#!/usr/bin/env bash
set -euo pipefail
[ "$(uname -s)" = Linux ] || { echo 'Container task requires Linux.' >&2; exit 2; }
mkdir -p "$HOME"
action="${1:?container action is required}"
shift
case "$action" in
  versions17)
    java -version
    javac -version
    python3 --version
    git --version
    ;;
  versions8)
    java -version
    javac -version
    gradle --version
    test -s "$ANDROID_HOME/platforms/android-30/android.jar"
    cat "$ANDROID_HOME/platforms/android-30/source.properties"
    cat "$ANDROID_HOME/build-tools/30.0.0/source.properties"
    "$ANDROID_HOME/build-tools/30.0.0/aapt" version
    cat /opt/toolchain-receipt.json
    ;;
  sdkaudit)
    bash /audit/sdk-verification/run-parser-audit.sh /input/sdk.aar
    ;;
  appaudit)
    python3 /audit/app-verification/run_audit.py "$SOURCE_REPO"
    ;;
  a02audit)
    python3 /audit/app-verification/run_a02_audit.py "$SOURCE_REPO"
    ;;
  gradle)
    build_root="$(mktemp -d /tmp/zhct-android-build.XXXXXX)"
    export_results() {
      local rc=$?
      trap - EXIT
      # Export only reviewable test reports and debug build artifacts, never source.
      for relative in app/build/test-results app/build/reports/tests app/build/outputs/apk/debug; do
        if [ -d "$build_root/$relative" ]; then
          mkdir -p "/evidence/$(dirname "$relative")"
          cp -R "$build_root/$relative" "/evidence/$relative"
        fi
      done
      printf '%s\n' "$rc" > /evidence/gradle-exit-code.txt
      exit "$rc"
    }
    trap export_results EXIT
    # Do not reuse .git absolute worktree pointer, Mac build binaries, caches, or sdk.dir.
    tar -C "$SOURCE_REPO" --exclude=./.git --exclude=./.gradle --exclude=./.idea \
      --exclude=./build --exclude=./app/build --exclude=./local.properties -cf - . \
      | tar -C "$build_root" -xf -
    printf 'sdk.dir=%s\n' "$ANDROID_HOME" > "$build_root/local.properties"
    python3 - "$build_root" <<'PY'
from pathlib import Path
import re, sys
root = Path(sys.argv[1])
wrapper = (root / 'gradle/wrapper/gradle-wrapper.properties').read_text()
if not re.search(r'^distributionUrl=.*gradle-5\.1\.1-all\.zip\s*$', wrapper, re.M):
    raise SystemExit('Gradle wrapper version changed: review container mapping before running')
build = (root / 'build.gradle').read_text()
if "com.android.tools.build:gradle:3.4.1" not in build:
    raise SystemExit('Android Gradle plugin version changed: review container mapping')
app = (root / 'app/build.gradle').read_text()
if not re.search(r'compileSdkVersion\s+30\b', app) or not re.search(r'buildToolsVersion\s+[\"\x27]30\.0\.0[\"\x27]', app):
    raise SystemExit('Android SDK/build tools changed: review container mapping')
PY
    cd "$build_root"
    java -version
    gradle --no-daemon --console=plain "$@"
    ;;
  *) echo "Unsupported container task: $action" >&2; exit 2 ;;
esac