#!/usr/bin/env bash
set -euo pipefail

ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"

# The cluster has no container registry: /etc/rancher/k3s/registries.yaml is
# absent and the alexcodeplace GHCR packages are private with no imagePullSecret
# anywhere in the cluster. Runner images therefore reach the nodes by being
# side-loaded into each node's containerd, and the tag is an identifier rather
# than a pullable reference -- hence the honest `localhost/` prefix and the
# `imagePullPolicy: Never` in arc/runner-values.yaml. distribute.sh owns the
# side-load; this script only produces the image on the machine it runs on.
#
# Run this on a buildbox (debian1/2/3), never on the workstation.
IMAGE="localhost/overdeck-ci-runner:arc-pr-gate-v1"

# --pull=missing: the base image is digest-pinned in the Containerfile, so a
# fetch when it is absent is still reproducible. --pull=false cannot build on a
# node that has never seen the base layer, which is every node on a fresh box.
podman build --pull=missing --file "$ROOT/Containerfile" --tag "$IMAGE" "$ROOT"
printf 'built %s\n' "$IMAGE"