# The OxygenFlow build image (backlog F1b): Rust with rustfmt and clippy,

# Node, every crate the Oxygen projects use, vendored, and an npm cache for

# the Oxygen extensions, because jobs

# have no network. Built by ./build.sh, which vendors the crates first.

FROM rust:1.97.1-slim-bookworm

RUN rustup component add rustfmt clippy \

 && apt-get update \

 && apt-get install -y --no-install-recommends ca-certificates xz-utils make git pkg-config \

 && rm -rf /var/lib/apt/lists/*

# The guest's PATH is fixed and has no /usr/local/cargo/bin, and a rustup

# proxy would need RUSTUP_HOME: link the toolchain's own binaries instead.

RUN tc=$(ls -d /usr/local/rustup/toolchains/*/ | head -1) \

 && for b in cargo rustc rustdoc cargo-fmt rustfmt cargo-clippy clippy-driver; do ln -sf "$tc/bin/$b" /usr/local/bin/$b; done

# Release builds (oxygen#59, oxygenhub#85): each project's scripts/dist.sh

# cross-builds Linux x86_64, arm64 and riscv64, macOS and Windows, with

# cargo-zigbuild and zig (no Apple SDK needed) and MinGW, and packs .deb,

# .tar.gz and .zip; wasm32-wasip1 rebuilds the cheap checks' WASI module

# (scripts/checks-wasm.sh --check, #96). The rustup targets' standard libraries, zig checked

# against its published SHA-256, and cargo-zigbuild, all linked onto the

# guest's fixed PATH.

ARG ZIG_VERSION

ARG ZIG_SHA256

RUN rustup target add x86_64-pc-windows-gnu aarch64-unknown-linux-gnu riscv64gc-unknown-linux-gnu x86_64-apple-darwin aarch64-apple-darwin wasm32-wasip1 \

 && apt-get update \

 && apt-get install -y --no-install-recommends gcc-mingw-w64-x86-64 zip \

 && rm -rf /var/lib/apt/lists/*

ADD https://ziglang.org/download/${ZIG_VERSION}/zig-x86_64-linux-${ZIG_VERSION}.tar.xz /tmp/zig.tar.xz

RUN echo "${ZIG_SHA256}  /tmp/zig.tar.xz" | sha256sum -c - \

 && mkdir -p /opt/zig && tar -xJf /tmp/zig.tar.xz -C /opt/zig --strip-components=1 && rm /tmp/zig.tar.xz \

 && ln -sf /opt/zig/zig /usr/local/bin/zig \

 && cargo install --locked --version 0.23.4 --root /opt/cargo-zigbuild cargo-zigbuild \

 && ln -sf /opt/cargo-zigbuild/bin/cargo-zigbuild /usr/local/bin/cargo-zigbuild \

 && rm -rf /usr/local/cargo/registry /usr/local/cargo/git

# Coverage (oxygenhub#113): the toolchain's llvm-tools and cargo-llvm-cov,

# linked onto the guest's PATH. A job writes an LCOV report with

# `cargo llvm-cov --lcov --output-path /src/target/lcov.info` and declares it

# as its `coverage` artifact; the hub reads it.

RUN rustup component add llvm-tools-preview \

 && cargo install --locked --version 0.9.1 --root /opt/cargo-llvm-cov cargo-llvm-cov \

 && ln -sf /opt/cargo-llvm-cov/bin/cargo-llvm-cov /usr/local/bin/cargo-llvm-cov \

 && rm -rf /usr/local/cargo/registry /usr/local/cargo/git

# Test reports (oxygenflow#81): cargo-nextest writes JUnit XML, which the

# hub reads as a job's `junit` artifact; `cargo llvm-cov nextest` gives the

# LCOV coverage and the JUnit report from one run of the tests.

RUN cargo install --locked --version 0.9.148 --root /opt/cargo-nextest cargo-nextest \

 && ln -sf /opt/cargo-nextest/bin/cargo-nextest /usr/local/bin/cargo-nextest \

 && rm -rf /usr/local/cargo/registry /usr/local/cargo/git

ARG NODE_VERSION

ARG NODE_SHA256

ADD https://nodejs.org/dist/v${NODE_VERSION}/node-v${NODE_VERSION}-linux-x64.tar.xz /tmp/node.tar.xz

RUN echo "${NODE_SHA256}  /tmp/node.tar.xz" | sha256sum -c - \

 && tar -xJf /tmp/node.tar.xz -C /usr/local --strip-components=1 --exclude='*/include' --exclude='*/share/doc' \

 && rm /tmp/node.tar.xz

# PostgreSQL (oxygenhub#211): OxygenHub's tests on Postgres start a server

# of their own on loopback inside the job (.flow/test-postgres.sh). Debian's

# server, its programs linked onto the guest's fixed PATH, and nss_wrapper:

# a job runs as the runner's builder, a user this image's /etc/passwd does

# not name, and initdb must look its user up.

RUN apt-get update \

 && apt-get install -y --no-install-recommends postgresql libnss-wrapper \

 && rm -rf /var/lib/apt/lists/* \

 && for b in initdb pg_ctl postgres; do ln -sf /usr/lib/postgresql/*/bin/$b /usr/local/bin/$b; done \

 && initdb --version

# npm's cache for the Oxygen extensions' lock files: `npm ci --offline

# --cache /opt/npm-cache` installs from it, read-only as it is.

COPY npm-cache /opt/npm-cache

# Cargo reads /.cargo/config.toml for anything under /, so /src uses the

# vendored crates; CARGO_HOME stays the default $HOME/.cargo (/tmp).

COPY vendor /opt/vendor

# What it vendors, `NAME VERSION` a line: `flow deps check --list` (#101).

COPY crates.txt /opt/crates.txt

COPY cargo-config.toml /.cargo/config.toml

# Dependencies prebuilt (backlog F6b2): each workspace's recipe (its

# manifests and lock file with the sources stubbed out, made by recipe.py)

# is built at /src, where jobs build, with the environment its pipeline's

# rust sandbox sets, for the release build, the tests and clippy. The

# target directory is kept in /opt/warm/NAME; a job copies it onto its

# empty target disk and compiles only its own crates. A lock file that

# has moved on since only costs the crates that changed.

COPY warm /tmp/warm

RUN set -e; \

    for ws in /tmp/warm/*; do \

        name=$(basename "$ws"); rm -rf /src; cp -a "$ws" /src; cd /src; \

        export CARGO_INCREMENTAL=0 CARGO_PROFILE_DEV_DEBUG=0 CARGO_PROFILE_TEST_DEBUG=0 CARGO_PROFILE_RELEASE_DEBUG=0; \

        cargo build --release --locked; \

        cargo test --workspace --locked --no-run; \

        cargo clippy --workspace --all-targets --locked; \

        mkdir -p /opt/warm; mv /src/target "/opt/warm/$name"; cd /; \

    done; \

    rm -rf /src /tmp/warm /root/.cargo/registry /root/.cargo/git; mkdir /src

# Everything under /opt readable and its directories searchable by any

# user: jobs do not run as root, and their uid is the runner host's.

RUN chmod -R a+rX /opt