#!/usr/bin/env bash

set -euo pipefail

ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
readonly ROOT
readonly IMAGE="hugo-chiri-sec-01"
readonly RESULTS="${ROOT}/results"

cd "${ROOT}"
docker build --tag "${IMAGE}" .
if [[ "${RESULTS}" != "${ROOT}/results" ]]; then
  echo "refusing to clear an unexpected results directory" >&2
  exit 65
fi
rm -rf "${RESULTS}"
mkdir -p "${RESULTS}"

docker run --rm \
  --cpus=2 \
  --memory=512m \
  --network=none \
  --volume "${RESULTS}:/experiment/results" \
  "${IMAGE}"
docker run --rm \
  --cpus=2 \
  --memory=512m \
  --network=none \
  --volume "${RESULTS}:/experiment/results" \
  --entrypoint node \
  "${IMAGE}" verify-profile.mjs
docker run --rm \
  --cpus=2 \
  --memory=512m \
  --network=none \
  --volume "${RESULTS}:/experiment/results" \
  --entrypoint sh \
  "${IMAGE}" -lc \
  'node decision-record.mjs && node verify-decisions.mjs'
docker run --rm \
  --volume "${RESULTS}:/experiment/results" \
  --entrypoint sh \
  "${IMAGE}" -lc \
  'mkdir -p results/environment && npm audit --audit-level=low > results/environment/npm-audit.txt 2>&1'
docker run --rm \
  --volume "${RESULTS}:/experiment/results" \
  --entrypoint sh \
  "${IMAGE}" -lc \
  'node source-evidence.mjs && node source-manifest.mjs && node mutate.mjs && node verify-results.mjs'