# syntax=docker/dockerfile:1
FROM rust:1-bookworm AS rust-deps

RUN apt-get update && apt-get install -y --no-install-recommends \
        pkg-config \
        libssl-dev \
        cmake \
        perl \
        git \
        curl \
        ca-certificates \
        unzip \
        protobuf-compiler \
    && rm -rf /var/lib/apt/lists/*

RUN curl -fsSL https://bun.sh/install | bash
ENV BUN_INSTALL=/root/.bun
ENV PATH=$BUN_INSTALL/bin:$PATH

WORKDIR /build

COPY Cargo.toml Cargo.lock ./


FROM rust-deps AS builder
COPY lib ./lib
COPY app ./app
COPY web ./web

RUN --mount=type=cache,target=/usr/local/cargo/registry \
    --mount=type=cache,target=/usr/local/cargo/git \
    --mount=type=cache,target=/build/target \
    rm -rf /build/target/release/build/web-* \
           /build/target/release/deps/web-* 2>/dev/null; \
    cargo build --release --workspace --bins && \
    mkdir -p /out && \
    for b in apihost githost synchost searchhost mails migrate openapi im adminhost webhook runner aihost mcp; do \
        cp "target/release/$b" /out/; \
    done

# The runner shells out to `docker run` for `container:` jobs; ship just the
# static CLI so the image stays daemon-free.
RUN curl -fsSL "https://mirrors.aliyun.com/docker-ce/linux/static/stable/x86_64/docker-27.3.1.tgz" -o /tmp/docker.tgz \
    && tar -xzf /tmp/docker.tgz -C /tmp \
    && cp /tmp/docker/docker /out/docker \
    && rm -rf /tmp/docker /tmp/docker.tgz

########## actions engine ##########
# The server side of CI (workflow parse/trigger/evaluate/expand, cron matching,
# OIDC) shells out to `gitdata-actions-engine` on every operation, not just the
# runner; ship it in this image too.
FROM golang:1.27-bookworm AS actions-engine

WORKDIR /src
COPY act/go.mod act/go.sum ./
COPY act/cmd ./cmd
COPY act/pkg ./pkg

RUN --mount=type=cache,target=/go/pkg/mod \
    --mount=type=cache,target=/root/.cache/go-build \
    CGO_ENABLED=0 go build -trimpath -ldflags="-s -w" \
    -o /out/gitdata-actions-engine ./cmd/gitdata-actions-engine

########## runtime ##########
FROM debian:bookworm-slim

# git: githost/synchost spawn system git; openssh-client: ssh-keygen for host key
RUN apt-get update && apt-get install -y --no-install-recommends \
        git \
        ca-certificates \
        libssl3 \
        openssh-client \
    && rm -rf /var/lib/apt/lists/* \
    && useradd --system --create-home --uid 10001 gitdata \
    && mkdir -p /opt/gitdata/repos /opt/gitdata/objects /var/lib/gitdata-runner \
    && chown -R gitdata:gitdata /opt/gitdata /var/lib/gitdata-runner

WORKDIR /app

COPY --chown=gitdata:gitdata config/default.toml config/default.toml
COPY --from=builder /out/apihost /out/githost /out/synchost /out/searchhost /out/mails /out/migrate /out/openapi /out/im /out/adminhost /out/webhook /out/runner /out/aihost /out/mcp /usr/local/bin/

COPY --from=builder /out/docker /usr/local/bin/docker

# `gitdata-actions-engine` is spawned by the CI service (lib/ci/src/actions.rs:145)
# as well as by the runner, so the default APP_CI__ACTIONS_ENGINE_BINARY value
# (a bare name resolved via PATH) works in every role.
COPY --from=actions-engine /out/gitdata-actions-engine /usr/local/bin/gitdata-actions-engine

USER gitdata

EXPOSE 3000 9418 22 3001 3002 3003 3004 3005 3006 3007 3014

CMD ["apihost"]