FROM public.ecr.aws/x8v8d7g8/mars-base:latest

WORKDIR /app

# Git time-travel: clone, then make the repo's default branch point AT the base
# commit with no future history — a real branch checkout (not a detached HEAD),
# future commits/tags gc'd away so the reference solution can't leak from history.
ARG BASE_SHA=79dd30d11aab6f0fba3cd79bd48f456209b966b3
RUN git clone https://github.com/pest-parser/pest . \
 && DEFAULT="$(git remote show origin | sed -n 's/.*HEAD branch: //p')" \
 && git checkout -B "$DEFAULT" "$BASE_SHA" \
 && git remote remove origin \
 && for b in $(git for-each-ref --format='%(refname:short)' refs/heads | grep -vx "$DEFAULT"); do git branch -D "$b" || true; done \
 && for t in $(git tag); do git merge-base --is-ancestor "$t" HEAD 2>/dev/null || git tag -d "$t"; done \
 && git reflog expire --expire=now --all \
 && git gc --prune=now \
 && (git submodule update --init --recursive || true)

RUN cargo fetch && cargo build --package pest_bootstrap

# v1.1 node-id scoring: cargo-nextest (pinned prebuilt binary) emits JUnit XML.
# Reporter config lives OUTSIDE the repo (--config-file) so the model can't
# hijack it via .config/nextest.toml.
ARG NEXTEST_VERSION=0.9.97
RUN curl -LsSf "https://get.nexte.st/${NEXTEST_VERSION}/linux" | tar zxf - -C /usr/local/bin \
 && cargo nextest --version
RUN mkdir -p /opt/nextest \
 && printf '[profile.junit]\nfail-fast = false\n\n[profile.junit.junit]\npath = "junit.xml"\n' > /opt/nextest/nextest.toml

# Warm the build cache for every scored target so verifier runs only recompile
# the task delta: base = pest_meta lib, pest_derive grammar+reporting,
# pest_grammars lib; new = a pest_meta integration test (deps warmed via --tests).
RUN cargo nextest run -p pest_meta --lib --tests --no-run --config-file /opt/nextest/nextest.toml --profile junit \
 && cargo nextest run -p pest_derive --test grammar --test reporting --no-run --config-file /opt/nextest/nextest.toml --profile junit \
 && cargo nextest run -p pest_grammars --lib --no-run --config-file /opt/nextest/nextest.toml --profile junit

# Official ctrf-io converter, pinned. mars-base already ships node v24.12.0 +
# npm 11.6.2; the node --version guard fails the build loudly if the base ever
# drops it. Global npm install lives outside /app (model.patch hygiene).
RUN node --version && npm install -g junit-to-ctrf@0.0.14 --ignore-scripts && junit-to-ctrf --version
# Fallback ONLY if a future base image lacks node (not needed today):
# RUN curl -fsSL https://nodejs.org/dist/v22.17.0/node-v22.17.0-linux-x64.tar.xz | tar -xJ -C /opt && ln -s /opt/node-v22.17.0-linux-x64/bin/node /usr/local/bin/node && ln -s /opt/node-v22.17.0-linux-x64/bin/npm /usr/local/bin/npm

# Reporter install + cache warming must not dirty the worktree (model.patch hygiene).
RUN test -z "$(git status --porcelain)"

# Disable git commit hooks (husky etc.): dev-workflow tooling, not task content.
# Broken hook environments otherwise block the agent's (and oracle's) commits.
RUN cd /app && git config core.hooksPath /dev/null

CMD ["/bin/bash"]
