#!/usr/bin/env bash
# Remove the Docker resources that THIS job created, and nothing else.
#
# Usage: scripts/ci/cleanup_job_resources.sh [image-ref ...]
#
# The runner shares one Docker daemon with other jobs and other services, so
# this script never prunes. It only removes:
#   * per-run networks named aegis-it-* that the job container is attached to
#     (the integration harness joins the job container to its own per-run
#     network only), plus the containers still attached to those networks;
#   * containers started from the per-run image refs given as arguments, and
#     those refs. Per-run refs are names containing "aegis-ci-" (named after the
#     run id), such as the local build tag aegis-ci-<run id>-build:<sha>;
#   * for any other ref (registry tags such as :sha-<12>, :latest, :main, :dev,
#     which a deployment on the same daemon may use) only the tag is removed.
#     Containers are never touched, and an image still used by a container simply
#     stays. Pass registry tags before the per-run ref: the image itself goes away
#     with its last tag.
# Everything is best effort (a failing removal never fails the job).
set -uo pipefail

job_ref=""
if command -v uv > /dev/null 2>&1 && [ -f tests/integration/harness.py ]; then
  job_ref="$(uv run python -c \
    'from tests.integration.harness import job_container_ref; print(job_container_ref())' \
    2> /dev/null || true)"
fi
if [ -z "${job_ref}" ]; then
  job_ref="${HOSTNAME:-}"
fi

if [ -n "${job_ref}" ] && docker container inspect "${job_ref}" > /dev/null 2>&1; then
  job_id="$(docker container inspect --format '{{.Id}}' "${job_ref}")"
  networks="$(docker container inspect \
    --format '{{range $name, $_ := .NetworkSettings.Networks}}{{$name}}{{"\n"}}{{end}}' \
    "${job_ref}" | grep -E '^aegis-it-[0-9a-f]+$' || true)"
  for net in ${networks}; do
    for cid in $(docker network inspect --format '{{range $id, $_ := .Containers}}{{$id}}{{"\n"}}{{end}}' "${net}" 2> /dev/null); do
      if [ "${cid}" != "${job_id}" ]; then
        docker rm -f -v "${cid}" > /dev/null 2>&1 || true
      fi
    done
    docker network disconnect -f "${net}" "${job_id}" > /dev/null 2>&1 || true
    docker network rm "${net}" > /dev/null 2>&1 || true
    echo "removed network ${net}"
  done
fi

is_per_run_ref() {
  case "$1" in
    *aegis-ci-*) return 0 ;;
    *) return 1 ;;
  esac
}

for image in "$@"; do
  if is_per_run_ref "${image}"; then
    for cid in $(docker ps -aq --filter "ancestor=${image}" 2> /dev/null); do
      docker rm -f -v "${cid}" > /dev/null 2>&1 || true
    done
    docker rmi "${image}" > /dev/null 2>&1 || true
    echo "removed image ${image}"
  else
    docker image rm "${image}" > /dev/null 2>&1 || true
    echo "untagged shared ref ${image}"
  fi
done

exit 0