# Build environment for the Debian autoupdater.
#
# Rebuilt monthly by .gitea/workflows/build-image.yaml and pushed as :latest, so
# the nightly package jobs start with the toolchain already in place instead
# of each running a full apt transaction first.
#
# bookworm on purpose: a package built against the older dpkg/debhelper installs
# on bookworm and on everything newer, never the other way round.
FROM debian:bookworm-slim

LABEL org.opencontainers.image.title="deb-autoupdate"
LABEL org.opencontainers.image.description="Debian build environment for the Debian package autoupdater"
LABEL org.opencontainers.image.source="https://git.bjphoster.com/deb/.autoupdate"

ARG DEBIAN_FRONTEND=noninteractive

# nodejs          actions/checkout is a JavaScript action; the runner executes it
#                 with `node` from inside this image, and debian-slim ships none.
# dpkg-dev        dpkg-buildpackage, dpkg-parsechangelog
# debhelper       dh, for debian/rules
# build-essential dpkg-checkbuilddeps implicitly requires it, even for arch:all
# fakeroot        for packages without Rules-Requires-Root: no
# devscripts      dch and friends, for working on a package by hand in here
# lintian         advisory lint of the built package
RUN apt-get update \
 && apt-get install -y --no-install-recommends \
      nodejs \
      git \
      curl \
      jq \
      ca-certificates \
      dpkg-dev \
      debhelper \
      build-essential \
      fakeroot \
      devscripts \
      lintian \
 && rm -rf /var/lib/apt/lists/*

# The nightly job drops to this user rather than building as root (CI
# containers are root by default). Baked in here rather than created per run.
RUN useradd --create-home --shell /bin/bash builder

# Sanity check: fail the image build rather than the nightly job if the
# toolchain ever stops working in this environment.
RUN runuser -u builder -- bash -c 'dpkg-buildpackage --version | head -n1 && lintian --version && command -v dpkg-parsechangelog node'