#!/bin/sh
# script/cibuild: run the CI build. The Dockerfile runs script/check, but
# that only proves anything because CHECK_EPOCH is a fresh nonce on every
# invocation: without it Docker serves the check layer from cache on an
# unchanged tree and the build exits 0 without running the suite.
set -eu

ROOT="$(cd "$(dirname "$0")/.." && pwd -P)"

main() {
    cd "$ROOT"
    # Assign on its own line: a failing command substitution inside an
    # argument does not trip `set -e`, which would silently degrade the
    # nonce to an empty constant. `$$` is required because busybox `date`
    # drops %N without erroring.
    epoch="$(date +%s%N)$$"
    # VERSION must be computed here, on the host: .dockerignore excludes
    # .git, so `git describe` cannot run in any build stage and fails
    # quietly there rather than erroring. Same own-line discipline as the
    # epoch. `|| true` keeps a failing describe from tripping `set -e`
    # and leaves the value empty; the guard below is then the single
    # place the fallback is applied, and it does fire — on an export with
    # no .git, or a repo with no commits yet. `unknown` is visibly wrong
    # in a binary in a way that an empty version is not.
    version="$(git describe --tags --always --dirty 2>/dev/null || true)"
    [ -n "$version" ] || version="unknown"
    docker build \
        --build-arg CHECK_EPOCH="$epoch" \
        --build-arg VERSION="$version" \
        .
}

main "$@"