"""Local qualification images, exact baseline source; no ports or deployment.

Uses inherited session proxy and mounted CA with verification enabled. Never
prints proxy credentials or changes Docker registry authentication.
"""
import os,socket,subprocess,tempfile
from pathlib import Path
from urllib.parse import urlparse


def main():
    env=dict(os.environ)
    for key in ('DOCKER_HOST','DOCKER_CONTEXT','DOCKER_TLS','DOCKER_TLS_VERIFY','DOCKER_CERT_PATH'):env.pop(key,None)
    D=['docker','--host=unix:///var/run/docker.sock'];base=D+['build','--secret','id=cloud_ca,src=/etc/ssl/certs/ca-certificates.crt']
    proxy=urlparse(env.get('HTTPS_PROXY','')).hostname
    if proxy:base+=['--add-host',f'{proxy}:{socket.gethostbyname(proxy)}']
    for key in ('HTTP_PROXY','HTTPS_PROXY','http_proxy','https_proxy'):
        if env.get(key):base+=['--build-arg',key]
    root=Path.cwd()
    with tempfile.TemporaryDirectory(prefix='needle-workflow-build-') as directory:
        env['BUILDX_CONFIG']=str(Path(directory)/'buildx')
        source=Path(directory)/'baseline'
        subprocess.run(['git','worktree','add','--detach',str(source),'ef25f06c0cebea319abaed86f49dffacd96938ce'],check=True)
        try:
            builds=[(source,['--target','runtime'],'needle-gateway-v2:coverage'),(root,['--target','tests'],'needle-gateway-v2:workflow-tests'),(root,['--target','runtime'],'needle-gateway-v2:workflow'),(root,['-f','Dockerfile.workflow-qualification'],'needle-gateway-v2:workflow-qualification')]
            for cwd,options,tag in builds:subprocess.run(base+options+['-t',tag,'.'],cwd=cwd,env=env,check=True)
        finally:subprocess.run(['git','worktree','remove',str(source)],check=True)

if __name__=='__main__':main()