#!/bin/sh
# script/lint: run the lint. This Hugo site has no dedicated linter, so
# the lint gate is a clean build that surfaces broken internal links and
# template path problems -- but where it runs is not negotiable: every
# lint run happens inside a Docker container, so this script does
# nothing except build Dockerfile.lint. The lint is a build step there,
# so a successful build is a clean lint. There is deliberately no host
# fallback and no "already inside a container?" branch: either would be
# a host lint path wearing a disguise.
#
# No --target: Dockerfile.lint has exactly one stage, so the whole-file
# build IS the lint. See that file for why a second, sibling stage would
# be a silent skip.
#
# Dockerfile.lint requires the CHECK_EPOCH build argument, generated
# here exactly as script/cibuild generates it -- see that script for why
# the lint layer must not be allowed to cache, and why the value is
# built in an assignment rather than inline.
set -eu

ROOT="$(cd "$(dirname "$0")/.." && pwd -P)"

main() {
    cd "$ROOT"
    epoch="$(date +%s%N)$$"
    # --output type=cacheonly: this build is run for its exit status,
    # not for an image. Because the lint layer is cache-busted on every
    # invocation the result is a new image every time, and an untagged
    # build would leave one dangling image per lint run on a host shared
    # with other work. cacheonly keeps the build cache (so
    # script/bootstrap still hits) and exports nothing. Failures still
    # propagate: an empty CHECK_EPOCH or a failing lint exits non-zero.
    docker build \
        --build-arg CHECK_EPOCH="$epoch" \
        --output type=cacheonly \
        -f Dockerfile.lint \
        .
}

main "$@"