# The OxygenFlow OpenTofu image (oxygenflow#56): OpenTofu and the providers
# the deploy pipelines use, mirrored inside, so `tofu init` needs no
# registry. A job reaches a cloud's API only through allow-listed egress
# (#55); formatting and validation need no network at all.

# Download and check OpenTofu, and mirror the providers, with the tools
# only this stage needs.
FROM debian:bookworm-slim AS fetch
ARG TOFU_VERSION
ARG TOFU_SHA256
RUN apt-get update \
 && apt-get install -y --no-install-recommends ca-certificates curl unzip \
 && rm -rf /var/lib/apt/lists/*
RUN curl -fsSL -o /tmp/tofu.zip \
      "https://github.com/opentofu/opentofu/releases/download/v${TOFU_VERSION}/tofu_${TOFU_VERSION}_linux_amd64.zip" \
 && echo "${TOFU_SHA256}  /tmp/tofu.zip" | sha256sum -c - \
 && unzip -q /tmp/tofu.zip tofu -d /usr/local/bin \
 && rm /tmp/tofu.zip
# The exact provider versions of the pipelines' lock files; `tofu
# providers mirror` checks each package against the registry's signed
# checksums as it downloads it.
COPY mirror.tf /tmp/mirror/
RUN cd /tmp/mirror && tofu providers mirror -platform=linux_amd64 /opt/tofu/mirror
# TFLint and its Google ruleset (HCL linting), each checked against its
# release's SHA-256; the ruleset where TFLint looks for plugins, so
# linting needs no `tflint --init` and no network.
ARG TFLINT_VERSION
ARG TFLINT_SHA256
ARG TFLINT_GOOGLE_VERSION
ARG TFLINT_GOOGLE_SHA256
RUN curl -fsSL -o /tmp/tflint.zip \
      "https://github.com/terraform-linters/tflint/releases/download/v${TFLINT_VERSION}/tflint_linux_amd64.zip" \
 && echo "${TFLINT_SHA256}  /tmp/tflint.zip" | sha256sum -c - \
 && unzip -q /tmp/tflint.zip tflint -d /usr/local/bin \
 && curl -fsSL -o /tmp/google.zip \
      "https://github.com/terraform-linters/tflint-ruleset-google/releases/download/v${TFLINT_GOOGLE_VERSION}/tflint-ruleset-google_linux_amd64.zip" \
 && echo "${TFLINT_GOOGLE_SHA256}  /tmp/google.zip" | sha256sum -c - \
 && d=/opt/tflint/plugins/github.com/terraform-linters/tflint-ruleset-google/${TFLINT_GOOGLE_VERSION} \
 && mkdir -p "$d" && unzip -q /tmp/google.zip -d "$d" \
 && rm /tmp/tflint.zip /tmp/google.zip

FROM debian:bookworm-slim
# curl, jq, xz, sfdisk and e2fsprogs' debugfs: oxygenhub-gcp's bake job
# builds the hub's VM image by writing files into Debian's cloud disk image,
# no root needed, and publishes it through Google's APIs (oxygenhub-gcp #7).
RUN apt-get update \
 && apt-get install -y --no-install-recommends ca-certificates curl jq xz-utils fdisk e2fsprogs \
 && rm -rf /var/lib/apt/lists/*
COPY --from=fetch /usr/local/bin/tofu /usr/local/bin/tofu
COPY --from=fetch /opt/tofu/mirror /opt/tofu/mirror
COPY --from=fetch /usr/local/bin/tflint /usr/local/bin/tflint
COPY --from=fetch /opt/tflint/plugins /opt/tflint/plugins
# Providers come only from the mirror: a job never reaches a registry.
COPY cli.tfrc /etc/tofu/cli.tfrc
ENV TF_CLI_CONFIG_FILE=/etc/tofu/cli.tfrc \
    TFLINT_PLUGIN_DIR=/opt/tflint/plugins
