# Build environment for the RPM autoupdater.
#
# Rebuilt monthly by .gitea/workflows/build-image.yaml and pushed as :latest, so
# the nightly package jobs start with the toolchain already in place instead
# of each running a full dnf transaction first.
#
# Fedora specifically: rpmbuild, rpmspec and rpmlint are native there and
# current. Packages are built with `dist` undefined, so the noarch result is not
# tied to the Fedora release that built it and installs on EL and openSUSE too.
FROM fedora:latest

LABEL org.opencontainers.image.title="rpm-autoupdate"
LABEL org.opencontainers.image.description="Fedora build environment for the RPM package autoupdater"
LABEL org.opencontainers.image.source="https://git.bjphoster.com/rpm/.autoupdate"

# nodejs       actions/checkout is a JavaScript action; the runner executes it
#              with `node` from inside this image, and fedora ships none.
# rpm-build    rpmbuild and rpmspec
# rpmdevtools  spectool, to resolve Source0's file name
# rpmlint      advisory lint of the spec and the built package
# util-linux   runuser, to drop from root to the build user
# make         the usual BuildRequires of a script package
RUN dnf -y install --setopt=install_weak_deps=False \
      nodejs \
      git \
      curl \
      jq \
      rpm-build \
      rpmdevtools \
      rpmlint \
      util-linux \
      shadow-utils \
      make \
      tar \
      gzip \
      findutils \
      diffutils \
 && dnf clean all

# The nightly job drops to this user rather than building as root (CI
# containers are root by default). Baked in here rather than created per run.
RUN useradd --create-home --shell /bin/bash builder

# Sanity check: fail the image build rather than the nightly job if the
# toolchain ever stops working in this environment.
RUN runuser -u builder -- bash -c 'rpmbuild --version && rpmspec --version && command -v spectool rpmlint node'