#!/bin/bash
# build-cdn.sh — one production build of the pulled commit into /data/cdn, one at a time.
#   snapshot (so the pull loop can't change files mid-build) -> apply the public exclusions ->
#   the build steps WITHOUT the gates (memory-capped) -> check the output -> the exclusion check again
#   (refuses the swap) -> atomic swap of /data/cdn/current.
# No gates here: they already passed before the commit reached main, and a full gate run on a
# 2-vCPU container takes most of an hour. The public exclusions are NOT a gate and always run.
# Exit 75 = another build holds the lock. To stop a build, kill the PID in /tmp/build-cdn.pid
# (never a process group: inside a container the group can be PID 1, i.e. the whole container).
set -u
exec 9>/tmp/build-cdn.lock
flock -n 9 || { echo "another build is running"; exit 75; }
echo $$ > /tmp/build-cdn.pid
cd /app/repo
SHA=$(git rev-parse --short HEAD); SNAP=/tmp/build-$SHA
rm -rf "$SNAP"; mkdir -p "$SNAP"
git archive HEAD | tar -x -C "$SNAP" || { echo "snapshot failed"; exit 1; }
bash /app/repo/deployment/cloud/apply-exclusions.sh "$SNAP"
ln -s /app/repo/node_modules "$SNAP/node_modules"
cd "$SNAP"
echo "$(date -u +%FT%TZ) building $SHA"
export NODE_OPTIONS="--max-old-space-size=${BUILD_MAX_OLD_SPACE_MB:-1536}"
for step in clean token build:bundles tree check:sri; do
  nice -n 10 bun run "$step" || { echo "build failed at $step"; rm -rf "$SNAP"; exit 1; }
done
OUT="$SNAP/public/dx-maps"
[ -f "$OUT/manifest.json" ] || { echo "no manifest.json in the output"; rm -rf "$SNAP"; exit 1; }
bun -e 'console.log("window.MAP_API_BASE=" + JSON.stringify(process.env.PUBLIC_API_BASE || "") + ";")' > "$OUT/runtime-config.js"
NEW=/data/cdn/build-$SHA
rm -rf "$NEW"; mkdir -p /data/cdn; mv "$SNAP/public" "$NEW"
bash /app/repo/deployment/cloud/apply-exclusions.sh --check "$NEW" || { echo "REFUSED: excluded content in the build; not published"; rm -rf "$NEW" "$SNAP"; exit 1; }
ln -sfn "$NEW" /data/cdn/current.tmp && mv -T /data/cdn/current.tmp /data/cdn/current
echo "$SHA" > /data/cdn/COMMIT
find /data/cdn -maxdepth 1 -name 'build-*' ! -path "$NEW" -exec rm -rf {} +
rm -rf "$SNAP"
echo "$(date -u +%FT%TZ) published $SHA at /cdn/dx-maps/"