# Repo-delivery fragment for Job.spec.template.spec in the ipz-e2e namespace.
#
# The dispatcher must replace all three __IPZ_E2E_*__ tokens before submitting the
# Job. Kubernetes does not expand environment variables in hostPath or subPath.
#
# __IPZ_E2E_MIRROR_SLUG__ is the validated, branch-specific directory name under
# /home/user/builds. It must contain no slash, '..', whitespace, or shell
# metacharacters. __IPZ_E2E_EXPECTED_ASSET_MANIFEST_SHA256__ is the lower-case
# SHA-256 of the canonical branch's built asset manifest, not a digest calculated
# from the node mirror after scheduling. __IPZ_E2E_RUNNER_IMAGE__ must be replaced
# with the digest-pinned runner image that is already imported on every eligible
# node.
#
# Merge the volumes and initContainers below into spec.template.spec. The
# WordPress container must also mount the ipz-plugin volume at the plugin path;
# the required mount is shown in the comment below the fragment.

# The enclosing Pod template should set fsGroup: 1000 (the runner image's
# unprivileged user) or an equivalent writable group for ipz-plugin. Do not make
# the host mirror writable.
securityContext:
  fsGroup: 1000
  fsGroupChangePolicy: OnRootMismatch

volumes:
  - name: ipz-repo-mirror
    hostPath:
      # /home/user/builds is present on the buildboxes. subPath below selects
      # the branch mirror, so a missing branch cannot be silently created.
      path: /home/user/builds
      type: Directory
  - name: ipz-plugin
    emptyDir:
      sizeLimit: 1Gi

initContainers:
  - name: deliver-ipz-plugin
    image: __IPZ_E2E_RUNNER_IMAGE__
    imagePullPolicy: IfNotPresent
    command:
      - /bin/sh
      - -ceu
      - |
        mirror_plugin=/repo-mirror/plugins/international-press-zone
        manifest="$mirror_plugin/admin/dist/asset-manifest.json"
        expected="$IPZ_E2E_EXPECTED_ASSET_MANIFEST_SHA256"

        echo "checking IPZ mirror ${IPZ_E2E_MIRROR_SLUG}"
        test -d "$mirror_plugin"
        # The built admin manifest is the delivery gate. Missing or empty means
        # this mirror is not usable and must fail the init container.
        test -f "$manifest"
        test -s "$manifest"

        # Require a real expected digest. An unresolved template token, an
        # omitted value, or an invalid value fails closed before any copy.
        if [ "${#expected}" -ne 64 ]; then
          echo "invalid expected asset-manifest SHA-256" >&2
          exit 1
        fi
        case "$expected" in
          *[!0-9a-f]*)
            echo "expected asset-manifest SHA-256 must be lower-case hex" >&2
            exit 1
            ;;
        esac

        actual="$(sha256sum "$manifest")"
        actual="${actual%% *}"
        if [ "$actual" != "$expected" ]; then
          echo "stale or wrong mirror: asset-manifest digest mismatch" >&2
          echo "expected ${expected}, got ${actual}" >&2
          exit 1
        fi

        # ipz-plugin is a fresh emptyDir for this Pod. Copy only the plugin,
        # never the whole wp-content mirror, then verify the copied gate file.
        cp -a "$mirror_plugin"/. /repo-plugin/
        test -s /repo-plugin/admin/dist/asset-manifest.json
    env:
      - name: IPZ_E2E_MIRROR_SLUG
        value: "__IPZ_E2E_MIRROR_SLUG__"
      - name: IPZ_E2E_EXPECTED_ASSET_MANIFEST_SHA256
        value: "__IPZ_E2E_EXPECTED_ASSET_MANIFEST_SHA256__"
    securityContext:
      allowPrivilegeEscalation: false
      capabilities:
        drop:
          - ALL
      readOnlyRootFilesystem: true
    volumeMounts:
      - name: ipz-repo-mirror
        mountPath: /repo-mirror
        # subPath is rendered from the per-branch Job parameter. A missing
        # directory makes kubelet reject the mount; it is never DirectoryOrCreate.
        subPath: __IPZ_E2E_MIRROR_SLUG__
        readOnly: true
      - name: ipz-plugin
        mountPath: /repo-plugin

# Add this mount to the WordPress container in the same Pod:
#   volumeMounts:
#     - name: ipz-plugin
#       mountPath: /var/www/html/wp-content/plugins/international-press-zone
#       readOnly: true
