#!/usr/bin/env bash
## php-emergency-guard.sh REF NEW_PHP
##
## "Do not roll back a newer php.net emergency image." REF is the published
## :phpNN tag a normal build is about to overwrite; NEW_PHP is the PHP version
## the normal build packages. Exit 0 = go ahead, 1 = refuse (or cannot tell).
##
## Decision (same predicate as the old inline step, evaluated on the amd64
## image only, so it is correct for a single-platform image AND a multi-arch
## index):
##   REF does not exist yet (registry "not found")      -> proceed (nothing to protect)
##   labels read, source != php.net                      -> proceed
##   labels read, source = php.net, cur == new           -> proceed
##   labels read, source = php.net, cur > new (sort -V)  -> REFUSE
##   labels read, source = php.net, cur < new            -> proceed
##   labels absent (older image without them)            -> proceed (as before)
##   ANYTHING ELSE (registry/auth/network error, malformed manifest, index
##   without exactly one linux/amd64 image, non-amd64 config) -> REFUSE
##   (FAIL CLOSED; the old step failed open and silently disabled the guard).
## Env: LABEL_SCRIPT (tests), IMAGETOOLS passed through.
set -euo pipefail
ref=${1:?usage: php-emergency-guard.sh REF NEW_PHP}
new=${2-}
here=$(cd "$(dirname "$0")" && pwd)
labeler=${LABEL_SCRIPT:-$here/image-label-amd64.sh}

rc=0
out=$("$labeler" "$ref" org.whp.lsphp-source org.whp.php-version) || rc=$?
if [ "$rc" -eq 3 ]; then
  echo "published $ref: not found (first build); this build: packaged $new. Nothing to protect."
  exit 0
fi
if [ "$rc" -ne 0 ]; then
  echo "::error::cannot read the php.net-emergency labels of the amd64 image behind $ref (rc=$rc). Refusing to overwrite it blind (fail closed). Retry the run; if it persists check registry access and the manifest."
  exit 1
fi
src=$(printf '%s\n' "$out" | sed -n 1p)
cur=$(printf '%s\n' "$out" | sed -n 2p)
echo "published $ref (amd64): source=${src:-?} php=${cur:-?}; this build: packaged $new"
if [ "$src" = "php.net" ] && [ "$cur" != "$new" ] && [ "$(printf '%s\n%s\n' "$cur" "$new" | sort -V | tail -n1)" = "$cur" ]; then
  echo "::error::$ref is a php.net emergency build of PHP $cur; LiteSpeed still ships $new. Not overwriting it with an older PHP. Re-run lsphp-source-emergency.yaml for a newer fix, or wait for LiteSpeed."
  exit 1
fi
exit 0