#!/usr/bin/env bash
set -Eeuo pipefail
: "${REVIEW_SHA:?The exact review commit SHA is required}"
[[ "$REVIEW_SHA" =~ ^[0-9a-f]{40}$ ]] || { echo 'Refusing invalid review SHA' >&2; exit 2; }
# Only this workflow's disposable tags; production tags, volumes and other projects stay out of scope.
for repository in creative-studio-review creative-wiki-tests creative-wiki-review; do
 tag="$repository:$REVIEW_SHA"
 referenced=$(docker ps -aq | xargs -r docker inspect --format '{{.Image}}')
 if ! image=$(docker image inspect --format '{{.Id}}' "$tag" 2>/dev/null); then
  echo "No review image: $tag"
  continue
 fi
 if printf '%s\n' "$referenced" | grep -Fxq "$image"; then
  echo "Keeping container-referenced review image: $tag"
  continue
 fi
 # Preserve parent layers so unchanged dependency installs stay cached.
 docker image rm --no-prune "$tag"
done