#!/bin/bash
set -euo pipefail

# ==========================================
# 配置
# ==========================================
REGISTRY="git.virtheart.com"
OWNER="virtheart"
IMAGE="personal"
TAG="latest"
FULL_IMAGE="${REGISTRY}/${OWNER}/${IMAGE}:${TAG}"

# ==========================================
# 1. 登录 Registry
# ==========================================
# 凭据必须通过环境变量 REGISTRY_USERNAME / REGISTRY_PASSWORD 提供，
# 禁止硬编码在脚本或代码中（团队安全规则第 5 条）。
# 使用方式：
#   REGISTRY_USERNAME="<用户名>" REGISTRY_PASSWORD="<密码>" ./build-and-push.sh
: "${REGISTRY_USERNAME:?请通过环境变量 REGISTRY_USERNAME 提供 Registry 用户名}"
: "${REGISTRY_PASSWORD:?请通过环境变量 REGISTRY_PASSWORD 提供 Registry 密码}"

echo ">>> [1/3] 登录 Registry: ${REGISTRY}"
echo "${REGISTRY_PASSWORD}" | docker login "${REGISTRY}" -u "${REGISTRY_USERNAME}" --password-stdin

# ==========================================
# 2. 构建镜像
# ==========================================
echo ">>> [2/3] 构建镜像: ${FULL_IMAGE}"
docker build -t "${FULL_IMAGE}" .

# ==========================================
# 3. 推送镜像
# ==========================================
echo ">>> [3/3] 推送镜像: ${FULL_IMAGE}"
docker push "${FULL_IMAGE}"

# ==========================================
# 清理本地镜像
# ==========================================
echo ">>> 清理本地镜像: ${FULL_IMAGE}"
docker rmi "${FULL_IMAGE}" || true

echo ">>> 完成！镜像已推送到 ${FULL_IMAGE}，本地镜像已清理"