#!/usr/bin/env bash
set -euo pipefail
root="${1:?Deployment directory required}"
sha="${2:?Commit SHA required}"
[[ "$root" =~ ^/[a-zA-Z0-9_/-]+$ && "$root" != / && "$root" != *..* && "$sha" =~ ^[0-9a-f]{40}$ ]] || exit 2
exec 9>"$root/.build.lock"
flock -w 1800 9
cd "$root/builds/$sha"
bash deploy/check.sh
docker build -t "sundynix/veyra:$sha" .
release="$root/releases/$sha"
umask 077
mkdir -p "$release"
cp deploy/docker-compose.yml deploy/release.sh "$release/"
docker save "sundynix/veyra:$sha" | gzip > "$release/image.tar.gz"
(cd "$release" && sha256sum image.tar.gz > image.tar.gz.sha256)
echo "Verified image prepared: $sha"