#!/usr/bin/env bash
# docker-run.sh — canonical ephemeral-container wrapper.
#
# Keeps the host clean: every build/test/generation runs inside a pinned image.
# Ensures output files are owned by the invoking user (not root).
#
# Usage:
#   docker-run.sh <image> [command...]
#       Runs <command> in <image> with the repo mounted at /data, cwd /data.
#       With no command, drops into the image's default entrypoint.
#   docker-run.sh --shell <image>
#       Interactive shell inside the container (for debugging).
#
# Examples:
#   docker-run.sh python:3.12-slim python3 -m pytest
#   docker-run.sh pandoc/extra report.md -o report.pdf
#   docker-run.sh --shell node:20
set -euo pipefail

HERE="$(cd "$(dirname "$0")" && pwd)"
# shellcheck disable=SC1091
source "$HERE/lib/common.sh"

SHELL_MODE=false
case "${1:-}" in
    --shell) SHELL_MODE=true; shift ;;
    -h|--help)
        sed -n '2,18p' "$0"; exit 0 ;;
esac

[ "$#" -ge 1 ] || { sed -n '2,18p' "$0"; exit 1; }

if [ "$SHELL_MODE" = true ]; then
    # ${SHELL:-sh} must expand inside the container, not in this outer shell.
    # shellcheck disable=SC2016
    docker_run "$1" sh -c 'exec "${SHELL:-sh}"'
else
    docker_run "$@"
fi