From bcc71c6ca091b6ceca312be2a3562950edd8cdcc Mon Sep 17 00:00:00 2001
From: rob <rob@stakesquid.eu>
Date: Thu, 30 Jul 2026 07:49:13 +0000
Subject: [PATCH] build-image.sh: hard gates - submodule init (https rewrite),
 foundation republish to mavenLocal, clean build, in-image resource check (ss1
 shipped without compatible-clients.yaml and crash-looped the canary)

---
 build-image.sh | 31 ++++++++++++++++++++++++++++++-
 1 file changed, 30 insertions(+), 1 deletion(-)

diff --git a/build-image.sh b/build-image.sh
index 79c988b6..9410d7ee 100755
--- a/build-image.sh
+++ b/build-image.sh
@@ -23,10 +23,39 @@ SUFFIX=${2:-ss1}
 VER=${BASE_TAG#v}
 
 git tag -f "$BASE_TAG" HEAD >/dev/null   # local only - makes getVersion() exact-match
-docker build -q -t drpc-dshackle . >/dev/null
+
+# Submodules are REQUIRED at build time (SSH urls -> rewrite to https; controller
+# has no github key). The `public` submodule feeds foundation's resources
+# (compatible-clients.yaml etc.) - foundation is consumed as a mavenLocal
+# artifact, so it must be REPUBLISHED whenever the submodule moves, and the
+# main build cleaned so jib can't reuse stale layers. Skipping any of this
+# shipped a boot-crashing image on 2026-07-30 (ss1: Spring died on missing
+# compatible-clients.yaml) - hence the hard gate below.
+git config url."https://github.com/".insteadOf "git@github.com:" 2>/dev/null || true
+git submodule sync -q && git submodule update --init --recursive
+test -f foundation/src/main/resources/public/compatible-clients.yaml \
+    || { echo "FATAL: public submodule missing compatible-clients.yaml"; exit 1; }
+
 export JAVA_HOME=${JAVA_HOME:-/usr/lib/jvm/java-21-openjdk-amd64}
+./gradlew -p foundation publishToMavenLocal -q
+./gradlew clean -q
+docker build -q -t drpc-dshackle . >/dev/null
 ./gradlew jibDockerBuild -Djib.to.image="stakesquid/dshackle:${VER}-${SUFFIX}" -x test
 
+echo "--- resource gate (foundation jar inside the image):"
+docker run --rm --entrypoint sh "stakesquid/dshackle:${VER}-${SUFFIX}" -c \
+    'ls /app/libs/foundation-*.jar >/dev/null' || { echo FATAL: no foundation jar; exit 1; }
+python3 - "$VER" "$SUFFIX" <<'PY'
+import subprocess, sys, zipfile, io
+ver, suf = sys.argv[1], sys.argv[2]
+jar = subprocess.run(["docker", "run", "--rm", "--entrypoint", "sh",
+                      f"stakesquid/dshackle:{ver}-{suf}", "-c",
+                      "cat /app/libs/foundation-*.jar"], capture_output=True).stdout
+names = zipfile.ZipFile(io.BytesIO(jar)).namelist()
+assert "public/compatible-clients.yaml" in names, "FATAL: compatible-clients.yaml not packaged"
+print("resource gate OK: public/compatible-clients.yaml present in foundation jar")
+PY
+
 echo "--- wire version check (must equal stock ${VER}):"
 docker run --rm --entrypoint cat "stakesquid/dshackle:${VER}-${SUFFIX}" \
     /app/resources/version.properties