#!/usr/bin/env bash
set -Eeuo pipefail
: "${GITEA_RUN_ID:?A numeric CI run ID is required}"
[[ "$GITEA_RUN_ID" =~ ^[1-9][0-9]*$ ]] || { echo 'Refusing invalid CI run ID' >&2; exit 2; }
project="prompt-ci-$GITEA_RUN_ID"
filter="label=com.docker.compose.project=$project"
# Recheck ownership immediately before removal; never target a shared stack.
containers=$(docker ps -aq --filter "$filter")
for resource in $containers; do
 [[ "$(docker inspect --format '{{index .Config.Labels "com.docker.compose.project"}}' "$resource")" == "$project" ]] || { echo "Refusing foreign resource: $resource" >&2; exit 2; }
 docker rm -f "$resource"
done
volumes=$(docker volume ls -q --filter "$filter")
for resource in $volumes; do
 [[ "$(docker volume inspect --format '{{index .Labels "com.docker.compose.project"}}' "$resource")" == "$project" ]] || { echo "Refusing foreign resource: $resource" >&2; exit 2; }
 docker volume rm "$resource"
done
networks=$(docker network ls -q --filter "$filter")
for resource in $networks; do
 [[ "$(docker network inspect --format '{{index .Labels "com.docker.compose.project"}}' "$resource")" == "$project" ]] || { echo "Refusing foreign resource: $resource" >&2; exit 2; }
 docker network rm "$resource"
done