#!/bin/bash
# Secure Docker build script using BuildKit secrets
# Usage: ./scripts/build-cicd-secure.sh [image-tag]

set -e

# Default image tag
IMAGE_TAG="${1:-plex-playlist-cicd:latest}"

# Check if SSH key exists
SSH_KEY_PATH="${SSH_KEY_PATH:-$HOME/.ssh/id_rsa}"
if [ ! -f "$SSH_KEY_PATH" ]; then
    echo "Error: SSH private key not found at $SSH_KEY_PATH"
    echo "Set SSH_KEY_PATH environment variable or ensure key exists at default location"
    exit 1
fi

echo "Building Docker image with secure secrets handling..."
echo "Image tag: $IMAGE_TAG"
echo "SSH key: $SSH_KEY_PATH"

# Enable Docker BuildKit (required for --secret)
export DOCKER_BUILDKIT=1

# Build with secrets mount - SSH key never enters image layers
docker build \
    --secret id=ssh_private_key,src="$SSH_KEY_PATH" \
    --build-arg GITHUB_SHA="${GITHUB_SHA:-}" \
    --file Dockerfile.cicd \
    --tag "$IMAGE_TAG" \
    .

echo "✅ Build completed successfully!"
echo "Run with: docker run -it $IMAGE_TAG"

# Optional: Test the image
if [ "${TEST_IMAGE:-}" = "true" ]; then
    echo "🧪 Testing image..."
    docker run --rm "$IMAGE_TAG" bash -c "
        echo 'Testing tools...' &&
        python3 --version &&
        node --version &&
        yarn --version &&
        git --version &&
        echo '✅ All tools working!'
    "
fi