# syntax=docker/dockerfile:1.7
# Multi-arch is produced by building this file on native amd64 and arm64 runners.
# Keep both bases pinned to manifest-list digests so either architecture resolves
# to immutable source bytes.
FROM rust:1.95-alpine3.22@sha256:064dfc925d68d1a63f4fd2871bd7dc6e6ea56692989a487185855d62885d90aa AS builder

RUN apk add --no-cache \
      build-base \
      cmake \
      git \
      musl-dev \
      openssl-dev \
      openssl-libs-static \
      perl \
      pkgconf \
      protoc
WORKDIR /build
COPY . .
RUN cargo build --locked --profile sprig -p sprig \
    && strip target/sprig/sprig

FROM alpine:3.22@sha256:14358309a308569c32bdc37e2e0e9694be33a9d99e68afb0f5ff33cc1f695dce

RUN apk add --no-cache bash ca-certificates curl git \
    && adduser -D -h /home/agent agent \
    && install -d -o agent -g agent /workspace /home/agent \
    && git config --system gpg.format x509 \
    && git config --system gpg.x509.program /usr/local/bin/git-sign-nostr \
    && git config --system commit.gpgSign true \
    && git config --system tag.gpgSign true

COPY --from=builder --chmod=0755 /build/target/sprig/sprig /usr/local/bin/sprig
COPY --chmod=0755 scripts/sprig-entrypoint.sh /usr/local/bin/sprig-entrypoint
RUN for name in \
      buzz-acp buzz-agent buzz-dev-mcp rg tree buzz \
      git-credential-nostr git-sign-nostr; do \
        ln -s sprig "/usr/local/bin/$name"; \
    done

ENV HOME=/home/agent \
    PATH=/usr/local/bin:/usr/local/sbin:/usr/sbin:/usr/bin:/sbin:/bin
WORKDIR /home/agent
USER agent
ENTRYPOINT ["/usr/local/bin/sprig-entrypoint"]