# In every stage ARG CACHEBUST comes right after the steps that install
# system packages and download Go's modules, or right after FROM in a
# stage with neither, and every step that lints, tests or compiles
# comes after it. script/ passes a new value on every build, which
# reruns every RUN step after it. Docker keeps the layers above it
# until the base image, their own lines or go.mod and go.sum change.
# The steps that compile mount Go's build cache, and golangci-lint run
# also mounts golangci-lint's; both survive from build to build.
#
# This repository keeps cgo off, so its test phase departs from the
# canonical Go Dockerfile in REPO_POLICIES.md in one way: it runs on the
# alpine Go image without -race, which needs a C toolchain. Everything
# else follows the canonical file.

# Lint phase
# golangci/golangci-lint:v2.15.0, 2026-10-16
FROM golangci/golangci-lint@sha256:fbfcfd12a6f8d7f1b97b3362ca80fc2a244d46863148c73cb88e7793af96c481 AS lint
WORKDIR /src
COPY go.mod go.sum ./
RUN go mod download
ARG CACHEBUST
COPY . .
RUN --mount=type=cache,target=/root/.cache/go-build \
    --mount=type=cache,target=/root/.cache/golangci-lint \
    golangci-lint run --config .golangci.yml ./...

# Test phase. -count=1 because the mounted cache also holds test
# results, which go test would otherwise replay. A first run that timed
# out gets no rerun, because a rerun would only wait for the same hang.
# golang:1.26-alpine, 2026-10-27
FROM golang@sha256:a2012b4a1d1f9f7e9f44e0d39b805a901e856b1dd80b4e6ee4338db547050308 AS test
ENV CGO_ENABLED=0
WORKDIR /src
COPY go.mod go.sum ./
RUN go mod download
ARG CACHEBUST
COPY . .
RUN --mount=type=cache,target=/root/.cache/go-build \
    status=0; \
    output=$(go test -count=1 -timeout 90s -cover ./... 2>&1) || status=$?; \
    printf '%s\n' "$output"; \
    test "$status" -eq 0 && exit 0; \
    case "$output" in \
        *"panic: test timed out"*|*"*** Test killed"*) exit 1 ;; \
    esac; \
    echo "--- Rerunning with -v for details ---"; \
    go test -count=1 -timeout 90s -v ./...; \
    exit 1

# Build stage. Nothing is wanted from either phase above; the copies
# are what make BuildKit build them first, so nothing after them can
# run unless lint and test passed.
# golang:1.26-alpine, 2026-10-27
FROM golang@sha256:a2012b4a1d1f9f7e9f44e0d39b805a901e856b1dd80b4e6ee4338db547050308 AS builder
# git comes from the base image's own distribution package index, which
# is trusted, so it needs no version and no hash.
RUN apk add --no-cache git
WORKDIR /src
COPY go.mod go.sum ./
RUN go mod download
ARG CACHEBUST
COPY --from=lint /src/go.sum /dev/null
COPY --from=test /src/go.sum /dev/null
# A tar-stream context keeps the sender's file owners, which git refuses.
RUN git config --system --add safe.directory /src
COPY . .

# The VERSION build arg when one is given, otherwise
# `git describe --tags --always` on the .git in the build context. With
# .git present, a version that is still empty, dev or unknown fails the
# build: git is missing or could not read the checkout.
ARG VERSION
RUN --mount=type=cache,target=/root/.cache/go-build \
    VERSION="${VERSION:-$(git describe --tags --always)}"; \
    if [ -e .git ]; then \
        case "$VERSION" in ""|dev|unknown) \
            echo "version is '$VERSION' although .git is present" >&2; \
            exit 1 ;; \
        esac; \
    fi; \
    CGO_ENABLED=0 go build -trimpath \
        -ldflags="-s -w -X main.Version=${VERSION}" \
        -o /sutil ./cmd/sutil
# The runtime stage ships the source; the repository history is not
# part of it.
RUN rm -rf /src/.git

# Runtime stage, and the last one: the binary plus the source it was
# built from.
# alpine:3.24, 2026-10-23
FROM alpine@sha256:be2656061b536c1883c4034790e21d0a09c5aaaf51968b89368a3c0371ea2c9a
ARG CACHEBUST
COPY --from=builder /sutil /usr/local/bin/sutil
COPY --from=builder /src /usr/local/src/x
ENTRYPOINT ["sutil"]