FROM rust:1.94-bookworm AS builder

WORKDIR /app
COPY . .
# compliance-agent depends on the private tramiton-core git repo. Authenticate
# the fetch with a PAT passed as a BuildKit secret (never baked into a layer).
# Build with: DOCKER_BUILDKIT=1 docker build --secret id=tramiton_token,env=TRAMITON_FETCH_TOKEN ...
RUN --mount=type=secret,id=tramiton_token \
    if [ -s /run/secrets/tramiton_token ]; then \
      git config --global \
        url."https://sharang:$(cat /run/secrets/tramiton_token)@gitea.meghsakha.com/".insteadOf \
        "ssh://git@gitea.meghsakha.com:22222/"; \
    fi && \
    CARGO_NET_GIT_FETCH_WITH_CLI=true cargo build --release -p compliance-agent

FROM debian:bookworm-slim
RUN apt-get update && apt-get install -y ca-certificates libssl3 git curl python3 python3-pip npm golang-go php-cli && rm -rf /var/lib/apt/lists/*

# Install Cargo (minimal, for cargo metadata / cargo audit / generate-lockfile)
RUN curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y --default-toolchain stable --profile minimal
ENV PATH="/root/.cargo/bin:${PATH}"
RUN cargo install cargo-audit

# Install Composer for PHP dependency resolution
RUN curl -sS https://getcomposer.org/installer | php -- --install-dir=/usr/local/bin --filename=composer

# Install Bundler for Ruby dependency resolution
RUN apt-get update && apt-get install -y ruby && rm -rf /var/lib/apt/lists/* && gem install bundler

# Install syft for SBOM generation
RUN curl -sSfL https://raw.githubusercontent.com/anchore/syft/main/install.sh | sh -s -- -b /usr/local/bin

# Install gitleaks for secret detection
RUN curl -sSfL https://github.com/gitleaks/gitleaks/releases/download/v8.21.2/gitleaks_8.21.2_linux_x64.tar.gz \
    | tar -xz -C /usr/local/bin gitleaks

# Install semgrep for static analysis
RUN pip3 install --break-system-packages semgrep

# Install ruff for Python linting
RUN pip3 install --break-system-packages ruff

# Install nix-portable (rootless nix) so the firmware-SBOM pipeline can drive a
# tramiton reproducible build (NixBackend). Best-effort: if the download fails,
# the agent falls back to analysis-only firmware SBOMs (never breaks a scan).
# The nix store lives under NP_LOCATION — mount a PERSISTENT volume there in the
# deployment, else every firmware scan re-fetches nixpkgs + cross toolchains.
ARG NIX_PORTABLE_VERSION=v012
RUN curl -fsSL -o /usr/local/bin/nix-portable \
      "https://github.com/DavHau/nix-portable/releases/download/${NIX_PORTABLE_VERSION}/nix-portable-x86_64" \
    && chmod +x /usr/local/bin/nix-portable \
    || { rm -f /usr/local/bin/nix-portable; echo "WARN: nix-portable install skipped; firmware SBOM uses analysis-only fallback"; }
ENV NP_LOCATION=/data/compliance-scanner
RUN mkdir -p /data/compliance-scanner

COPY --from=builder /app/target/release/compliance-agent /usr/local/bin/compliance-agent

# Copy documentation for the help chat assistant
COPY --from=builder /app/README.md /app/README.md
COPY --from=builder /app/docs /app/docs
ENV HELP_DOCS_PATH=/app

# Ensure SSH key directory exists
RUN mkdir -p /data/compliance-scanner/ssh

EXPOSE 3001 3002

ENTRYPOINT ["compliance-agent"]