# syntax=docker/dockerfile:1
#
# ngit-ci coordinator image (embedded-act runner).
#
# Build it yourself for now:
#
#   docker build -t ngit-ci .
#
# In the future we plan to build and publish this image via CI produced
# using this runner, once secrets support lands.
#
# The image contains the coordinator binary plus its host-side runtime
# dependencies (git, act). Job containers are created by act through the
# Docker-compatible daemon at DOCKER_HOST — never inside this container —
# so the image needs no container runtime of its own. See
# docker-compose.yml for the recommended docker-in-docker sidecar setup.

# --- Build the coordinator from source -------------------------------------
FROM rust:1-bookworm AS builder
WORKDIR /src
COPY . .
RUN cargo build --release --locked --bin ngit-ci

# --- Fetch a pinned act release ---------------------------------------------
# act must be >= 0.2.86: earlier releases are vulnerable to
# CVE-2026-34041 / CVE-2026-34042.
FROM debian:bookworm-slim AS act
ARG TARGETARCH
ARG ACT_VERSION=0.2.89
ARG ACT_SHA256_AMD64=0191d6f1f3b716b5c55820032605d05fc3c1cdbf581ebeff655019e5dd1524c0
ARG ACT_SHA256_ARM64=daa8679ba9615a74d2d0cec321dc593f21948a2a11bb65862b063d8b930f4bcb
RUN apt-get update \
 && apt-get install -y --no-install-recommends ca-certificates curl \
 && arch="${TARGETARCH:-$(dpkg --print-architecture)}" \
 && case "$arch" in \
      amd64) act_arch=x86_64; act_sha="$ACT_SHA256_AMD64" ;; \
      arm64) act_arch=arm64; act_sha="$ACT_SHA256_ARM64" ;; \
      *) echo "unsupported architecture: $arch" >&2; exit 1 ;; \
    esac \
 && curl -fsSL -o /tmp/act.tar.gz \
      "https://github.com/nektos/act/releases/download/v${ACT_VERSION}/act_Linux_${act_arch}.tar.gz" \
 && echo "${act_sha}  /tmp/act.tar.gz" | sha256sum -c - \
 && tar -xzf /tmp/act.tar.gz -C /usr/local/bin act

# --- Runtime image -----------------------------------------------------------
FROM debian:bookworm-slim
RUN apt-get update \
 && apt-get install -y --no-install-recommends git ca-certificates \
 && rm -rf /var/lib/apt/lists/* \
 && useradd --system --uid 1000 --create-home ngit-ci
COPY --from=act /usr/local/bin/act /usr/local/bin/act
COPY --from=builder /src/target/release/ngit-ci /usr/local/bin/ngit-ci

# /data holds everything the coordinator persists: the generated
# .coordinator.nsec identity key, the processed-event-ids file, and the
# work dir. Mount a volume here so the coordinator keeps its identity and
# dedupe state across container restarts.
ENV NGIT_CI_WORK_DIR=/data/work \
    NGIT_CI_PROCESSED_IDS_PATH=/data/processed-ids.json
WORKDIR /data
RUN chown ngit-ci:ngit-ci /data
USER ngit-ci
VOLUME /data

ENTRYPOINT ["/usr/local/bin/ngit-ci"]
