#!/usr/bin/env bash
set -euo pipefail
root="$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")/.." && pwd)"
engine="${CONTAINER_ENGINE:-podman}"
tag="${SCANNER_IMAGE:-localhost/devsecops/scanner:20260912}"
[[ "$(uname -m)" == x86_64 ]] || exit 1
cd "$root"
sha256sum --check --quiet SHA256SUMS
"$engine" load -i images/zap-stable-amd64.tar
# A small, explicit build context avoids copying image archives into themselves.
context="$(mktemp -d /tmp/devsecops-context.XXXXXXXX)"
mkdir -p "$context/cache" "$context/containers" "$context/metadata"
cp -a bin scripts examples "$context/"
cp -a cache/trivy cache/grype "$context/cache/"
cp containers/Containerfile containers/ci-security.sh containers/gitleaks.toml "$context/containers/"
cp containers/test-adapter.sh containers/test-zap.sh "$context/containers/"
cp metadata/*LICENSE metadata/releases.json "$context/metadata/"
"$engine" build --pull=never --network=none -f "$context/containers/Containerfile" -t "$tag" "$context"
export_dir="$(mktemp -d "$root/images/.export.XXXXXXXX")"
"$engine" save --format docker-archive -o "$export_dir/scanner.tar" "$tag"
mv "$export_dir/scanner.tar" images/devsecops-scanner-amd64.tar
rmdir "$export_dir"
"$engine" image inspect "$tag" > metadata/scanner-image.json
echo "Built $tag. Temporary context: $context"
echo 'Regenerate SHA256SUMS with scripts/make-manifest.py before transfer.'