# Auditor image: a disposable environment holding opencode plus a deterministic
# security toolchain. No host credentials are baked in; the only secret reaching
# a running container is the read-only opencode auth.json mounted at runtime.
#
# Everything that needs the network is fetched HERE, at build time, where the
# daemon has normal egress. At RUN time the container sits on an internal
# network whose only exit is the allowlist proxy, so the scanners must be
# fully offline: hence the baked Go vulnerability database and semgrep rules.
# 1.27.1 to match the project's go.mod directive (staticcheck needs 1.26+;
# GOTOOLCHAIN=local, so the base version is the version you get.
FROM golang:1.27.1-bookworm

RUN apt-get update && apt-get install -y --no-install-recommends \
      git ripgrep ca-certificates curl unzip jq python3 python3-venv \
    && rm -rf /var/lib/apt/lists/*

# opencode via the vendor install script (a platform binary, so no Node runtime).
RUN curl -fsSL https://opencode.ai/install | bash
# GOPATH is /go in the official images, so `go install` lands in /go/bin.
# Login shells reset PATH from /etc/profile, so the tools are also symlinked
# into /usr/local/bin below — never rely on this ENV alone.
ENV PATH="/root/.opencode/bin:/go/bin:${PATH}"

# Go security tooling.
#   gosec        — Go-specific insecure patterns (G1xx-G7xx), fully offline
#   govulncheck  — known CVEs filtered by symbol-level reachability
#   staticcheck  — correctness bugs (nil derefs, races) behind security bugs
#   gitleaks     — committed secrets
RUN go install github.com/securego/gosec/v2/cmd/gosec@latest \
 && go install golang.org/x/vuln/cmd/govulncheck@latest \
 && go install honnef.co/go/tools/cmd/staticcheck@latest \
 && go install github.com/zricethezav/gitleaks/v8@latest \
 && ln -s /go/bin/gosec /go/bin/govulncheck /go/bin/staticcheck /go/bin/gitleaks \
          /usr/local/bin/

# semgrep plus its rule corpus, cloned for offline use (--config auto would
# hit the registry and report the project URL upstream; we never use it).
RUN python3 -m venv /opt/semgrep \
 && /opt/semgrep/bin/pip install --no-cache-dir --quiet semgrep \
 && ln -s /opt/semgrep/bin/semgrep /usr/local/bin/semgrep \
 && git clone --depth 1 https://github.com/semgrep/semgrep-rules /opt/semgrep-rules

# Offline Go vulnerability database: any file:// directory implements the API,
# so govulncheck runs with no network at all.
RUN curl -sL https://vuln.go.dev/vulndb.zip -o /tmp/vulndb.zip \
 && mkdir -p /opt/vulndb \
 && unzip -q /tmp/vulndb.zip -d /opt/vulndb \
 && rm /tmp/vulndb.zip

# Bake the project's module cache so govulncheck and staticcheck can load
# packages with no network at run time. prepare.sh exports .code/ before it
# builds, so these files are present in the build context.
COPY .code/go.mod .code/go.sum /build/
RUN cd /build && go mod download

ENV SEMGREP_SEND_METRICS=off
WORKDIR /src
CMD ["opencode", "--version"]