# agent-flow repo env image (ADR-024) — the tag `project.image` rows point at
# for projects whose repo is agent-flow. One image serves BOTH job legs:
#   * gate leg: gate cmds via `--entrypoint /bin/sh -c` (run-unit-tests.sh
#     runs cargo test --lib + `archspec verify --strict`) + git + archspec;
#   * agent leg: same shape with the opencode CLI on PATH.
# ENTRYPOINT is always overridden by the launcher, so none is set here; the
# contract is `/bin/sh` + `opencode` on PATH. `node` deliberately absent:
# zero node/npm invocations in run-unit-tests.sh.
ARG RUST_VERSION=1.94.1
FROM rust:${RUST_VERSION}-bookworm

# git + curl ship in the rust:1.94.1-bookworm base (bookworm-derived).

# archspec — run-unit-tests.sh runs `archspec verify --strict` per crate and
# fails closed without the binary (run-unit-tests.sh ARCHSPEC contract).
# musl static build, sha256-pinned (release v0.5.0 asset).
ARG ARCHSPEC_VERSION=0.5.0
RUN curl -fsSLo /tmp/archspec.tar.gz \
      "https://github.com/mateuszwrobel/archspec/releases/download/v${ARCHSPEC_VERSION}/archspec-${ARCHSPEC_VERSION}-x86_64-unknown-linux-musl.tar.gz" \
 && echo "492cf11237849173b097b66e0a6ab0b764c8bb438156e58e105a4070d2105181  /tmp/archspec.tar.gz" | sha256sum -c - \
 && tar -xzf /tmp/archspec.tar.gz -C /usr/local/bin \
 && rm /tmp/archspec.tar.gz \
 && archspec --help >/dev/null

# opencode CLI — agent-leg entrypoint binary; version pin shared with
# sorprop/images/opencode/Dockerfile (v1.18.31). GNU build for this Debian
# base (that Dockerfile uses the musl build on alpine).
ARG OPENCODE_VERSION=v1.18.31
RUN curl -fsSLo /tmp/opencode.tar.gz \
      "https://github.com/anomalyco/opencode/releases/download/${OPENCODE_VERSION}/opencode-linux-x64.tar.gz" \
 && echo "e9312be75ed803b7415fc2aeabda1f4fe938912a39673762dc0c38c0e11ebde4  /tmp/opencode.tar.gz" | sha256sum -c - \
 && tar -xzf /tmp/opencode.tar.gz -C /usr/local/bin \
 && rm /tmp/opencode.tar.gz \
 && opencode --version
