# Custom toolchain image for the self-hosted Gitea Actions (Forgejo) runner.
#
# The cluster runs act_runner in *host mode* (docker disabled), so workflow steps
# execute INSIDE this image. The stock forgejo/runner image is minimal and lacks
# node (needed by JS actions: actions/checkout, setup-go, ...), git, make, etc.
# The runner pod is non-root with all caps dropped, so it cannot apt/apk-add at
# runtime -- the tools must be baked in here.
#
# Build multi-arch (cluster is mixed amd64/arm64) and push to the Gitea registry:
#
#   docker buildx create --use --name zegit-ci 2>/dev/null || true
#   docker login gitea.langenoja.se        # username + a Gitea personal access token
#   docker buildx build --platform linux/amd64,linux/arm64 \
#     -t gitea.langenoja.se/zegit-zoo/zegit-forgejo-runner:12.11.1-ci --push .
#
# Then in flux-config set both containers' image: to the tag above and commit.
# Package visibility is PUBLIC, so the runner namespace pulls without a secret.
FROM code.forgejo.org/forgejo/runner:12.11.1

USER root

# nodejs   -> JS actions runtime (actions/checkout, actions/setup-go, ...)
# git      -> checkout
# bash     -> `shell: bash` steps and many action entrypoints
# coreutils-> GNU userland (alpine busybox tools trip up some scripts)
# curl,tar -> setup-go / gitleaks download + extract their own arch-specific binaries
# make     -> zegit Makefile targets
# ca-certificates -> trusted roots for HTTPS to gitea/github/goproxy
#
# Go is intentionally NOT baked in: actions/setup-go fetches the pinned version
# per-run (node + tar are present), so the image needs no rebuild on Go bumps.
RUN apk add --no-cache \
      nodejs \
      git \
      bash \
      coreutils \
      curl \
      tar \
      make \
      ca-certificates

# Match the runner pod's runAsUser (1000); keep the image non-root by default.
USER 1000