# Builds an image that runs alakazam together with the abra version pinned by the submodule.

# keep in step with GOVERSION in abra/Makefile, a FROM cannot read it from there
ARG GO_VERSION=1.26

FROM golang:${GO_VERSION} AS abra
WORKDIR /src
COPY abra/ ./
COPY .git/modules/abra /gitdir
# abra ships its dependencies in vendor/, so the build itself needs no network
RUN set -eu; \
  sed -i '/worktree =/d' /gitdir/config; \
  version="$(git --git-dir=/gitdir describe --tags)"; \
  commit="$(git --git-dir=/gitdir rev-parse HEAD)"; \
  echo "building abra $version"; \
  go build -mod=vendor -trimpath \
  -ldflags "-s -w -X 'main.Version=$version' -X 'main.Commit=$commit'" \
  -o /out/abra ./cmd/abra

FROM python:3.11-slim AS deps
RUN apt-get update \
  && apt-get install -y --no-install-recommends gcc libc6-dev \
  && rm -rf /var/lib/apt/lists/*
COPY requirements.txt /tmp/requirements.txt
RUN python -m venv /opt/alakazam \
  && /opt/alakazam/bin/pip install --no-cache-dir -r /tmp/requirements.txt

FROM python:3.11-slim
# git: alakazam syncs the recipe repos itself. openssh-client: abra reaches the servers over
# ssh. argon2: recipes hash secrets locally in their abra.sh, vaultwarden's admin token does
RUN apt-get update \
  && apt-get install -y --no-install-recommends git openssh-client make argon2 \
  && rm -rf /var/lib/apt/lists/* \
  && git config --global --add safe.directory '*'

COPY --from=abra /out/abra /usr/local/bin/abra
COPY --from=deps /opt/alakazam /opt/alakazam
COPY alakazam.py combine.yml /opt/alakazam/
RUN printf '#!/bin/sh\nexec /opt/alakazam/bin/python /opt/alakazam/alakazam.py "$@"\n' \
  > /usr/local/bin/alakazam \
  && chmod +x /usr/local/bin/alakazam

# PYTHONUNBUFFERED so the streamed hook output arrives while a command is still running.
# LANG pins abra to its untranslated messages, which alakazam matches on to tell a missing
# secret or an empty generate run apart from a real failure.
ENV PYTHONUNBUFFERED=1 \
  LANG=C.UTF-8 \
  ABRA_DIR=/root/.abra

WORKDIR /config
CMD ["alakazam", "--help"]