# syntax=docker/dockerfile:1

FROM node:22-alpine AS app-build
WORKDIR /src
COPY package.json package-lock.json tsconfig.json ./
RUN npm ci
COPY src ./src
RUN npm run build && npm prune --omit=dev

FROM docker.io/gitea/runner:1.0.8

ARG TARGETARCH=amd64
ARG OPENCODE_VERSION=1.17.18
ARG GITEA_MCP_VERSION=1.3.0

USER root

RUN apk add --no-cache \
      ca-certificates \
      coreutils \
      curl \
      jq \
      nodejs \
      npm \
      openssh-client \
      tar \
    && npm install --global --omit=dev "opencode-ai@${OPENCODE_VERSION}" \
    && case "${TARGETARCH}" in \
         amd64) asset="gitea-mcp_Linux_x86_64.tar.gz"; sha="99e144ee9821c8ef26dfb05daa3351435ed55eb56bd1b7418c4f7b573cc92ce2" ;; \
         arm64) asset="gitea-mcp_Linux_arm64.tar.gz"; sha="07dd4b6823c145baee817ad664043cc26ce5903d0358693949b0ee2da18d4b62" ;; \
         *) echo "Unsupported TARGETARCH: ${TARGETARCH}" >&2; exit 1 ;; \
       esac \
    && curl --fail --location --output "/tmp/${asset}" \
         "https://gitea.com/gitea/gitea-mcp/releases/download/v${GITEA_MCP_VERSION}/${asset}" \
    && printf '%s  %s\n' "${sha}" "/tmp/${asset}" | sha256sum --check - \
    && tar -xzf "/tmp/${asset}" -C /tmp \
    && install -m 0755 /tmp/gitea-mcp /usr/local/bin/gitea-mcp \
    && rm -rf "/tmp/${asset}" /tmp/gitea-mcp

RUN addgroup -g 10001 ci-agent \
    && adduser -D -u 10001 -G ci-agent -h /home/ci-agent ci-agent \
    && install -d -o ci-agent -g ci-agent -m 0700 \
         /data \
         /var/lib/opencode-ci/data \
         /var/lib/opencode-ci/cache \
    && install -d -o root -g root -m 0555 \
         /opt/ci-agents/empty-config \
         /opt/ci-agents/empty-config/opencode

COPY --from=app-build /src/dist /opt/ci-agents/dist
COPY --from=app-build /src/node_modules /opt/ci-agents/node_modules
COPY opencode /opt/ci-agents/opencode
COPY bin/git-askpass.sh /opt/ci-agents/bin/git-askpass.sh

RUN chmod -R a-w /opt/ci-agents \
    && chmod 0555 /opt/ci-agents/bin/git-askpass.sh \
    && ln -s /opt/ci-agents/dist/cli.js /usr/local/bin/olixero-ci-agent

ENV HOME=/home/ci-agent \
    XDG_DATA_HOME=/var/lib/opencode-ci/data \
    XDG_CONFIG_HOME=/opt/ci-agents/empty-config \
    XDG_CACHE_HOME=/var/lib/opencode-ci/cache

USER ci-agent