FROM ubuntu:24.04@sha256:84e77dee7d1bc93fb029a45e3c6cb9d8aa4831ccfcc7103d36e876938d28895b

LABEL org.opencontainers.image.title="ci-base" \
      org.opencontainers.image.description="Base image for CI pipelines (Go, GoReleaser, Bun, Docker CLI)" \
      org.opencontainers.image.source="https://git.nakama.town/fmartingr/ci-images"

ARG TARGETARCH

# Go toolchain version (e.g., 1.26.1)
ARG GO_VERSION=1.26.1
ARG GO_SHA256_AMD64="031f088e5d955bab8657ede27ad4e3bc5b7c1ba281f05f245bcc304f327c987a"
ARG GO_SHA256_ARM64="a290581cfe4fe28ddd737dde3095f3dbeb7f2e4065cab4eae44dfc53b760c2f7"

# Bun runtime version (pin to specific version for reproducibility)
ARG BUN_VERSION=1.3.11

ENV DEBIAN_FRONTEND=noninteractive
ENV PATH="/usr/local/go/bin:/root/go/bin:${PATH}"

# Install system packages, add third-party repositories, and install from them
RUN apt-get update && \
    apt-get install -y --no-install-recommends \
        ca-certificates \
        curl \
        git \
        make \
        unzip \
        gnupg \
        jq \
        upx-ucl \
        nodejs \
        build-essential \
    && \
    # Add Docker repository (https://docs.docker.com/engine/install/ubuntu/)
    install -m 0755 -d /etc/apt/keyrings && \
    curl -fsSL https://download.docker.com/linux/ubuntu/gpg -o /etc/apt/keyrings/docker.asc && \
    chmod a+r /etc/apt/keyrings/docker.asc && \
    printf 'Types: deb\nURIs: https://download.docker.com/linux/ubuntu\nSuites: noble\nComponents: stable\nSigned-By: /etc/apt/keyrings/docker.asc\n' \
        > /etc/apt/sources.list.d/docker.sources && \
    # Add GoReleaser repository (https://goreleaser.com/install/#apt)
    echo 'deb [trusted=yes] https://repo.goreleaser.com/apt/ /' \
        > /etc/apt/sources.list.d/goreleaser.list && \
    # Install Docker CLI and GoReleaser from third-party repos
    apt-get update && \
    apt-get install -y --no-install-recommends \
        docker-ce-cli \
        docker-buildx-plugin \
        docker-compose-plugin \
        goreleaser \
    && rm -rf /var/lib/apt/lists/*

# Install Go (with checksum verification)
RUN curl -fsSL -o go.tar.gz "https://go.dev/dl/go${GO_VERSION}.linux-${TARGETARCH}.tar.gz" && \
    case "${TARGETARCH}" in \
        amd64) echo "${GO_SHA256_AMD64}  go.tar.gz" | sha256sum -c - ;; \
        arm64) echo "${GO_SHA256_ARM64}  go.tar.gz" | sha256sum -c - ;; \
        *) echo "Unsupported architecture: ${TARGETARCH}" && exit 1 ;; \
    esac && \
    tar -C /usr/local -xzf go.tar.gz && \
    rm go.tar.gz && \
    go version

# Install Bun (from GitHub release binaries)
# Bun uses x64/aarch64 naming convention
RUN case "${TARGETARCH}" in \
        amd64) BUN_ARCH="x64" ;; \
        arm64) BUN_ARCH="aarch64" ;; \
        *) echo "Unsupported architecture: ${TARGETARCH}" && exit 1 ;; \
    esac && \
    curl -fsSL "https://github.com/oven-sh/bun/releases/download/bun-v${BUN_VERSION}/bun-linux-${BUN_ARCH}.zip" \
        -o /tmp/bun.zip && \
    unzip -o /tmp/bun.zip -d /tmp/bun && \
    install -m 0755 /tmp/bun/bun-linux-${BUN_ARCH}/bun /usr/local/bin/bun && \
    rm -rf /tmp/bun /tmp/bun.zip && \
    bun --version

# Install husky globally via bun (for git hooks management in CI)
ENV BUN_INSTALL="/usr/local"
RUN bun install -g husky && \
    command -v husky

# Verify all installations
RUN echo "=== Installed versions ===" && \
    go version && \
    goreleaser --version && \
    bun --version && \
    docker --version && \
    docker buildx version && \
    node --version && \
    upx --version | head -1 && \
    git --version && \
    command -v husky && \
    echo "=== All tools installed ==="