# Orchestrator image for the advisory community-PR checker (scripts/pr-check.sh), built for the NAS
# (linux/amd64). It carries the trusted toolchain: node (parse tg JSON + run the checker), git (clone
# + git am the PRs), tg (list/checkout/comment), and the docker CLI (to spawn the untrusted checks as
# a SIBLING container via the mounted host socket, so PR code never runs in this image alongside the
# tg credentials). Build ON the NAS (native amd64) or with `buildx --platform linux/amd64`.
#
# The tg CLI is github.com/alyraffauf/tg; built here from source so no binary is committed to the repo.

FROM golang:1.27-bookworm AS tg
RUN go install github.com/alyraffauf/tg/cmd/tg@v0.6.0

FROM node:24-bookworm-slim
# git: clone + git am the PR patches. docker-cli: spawn the sandbox sibling. curl/ca-certificates:
# fetch the current pr-check.sh from Tangled raw at run time. jq is not needed (node parses the JSON).
RUN apt-get update \
  && apt-get install -y --no-install-recommends git curl ca-certificates docker.io \
  && rm -rf /var/lib/apt/lists/*
COPY --from=tg /go/bin/tg /usr/local/bin/tg
COPY entrypoint.sh /usr/local/bin/entrypoint.sh
RUN chmod +x /usr/local/bin/entrypoint.sh
ENTRYPOINT ["/usr/local/bin/entrypoint.sh"]