# Build environment for the AUR autoupdater.
#
# Rebuilt monthly by .gitea/workflows/build-image.yaml and pushed as :latest, so
# the six nightly package jobs start with the toolchain already in place instead
# of each running a full pacman transaction first.
#
# Arch specifically: makepkg --printsrcinfo must be the genuine Arch tool.
# Ubuntu's build environment silently emits an empty .SRCINFO, which the AUR
# then rejects -- that is what broke three packages before this was rewritten.

# base, not base-devel: the autoupdater only ever *parses* PKGBUILDs
# (makepkg --printsrcinfo) and never compiles anything, so the toolchain in
# base-devel is dead weight -- 822 MB against 1.48 GB. If a real build or
# verify step is ever added here, this needs to go back to base-devel.
FROM archlinux:base

LABEL org.opencontainers.image.title="aur-autoupdate"
LABEL org.opencontainers.image.description="Arch build environment for the AUR package autoupdater"
LABEL org.opencontainers.image.source="https://git.bjphoster.com/aur/.autoupdate"

# nodejs        actions/checkout is a JavaScript action; the runner executes it
#               with `node` from inside this image, and base-devel has none.
# pacman-contrib updpkgsums/paccache and friends
# namcap        PKGBUILD linting
# fuse2         AppImage extraction
# python        test.sh's local HTTP server
RUN pacman -Syu --noconfirm --needed \
      nodejs \
      git \
      openssh \
      jq \
      curl \
      pacman-contrib \
      namcap \
      fuse2 \
      python \
      diffutils \
 && rm -rf /var/cache/pacman/pkg/*
# NB: not `pacman -Scc` -- under --noconfirm it takes the default answer, which
# is *no* for the cache prompt, so it drops sync databases (breaking pacman -Ss
# for debugging) without actually reclaiming the cache. The rm does the real work.

# makepkg refuses to run as root and CI containers are root by default, so the
# nightly job drops to this user. Baked in here rather than created per run.
RUN useradd --create-home --shell /bin/bash builder

# Sanity check: fail the image build rather than the nightly job if makepkg
# ever stops working in this environment.
RUN runuser -u builder -- bash -c 'command -v makepkg && makepkg --version | head -1'