ARG TEA_VERSION=0.14.2

FROM node:24-bookworm-slim AS agent-tools

ARG CODEGRAPH_VERSION=1.3.1
ARG AGENTCI_OPENCODE_VERSION=^1
RUN npm install --global \
    "opencode-ai@${AGENTCI_OPENCODE_VERSION}" \
    "@colbymchenry/codegraph@${CODEGRAPH_VERSION}" \
    && version="$(opencode --version)" \
    && case "$version" in 1.*) ;; *) echo "Expected OpenCode 1.x, got $version" >&2; exit 1;; esac

FROM ghcr.io/astral-sh/uv:0.8.14 AS uv

FROM gitea/tea:${TEA_VERSION} AS tea

FROM python:3.13-slim-bookworm

ENV PYTHONDONTWRITEBYTECODE=1 \
    PYTHONUNBUFFERED=1 \
    UV_LINK_MODE=copy \
    UV_NO_DEV=1 \
    CODEGRAPH_TELEMETRY=0 \
    XDG_CONFIG_HOME=/run/agentci \
    PATH=/opt/agentci/.venv/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin

RUN apt-get update \
    && apt-get install --yes --no-install-recommends \
        adduser ca-certificates curl git libgcc-s1 libgssapi-krb5-2 \
        libicu72 libssl3 libstdc++6 zlib1g \
    && rm -rf /var/lib/apt/lists/* \
    && /usr/sbin/adduser --disabled-password --gecos "" --uid 10001 agentci \
    && mkdir -p /opt/agentci /var/lib/agentci /var/lib/opencode \
        /etc/opencode/home/.opencode /etc/opencode/xdg/opencode /run/agentci \
    && chmod 0555 /etc/opencode/home /etc/opencode/home/.opencode \
        /etc/opencode/xdg /etc/opencode/xdg/opencode \
    && chown agentci:agentci /run/agentci

COPY --from=uv /uv /uvx /usr/local/bin/
COPY --from=tea /bin/tea /usr/local/libexec/tea
COPY --from=agent-tools /usr/local/bin/node /usr/local/bin/node
COPY --from=agent-tools /usr/local/lib/node_modules/opencode-ai/bin/opencode.exe /usr/local/bin/opencode
COPY --from=agent-tools /usr/local/lib/node_modules/@colbymchenry /usr/local/lib/node_modules/@colbymchenry
RUN ln -s /usr/local/lib/node_modules/@colbymchenry/codegraph/npm-shim.js \
        /usr/local/bin/codegraph

WORKDIR /opt/agentci
COPY pyproject.toml uv.lock README.md ./
COPY src ./src
COPY scripts ./scripts
COPY install-scripts /etc/agentci/install-scripts
COPY opencode /etc/opencode

RUN chmod 0755 \
        /opt/agentci/scripts/entrypoint.sh \
        /opt/agentci/scripts/gitea-askpass.sh \
        /opt/agentci/scripts/tea.sh \
        /usr/local/libexec/tea \
        /usr/local/bin/opencode \
        /usr/local/bin/codegraph \
    && ln -s /opt/agentci/scripts/tea.sh /usr/local/bin/tea \
    && uv sync --frozen --no-dev \
    && chown -R agentci:agentci /opt/agentci /var/lib/agentci /var/lib/opencode \
    && opencode --version \
    && OPENCODE_CONFIG=/etc/opencode/opencode.json \
        OPENCODE_DISABLE_PROJECT_CONFIG=1 \
        OPENCODE_PURE=1 \
        AGENTCI_RESEARCH_MODEL=openai/gpt-5.6-luna \
        AGENTCI_RESEARCH_VARIANT=high \
        CONTEXT7_API_KEY= \
        opencode debug config >/dev/null

USER agentci
EXPOSE 8080

HEALTHCHECK --interval=30s --timeout=5s --start-period=10s --retries=3 \
  CMD ["python", "-c", "import urllib.request; urllib.request.urlopen('http://127.0.0.1:8080/health/live')"]

ENTRYPOINT ["/opt/agentci/scripts/entrypoint.sh"]
CMD ["agentci"]