#!/usr/bin/env bash
set -euo pipefail

root="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
cd "$root"

require_line() {
  local file="$1"
  local line="$2"
  grep -Fqx "$line" "$file" || {
    echo "$file must contain: $line" >&2
    exit 1
  }
}

# Keep Docker build contexts aligned with root Go replacements and Web imports.
require_line Dockerfile.server 'COPY dev/go.mod dev/go.sum ./dev/'
require_line Dockerfile.web 'COPY web/scripts ./scripts'

# Keep the release image self-contained while preserving explicit entrypoints:
# server replicas use the default CMD, and one-shot jobs override it with an
# absolute schema/admin binary path.
for binary in agentteam-server agentteam-gateway-server agentteam-schema agentteam-tidb-admin; do
  grep -Fq -- "-o /out/bin/$binary" Dockerfile.server || {
    echo "Dockerfile.server must build /out/bin/$binary" >&2
    exit 1
  }
done

if [[ -e Dockerfile.tools ]]; then
  echo 'Dockerfile.tools must not reintroduce a separate AgentTeam tools image' >&2
  exit 1
fi

echo 'Docker build context guardrail passed.'