#!/bin/sh
# Rebuilds every lab repo from scratch and runs each experiment from the post, in order.
# Needs Docker. Network is used for pip installs and Skylos's PyPI/OSV lookups.
set -u
HERE=$(cd "$(dirname "$0")" && pwd)
WORK=${WORK:-$HERE/work}
rm -rf "$WORK"; mkdir -p "$WORK"
docker build -q -t skylos-lab:5.1.1 -f "$HERE/Dockerfile" "$HERE"
docker build -q -t skylos-lab:4.33.1 -f "$HERE/Dockerfile.v433" "$HERE"
run() { img=$1; dir=$2; shift 2; docker run --rm -v "$dir":/work -w /work -v "$HERE":/lab "$img" sh -c "git config --global --add safe.directory '*'; $*"; }

echo "### Step 2: the challenge as written"
mkdir "$WORK/challenge" && (cd "$WORK/challenge" && sh "$HERE/make_challenge.sh")
for v in 5.1.1 4.33.1; do
  echo "--- skylos $v: scan"; run skylos-lab:$v "$WORK/challenge" 'skylos . -a --format pretty; echo scan_exit=$?'
  echo "--- skylos $v: verify"; run skylos-lab:$v "$WORK/challenge" 'skylos verify . --file src/app.py --project-context; echo verify_exit=$?'
done

echo "### Step 3: eight hallucinations"
mkdir "$WORK/variants" && (cd "$WORK/variants" && sh "$HERE/make_variants.sh")
run skylos-lab:5.1.1 "$WORK/variants" '/lab/verify_each.sh --no-security --format json'
run skylos-lab:5.1.1 "$WORK/variants" '/lab/verify_each.sh --no-security --format json --project-context'
docker run --rm -v "$WORK/variants":/work -w /work/src python:3.12-slim sh -c \
  'pip -q install ruff==0.14.1 mypy==1.18.2 types-requests==2.32.4.20250913 2>/dev/null; ruff check --select F821 shop/; mypy --check-untyped-defs shop/'

echo "### Step 4: contract"
run skylos-lab:5.1.1 "$WORK/variants" 'skylos contract init >/dev/null; skylos verify . --file src/shop/h3_undefined_function.py --no-security --format short'

echo "### Steps 5-6: PR branches against the generated CI gate, and conftest"
mkdir "$WORK/prgate" && (cd "$WORK/prgate" && sh "$HERE/make_prgate.sh")
docker run --rm -v "$WORK/prgate":/work -v "$HERE":/lab skylos-lab:5.1.1 /lab/ci_gate.sh
docker run --rm -e GITHUB_TOKEN=ghs_fake_lab_value -v "$WORK/prgate":/work skylos-lab:5.1.1 sh -c '
  git config --global --add safe.directory "*"; cd /tmp && git clone -q /work r && cd r && git checkout -q pr-conftest
  skylos . -a >/dev/null 2>&1; skylos verify . >/dev/null 2>&1; ls /tmp/conftest-ran 2>&1
  skylos done --base origin/main | grep -E "Tests pass|Verdict"; cat /tmp/conftest-ran'

echo "### Step 7: dynamic code"
mkdir "$WORK/dynamic" && (cd "$WORK/dynamic" && sh "$HERE/make_dynamic.sh")
run skylos-lab:5.1.1 "$WORK/dynamic" 'skylos . --confidence 0 --format json' > "$WORK/dynamic.json"

echo "### Step 8: timing on mitmproxy v12.1.2 (takes a while)"
git clone -q --depth 1 --branch v12.1.2 https://github.com/mitmproxy/mitmproxy "$WORK/mitmproxy"
docker run --rm -e DEBIAN_FRONTEND=noninteractive -v "$WORK/mitmproxy":/work -v "$HERE":/lab skylos-lab:5.1.1 sh -c \
  'apt-get -qq update >/dev/null && apt-get -qq install -y bc >/dev/null 2>&1; pip -q install ruff==0.14.1 2>/dev/null; /lab/timing.sh'