# Lint phase. golangci-lint runs here, in the pinned linter image, never on
# the host. script/lint builds this stage by name with --no-cache.
# golangci/golangci-lint:v2.12.2, 2026-05-06
FROM golangci/golangci-lint:v2.12.2@sha256:5cceeef04e53efe1470638d4b4b4f5ceefd574955ab3941b2d9a68a8c9ad5240 AS lint
WORKDIR /src
COPY go.mod go.sum ./
RUN go mod download
COPY . .
RUN golangci-lint config verify --config .golangci.yml
RUN golangci-lint run --config .golangci.yml ./...

# Test phase. script/test builds this stage by name with --no-cache.
# golang:1.26.1-bookworm, 2026-03-17
FROM golang:1.26.1-bookworm@sha256:4465644228bc2857a954b092167e12aa59c006a3492282a6c820bf4755fd64a4 AS test
WORKDIR /src
COPY go.mod go.sum ./
RUN go mod download
COPY . .
RUN go test -count=1 -race -cover -timeout 90s ./... || \
    { echo "--- Rerunning with -v for details ---"; \
      go test -count=1 -race -v -timeout 90s ./...; exit 1; }

# Build stage, and the last one. Nothing is wanted from the phases above;
# the two copies are the ordering edges that make BuildKit build them first,
# so this stage cannot build unless lint and test passed. For this
# non-server tool the final stage is the build/development environment
# carrying the compiled binary; rtnetmon runs on a host with the privileges
# to open raw ICMP sockets, not as a container service.
# golang:1.26.1-bookworm, 2026-03-17
FROM golang:1.26.1-bookworm@sha256:4465644228bc2857a954b092167e12aa59c006a3492282a6c820bf4755fd64a4 AS builder
COPY --from=lint /src/go.sum /dev/null
COPY --from=test /src/go.sum /dev/null
WORKDIR /src
COPY go.mod go.sum ./
RUN go mod download
COPY . .
RUN CGO_ENABLED=0 go build -trimpath -o /rtnetmon ./cmd/rtnetmon/