|'') echo "Invalid cache scope" >&2; exit 1;; esac
root=$(pwd -P)
image=endorphin-tessera-gui-ci:rust-1.91.1
prefix=tessera-ci-rust-1-91-1-$scope
# Serialize access to each target directory, including manually started checks.
exec 9>"/tmp/$prefix.lock"
flock 9
sh -n scripts/build-macos-app.sh
# Empty context: only the toolchain and OS dependencies become image layers.
docker build -t "$image" - < Dockerfile.ci
name="$prefix-${GITHUB_RUN_ID:-$$}"
cleanup() { docker rm -f "$name" >/dev/null 2>&1 || true; }
trap cleanup EXIT
trap 'exit 130' INT
trap 'exit 143' TERM
docker run --name "$name" --rm --init \
  --mount "type=bind,src=$root,dst=/build,readonly" \
  --mount "type=volume,src=$prefix-target,dst=/cargo-target" \
  --mount "type=volume,src=$prefix-registry,dst=/usr/local/cargo/registry" \
  --mount "type=volume,src=$prefix-git,dst=/usr/local/cargo/git" \
  "$image" &
run_pid=$!
wait "$run_pid"