#!/bin/sh
# keyproxy dev wrapper. EVERY compile/vet/test path routes through the
# digest-pinned Docker builder (DESIGN "ALL dev work in Docker" — big
# rule); the host runs containers, never toolchains.
#
# Usage: ./dev.sh {build|vet|test|check|smoke|shell} [args...]
#
#   build    compile ./cmd/keyproxy into bin/keyproxy
#   vet      go vet ./...
#   test     go test ./...
#   check    build + vet + test (the pre-push gate)
#   smoke    end-to-end smoke: builds, starts `keyproxy serve` in a
#            container on port 8082 with a throwaway config, drives it
#            from the host with python urllib (curl is banned on host),
#            shows 401/200/404/501 paths + redacted server log, tears
#            everything down
#   shell    interactive sh inside the builder
set -e

IMAGE="golang@sha256:e8c859f5632dcfde7b32d2012b4351728f6437930887c2f6a91ea242459e5514" # = golang:1.26-bookworm (bash present; alpine lacks it)

run() {
    docker run --rm -v "$PWD:/h" -w /h \
        -u "$(id -u):$(id -g)" -e HOME=/tmp -e GOFLAGS=-buildvcs=false \
        "$IMAGE" "$@"
}

cmd=${1:-check}
shift || true

case "$cmd" in
build)
    run go build -o bin/keyproxy ./cmd/keyproxy
    ;;
vet)
    run go vet ./...
    ;;
test)
    run go test "$@" ./...
    ;;
check)
    run sh -c 'go build -o bin/keyproxy ./cmd/keyproxy && go vet ./... && go test ./...'
    ;;
smoke)
    ./smoke/smoke.sh
    ;;
shell)
    run sh
    ;;
*)
    echo "dev.sh: unknown command $cmd (build|vet|test|check|smoke|shell)" >&2
    exit 1
    ;;
esac