# The OxygenFlow OpenTofu image (oxygenflow#56): OpenTofu and the providers

# the deploy pipelines use, mirrored inside, so `tofu init` needs no

# registry. A job reaches a cloud's API only through allow-listed egress

# (#55); formatting and validation need no network at all.

# Download and check OpenTofu, and mirror the providers, with the tools

# only this stage needs.

FROM debian:bookworm-slim AS fetch

ARG TOFU_VERSION

ARG TOFU_SHA256

RUN apt-get update \

 && apt-get install -y --no-install-recommends ca-certificates curl unzip \

 && rm -rf /var/lib/apt/lists/*

RUN curl -fsSL -o /tmp/tofu.zip \

      "https://github.com/opentofu/opentofu/releases/download/v${TOFU_VERSION}/tofu_${TOFU_VERSION}_linux_amd64.zip" \

 && echo "${TOFU_SHA256}  /tmp/tofu.zip" | sha256sum -c - \

 && unzip -q /tmp/tofu.zip tofu -d /usr/local/bin \

 && rm /tmp/tofu.zip

# The exact provider versions of the pipelines' lock files; `tofu

# providers mirror` checks each package against the registry's signed

# checksums as it downloads it.

COPY mirror.tf /tmp/mirror/

RUN cd /tmp/mirror && tofu providers mirror -platform=linux_amd64 /opt/tofu/mirror

# TFLint and its Google ruleset (HCL linting), each checked against its

# release's SHA-256; the ruleset where TFLint looks for plugins, so

# linting needs no `tflint --init` and no network.

ARG TFLINT_VERSION

ARG TFLINT_SHA256

ARG TFLINT_GOOGLE_VERSION

ARG TFLINT_GOOGLE_SHA256

RUN curl -fsSL -o /tmp/tflint.zip \

      "https://github.com/terraform-linters/tflint/releases/download/v${TFLINT_VERSION}/tflint_linux_amd64.zip" \

 && echo "${TFLINT_SHA256}  /tmp/tflint.zip" | sha256sum -c - \

 && unzip -q /tmp/tflint.zip tflint -d /usr/local/bin \

 && curl -fsSL -o /tmp/google.zip \

      "https://github.com/terraform-linters/tflint-ruleset-google/releases/download/v${TFLINT_GOOGLE_VERSION}/tflint-ruleset-google_linux_amd64.zip" \

 && echo "${TFLINT_GOOGLE_SHA256}  /tmp/google.zip" | sha256sum -c - \

 && d=/opt/tflint/plugins/github.com/terraform-linters/tflint-ruleset-google/${TFLINT_GOOGLE_VERSION} \

 && mkdir -p "$d" && unzip -q /tmp/google.zip -d "$d" \

 && rm /tmp/tflint.zip /tmp/google.zip

FROM debian:bookworm-slim

# curl, jq, xz, sfdisk and e2fsprogs' debugfs: oxygenhub-gcp's bake job

# builds the hub's VM image by writing files into Debian's cloud disk image,

# no root needed, and publishes it through Google's APIs (oxygenhub-gcp #7).

RUN apt-get update \

 && apt-get install -y --no-install-recommends ca-certificates curl jq xz-utils fdisk e2fsprogs \

 && rm -rf /var/lib/apt/lists/*

COPY --from=fetch /usr/local/bin/tofu /usr/local/bin/tofu

COPY --from=fetch /opt/tofu/mirror /opt/tofu/mirror

COPY --from=fetch /usr/local/bin/tflint /usr/local/bin/tflint

COPY --from=fetch /opt/tflint/plugins /opt/tflint/plugins

# Providers come only from the mirror: a job never reaches a registry.

COPY cli.tfrc /etc/tofu/cli.tfrc

ENV TF_CLI_CONFIG_FILE=/etc/tofu/cli.tfrc \

    TFLINT_PLUGIN_DIR=/opt/tflint/plugins