#!/usr/bin/env bash
# Build/export each tool without fetching images or packages.
set -euo pipefail
root="$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")/.." && pwd)"
engine="${CONTAINER_ENGINE:-podman}"
cd "$root"
sha256sum --check --quiet SHA256SUMS
runtime="$(mktemp /tmp/devsecops-tool-runtime.XXXXXXXX.tar)"
trap 'rm -f "$runtime"' EXIT
python3 containers/prepare-tool-runtime.py "$runtime"
"$engine" load -i "$runtime"
for spec in gitleaks:8.30.1 syft:1.51.1 grype:0.118.0 trivy:0.74.0; do
  tool="${spec%:*}"; version="${spec#*:}"
  tag="localhost/devsecops/$spec"
  "$engine" build --pull=never --network=none \
    -f "containers/Containerfile.$tool" -t "$tag" .
  archive="images/$tool-$version-linux-amd64.tar"
  "$engine" save --format docker-archive -o "$archive.part" "$tag"
  mv "$archive.part" "$archive"
  "$engine" image inspect "$tag" > "metadata/$tool-image.json"
done
# ZAP is already exported separately, with its original pinned tag.
echo 'ZAP: images/zap-stable-amd64.tar (localhost/devsecops/zap:20260909)'
echo 'Regenerate SHA256SUMS with scripts/make-manifest.py after validation.'