#!/usr/bin/env bash
set -euo pipefail

# Build the isolated training image from the reviewed, complete hash lock. This
# is an operator preparation command, never a CI step or training invocation.
# It intentionally does not download corpora or rewrite the reviewed lock.

readonly build_dir="deploy/wakeword-training"
readonly lock_file="${build_dir}/requirements.wheelhouse.lock"
readonly base_image="docker.io/pytorch/pytorch@sha256:639b8229ccfd8a3aa803cf49c33d6d6fe406750d79aaf723fe8c0eb1060d8cff"

if [[ $# -ne 1 ]]; then
  echo "usage: $0 <output-image-tag>" >&2
  exit 64
fi
if [[ ! -s "$lock_file" ]]; then
  echo "required reviewed dependency lock is missing: $lock_file" >&2
  exit 66
fi
if ! grep -F "livekit-wakeword" "$lock_file" >/dev/null \
  || ! grep -F "0.2.1" "$lock_file" >/dev/null; then
  echo "compiled lock did not retain livekit-wakeword 0.2.1" >&2
  exit 65
fi
if ! grep -F "cf2d9cf4867812c06788f64c15e49abd909d9d6291f0a13f1c3f9cb649fa6127" "$lock_file" >/dev/null; then
  echo "compiled lock did not retain the attested LiveKit source hash" >&2
  exit 65
fi
if ! grep -F "torch==2.7.1+cu126" "$lock_file" >/dev/null \
  || ! grep -F "torchaudio==2.7.1+cu126" "$lock_file" >/dev/null; then
  echo "compiled lock must match the base image's PyTorch/TorchAudio 2.7.1 CUDA 12.6 pair" >&2
  exit 65
fi
docker build --pull=false --build-arg "BASE_IMAGE=$base_image" -f "${build_dir}/Dockerfile" -t "$1" .