#!/usr/bin/env bash
# Drops from root (needed to read the Go toolchain and module cache under
# /usr/local/go and /opt/go) to a user matching the host's UID/GID, so
# anything written into the bind-mounted repo (hacked/_build/, ...) is owned
# by the host user instead of root.
set -euo pipefail

USER_UID="${HOST_UID:-1000}"
USER_GID="${HOST_GID:-1000}"

groupadd -g "$USER_GID" builder 2>/dev/null || true
useradd -u "$USER_UID" -g "$USER_GID" -m -s /bin/bash builder 2>/dev/null || true

# /workspace (the bind-mounted repo) may actually be owned by a group the
# host user only has via *supplementary* membership rather than their
# primary GID above - e.g. a VirtualBox vboxsf shared folder, which shows
# up as root:vboxsf on the host and would otherwise be inaccessible to
# `builder` here (falls through to "other", which vboxsf's default mode
# leaves with no permissions at all). Join whatever group actually owns
# /workspace too, if it differs.
WORKSPACE_GID="$(stat -c %g /workspace 2>/dev/null || true)"
if [ -n "$WORKSPACE_GID" ] && [ "$WORKSPACE_GID" != "$USER_GID" ]; then
    groupadd -g "$WORKSPACE_GID" workspace 2>/dev/null || true
    usermod -aG "$WORKSPACE_GID" builder 2>/dev/null || true
fi

# The Go module cache under /opt/go was populated as root at image-build
# time (see Dockerfile) - readable by anyone, but go build also wants to
# write GOCACHE (build cache) under there by default. Point it at a
# per-run tmpfs-friendly location inside the builder's own home instead of
# fighting permissions on the image's baked-in GOPATH.
export GOCACHE=/home/builder/.cache/go-build
export GOMODCACHE=/opt/go/pkg/mod

exec gosu builder "$@"