#!/bin/bash
# Copy-based isolation for containerized runners using a sibling Docker daemon.
set -euo pipefail
root=$(cd -- "$(dirname -- "$0")/.." && pwd)
out=$(realpath "${1:?empty output directory outside checkout required}")
[[ -d $out && -z $(find "$out" -mindepth 1 -print -quit) ]] || exit 1
case $out in "$root"|"$root"/*) exit 1 ;; esac
[[ -d $root/.git ]] || exit 1
image=${G15_BUILD_IMAGE:-g15-packaging}
build=''
rebuild=''
cleanup() {
    [[ -z $build ]] || docker rm -f "$build" >/dev/null
    [[ -z $rebuild ]] || docker rm -f "$rebuild" >/dev/null
}
trap cleanup EXIT
docker build -t "$image" -f "$root/packaging/Dockerfile" "$root/packaging"
build=$(docker create "$image" bash -c 'mkdir /out && shellcheck packaging/*.sh packaging/overlays/v1/*.sh && bash packaging/container-build.sh')
# Explicit allowlist: never copy editor settings, credentials or unrelated files.
for path in .git .gitmodules packaging libg15 libg15render g15daemon g15macro g15stats; do
    docker cp "$root/$path" "$build:/work/$path"
done
docker start -a "$build"
[[ $(docker inspect -f '{{.State.ExitCode}}' "$build") == 0 ]]
docker cp "$build:/out/." "$out/"
rebuild=$(docker create "$image" bash -c 'apt-get update && bash /rebuild.sh /out')
docker cp "$out" "$rebuild:/out"
docker cp "$root/packaging/rebuild.sh" "$rebuild:/rebuild.sh"
docker start -a "$rebuild"
[[ $(docker inspect -f '{{.State.ExitCode}}' "$rebuild") == 0 ]]