# CI base image for tftio/silent-critic.
#
# Built and pushed to $CI_REGISTRY_IMAGE/ci:<rust-version> by the
# `ci-image` job in .gitlab-ci.yml. Triggered automatically when this
# file or rust-toolchain.toml changes; otherwise can be run manually.
#
# Bakes in the Rust toolchain so jobs never need to call out to
# static.rust-lang.org at run time — the self-hosted runner's
# intermittent DNS failures during rustup channel-sync are eliminated.
#
# When bumping the Rust toolchain:
#   1. Update rust-toolchain.toml (single source of truth).
#   2. Update the FROM tag below to match.
#   3. Update CI_BASE_IMAGE in .gitlab-ci.yml's `variables:` block.
#   4. Push; the ci-image job will rebuild before any consumers run.
FROM rust:1.95.0

RUN apt-get update \
 && apt-get install -y --no-install-recommends \
      ca-certificates \
      gcc-aarch64-linux-gnu \
      libc6-dev-arm64-cross \
      libssl-dev \
      pkg-config \
 && rm -rf /var/lib/apt/lists/*

# aarch64 cross target for build-linux-arm64.
RUN rustup target add aarch64-unknown-linux-gnu

# Quality + release tooling. release-plz can run cargo-semver-checks against
# the crate's library surface on each release; including it here keeps that
# check available rather than skipped-with-a-warning.
RUN cargo install --locked \
      cargo-audit \
      cargo-deny \
      cargo-semver-checks

# release-plz binary (statically-linked release).
RUN curl -fsSL https://github.com/MarcoIeni/release-plz/releases/latest/download/release-plz-x86_64-unknown-linux-gnu.tar.gz \
    | tar xz -C /usr/local/bin \
 && chmod +x /usr/local/bin/release-plz

# Pre-warm the RustSec advisory database. cargo-audit and cargo-deny
# each clone https://github.com/RustSec/advisory-db at job time; baking a
# clone into the image turns the job-time fetch into a fast incremental
# update.
#   - cargo-audit reads $CARGO_HOME/advisory-db by default.
#   - cargo-deny manages its own cache under $CARGO_HOME/advisory-dbs;
#     `cargo deny fetch db` populates it without needing a manifest or
#     deny.toml in the working directory.
# Both keep fetching enabled at job time, so advisories stay current —
# the bake just removes the cold-clone penalty.
RUN git clone https://github.com/RustSec/advisory-db.git \
      "$CARGO_HOME/advisory-db" \
 && mkdir -p /tmp/deny-warm/src \
 && printf '[package]\nname = "warm"\nversion = "0.0.0"\nedition = "2021"\n' \
      > /tmp/deny-warm/Cargo.toml \
 && touch /tmp/deny-warm/src/lib.rs \
 && (cd /tmp/deny-warm && cargo deny fetch db) \
 && rm -rf /tmp/deny-warm
