FROM public.ecr.aws/x8v8d7g8/mars-base:latest

WORKDIR /app

# Git time-travel: clone, then make the repo's default branch point AT the base
# commit with no future history — a real branch checkout (not a detached HEAD),
# future commits/tags gc'd away so the reference solution can't leak from history.
ARG BASE_SHA=399ef141161f212f4e81b5d7497b84633fc712d9
RUN git clone https://github.com/goreleaser/goreleaser . \
 && DEFAULT="$(git remote show origin | sed -n 's/.*HEAD branch: //p')" \
 && git checkout -B "$DEFAULT" "$BASE_SHA" \
 && git remote remove origin \
 && for b in $(git for-each-ref --format='%(refname:short)' refs/heads | grep -vx "$DEFAULT"); do git branch -D "$b" || true; done \
 && for t in $(git tag); do git merge-base --is-ancestor "$t" HEAD 2>/dev/null || git tag -d "$t"; done \
 && git reflog expire --expire=now --all \
 && git gc --prune=now \
 && (git submodule update --init --recursive || true)

ENV GOCACHE=/tmp/gocache \
    GOMODCACHE=/tmp/gomodcache \
    GOTOOLCHAIN=auto \
    GOFLAGS=-mod=mod

# Bake every dep the verifier will need against the airgap. `go mod download all`
# fetches the FULL module graph (not just the build-graph subset that bare
# `go mod download` covers). Then `go build ./...` and `go test -run=^$ ./...`
# compile every package + every test binary, populating $GOCACHE and verifying
# every checksum in go.sum against the actually-cached zips. After this the
# airgapped verifier never needs to re-download or re-verify.
# v1.1: `go mod download all` under GOFLAGS=-mod=mod appends full-graph hashes to
# go.sum (860 lines). Reset go.mod/go.sum afterwards so `git status --porcelain` is
# EMPTY in the image (a dirty go.sum would pollute every model.patch and false-fire
# the HARD go.sum tripwire). The committed go.sum already covers the build graph,
# so offline builds/tests never need the pruned full-graph entries.
RUN set -eu; \
    mkdir -p /tmp/gocache /tmp/gomodcache; \
    go mod download all; \
    git checkout -- go.mod go.sum; \
    go build ./... >/dev/null 2>&1 || true; \
    go test -run=^$ -count=1 ./... >/dev/null 2>&1 || true; \
    git checkout -- go.mod go.sum; \
    test -z "$(git status --porcelain)"

# v1.1 CTRF: official ctrf-io reporter for `go test -json` (pinned tag; resolved
# via proxy.golang.org + checksum db at BUILD time).
# GOFLAGS=-mod=mod is cleared for the install (pkg@version mode rejects -mod).
RUN env GOFLAGS= go install github.com/ctrf-io/go-ctrf-json-reporter/cmd/go-ctrf-json-reporter@v0.1.0
# binary lands in $(go env GOPATH)/bin (/root/go/bin in these images); the
# verifier wrapper also does: export PATH="$(go env GOPATH)/bin:$PATH"
ENV PATH="/root/go/bin:${PATH}"

# Disable git commit hooks (husky etc.): dev-workflow tooling, not task content.
# Broken hook environments otherwise block the agent's (and oracle's) commits.
RUN cd /app && git config core.hooksPath /dev/null

CMD ["/bin/bash"]
