#!/usr/bin/env bash
# Build (and optionally scan/push) the heleos base images.
#
#   REGISTRY=git.example.com/heleos ./build.sh            # build + Trivy scan
#   REGISTRY=git.example.com/heleos PUSH=1 ./build.sh     # also push
#
# PHP_VERSIONS controls which php-fpm tags are built.
set -euo pipefail

REGISTRY="${REGISTRY:-heleos}"          # e.g. git.example.com/heleos
PUSH="${PUSH:-0}"
SCAN="${SCAN:-1}"                        # run Trivy if available
PHP_VERSIONS="${PHP_VERSIONS:-8.3 8.2}"
HERE="$(cd "$(dirname "$0")" && pwd)"

scan() {
    if [ "$SCAN" = "1" ] && command -v trivy >/dev/null 2>&1; then
        trivy image --severity HIGH,CRITICAL --exit-code 1 --no-progress "$1"
    else
        echo "  (skipping Trivy scan for $1)"
    fi
}

maybe_push() { [ "$PUSH" = "1" ] && docker push "$1" || true; }

echo "==> nginx"
docker build -t "${REGISTRY}/nginx:latest" "${HERE}/nginx"
scan "${REGISTRY}/nginx:latest"
maybe_push "${REGISTRY}/nginx:latest"

for v in $PHP_VERSIONS; do
    echo "==> php-fpm ${v}"
    docker build --build-arg "PHP_VERSION=${v}" -t "${REGISTRY}/php-fpm:${v}" "${HERE}/php-fpm"
    scan "${REGISTRY}/php-fpm:${v}"
    maybe_push "${REGISTRY}/php-fpm:${v}"
done

echo "Done."