# syntax=docker/dockerfile:1

FROM node:24-alpine AS app-build
WORKDIR /src/app
COPY app/package.json app/package-lock.json ./
COPY app/config/tsconfig.json ./config/tsconfig.json
RUN npm ci
COPY app/src ./src
RUN npm run build && npm prune --omit=dev

FROM node:24-alpine AS runtime
RUN apk add --no-cache ca-certificates coreutils git openssh-client \
    && addgroup -g 10001 ci-agent \
    && adduser -D -u 10001 -G ci-agent -h /home/ci-agent ci-agent \
    && install -d -o ci-agent -g ci-agent -m 0700 \
    /var/lib/gitea-agent/state \
    /var/lib/gitea-agent/workspaces \
    /var/lib/opencode-agent/data \
    /var/lib/opencode-agent/state \
    /var/lib/opencode-agent/cache \
    && install -d -o root -g root -m 0555 \
    /opt/ci-agents

COPY --from=app-build /src/app/dist /opt/ci-agents/dist
COPY --from=app-build /src/app/node_modules /opt/ci-agents/node_modules
COPY app/scripts/git-askpass.sh /opt/ci-agents/bin/git-askpass.sh

RUN chmod -R a-w /opt/ci-agents \
    && chmod 0555 /opt/ci-agents/bin/git-askpass.sh

ENV HOME=/home/ci-agent \
    NODE_ENV=production \
    AGENT_DB_PATH=/var/lib/gitea-agent/state/agent.db \
    AGENT_WORKSPACE_ROOT=/var/lib/gitea-agent/workspaces

WORKDIR /opt/ci-agents
USER ci-agent

FROM runtime AS controller
EXPOSE 8080
CMD ["node", "/opt/ci-agents/dist/application/controller/main.js"]

FROM runtime AS executor
ARG TARGETARCH=amd64
ARG OPENCODE_VERSION=1.18.2
ARG GITEA_MCP_VERSION=1.3.0
USER root
RUN npm install --global --omit=dev "opencode-ai@${OPENCODE_VERSION}" \
    && case "${TARGETARCH}" in \
    amd64) asset="gitea-mcp_Linux_x86_64.tar.gz"; sha="99e144ee9821c8ef26dfb05daa3351435ed55eb56bd1b7418c4f7b573cc92ce2" ;; \
    arm64) asset="gitea-mcp_Linux_arm64.tar.gz"; sha="07dd4b6823c145baee817ad664043cc26ce5903d0358693949b0ee2da18d4b62" ;; \
    *) echo "Unsupported TARGETARCH: ${TARGETARCH}" >&2; exit 1 ;; \
    esac \
    && wget -q -O "/tmp/${asset}" "https://gitea.com/gitea/gitea-mcp/releases/download/v${GITEA_MCP_VERSION}/${asset}" \
    && printf '%s  %s\n' "${sha}" "/tmp/${asset}" | sha256sum --check - \
    && tar -xzf "/tmp/${asset}" -C /tmp \
    && install -m 0755 /tmp/gitea-mcp /usr/local/bin/gitea-mcp \
    && rm -f "/tmp/${asset}" /tmp/gitea-mcp

COPY opencode /opt/ci-agents/opencode
RUN touch /opt/ci-agents/opencode/.gitignore \
    && chmod -R a-w /opt/ci-agents

ENV XDG_DATA_HOME=/var/lib/opencode-agent/data \
    XDG_CONFIG_HOME=/var/lib/opencode-agent/state \
    XDG_STATE_HOME=/var/lib/opencode-agent/state \
    XDG_CACHE_HOME=/var/lib/opencode-agent/cache \
    OPENCODE_CONFIG_DIR=/opt/ci-agents/opencode \
    OPENCODE_DISABLE_PROJECT_CONFIG=true \
    OPENCODE_DISABLE_EXTERNAL_SKILLS=true

USER ci-agent
CMD ["node", "/opt/ci-agents/dist/application/execution/main.js"]