FROM public.ecr.aws/x8v8d7g8/mars-base:latest

WORKDIR /app

# Git time-travel: clone, then make the repo's default branch point AT the base
# commit with no future history — a real branch checkout (not a detached HEAD),
# future commits/tags gc'd away so the reference solution can't leak from history.
ARG BASE_SHA=24a057bbf9089677b4c49eac4ae1f28287ac8bb9
RUN git clone https://github.com/prometheus/prometheus.git . \
 && DEFAULT="$(git remote show origin | sed -n 's/.*HEAD branch: //p')" \
 && git checkout -B "$DEFAULT" "$BASE_SHA" \
 && git remote remove origin \
 && for b in $(git for-each-ref --format='%(refname:short)' refs/heads | grep -vx "$DEFAULT"); do git branch -D "$b" || true; done \
 && for t in $(git tag); do git merge-base --is-ancestor "$t" HEAD 2>/dev/null || git tag -d "$t"; done \
 && git reflog expire --expire=now --all \
 && git gc --prune=now \
 && (git submodule update --init --recursive || true)

ENV GONOSUMDB=* \
    GONOSUMCHECK=* \
    GOFLAGS=-mod=mod

# Build cache lives OUTSIDE /app so the warmed cache never dirties `git status`
# (model.patch hygiene) and the offline verifier reuses it (cmd/prometheus is a
# heavy compile; a cold cache risks the verifier timeout).
ENV GOCACHE=/opt/gocache

# The offline verifier runs `GOWORK=off go test ./cmd/prometheus` (base) and the same with
# `-tags=olympus_new` (new). `go mod download` of the main module alone left the cache missing
# grpc-gateway/v2 v2.27.7.zip, so the no-network verifier could not build cmd/prometheus. Mirror
# the verifier here (network available) so every build+test dependency zip is cached before the
# network is cut. GOWORK=off is required: the repo is in Go workspace mode, where GOFLAGS=-mod=mod
# is otherwise rejected ("-mod may only be set to readonly or vendor when in workspace mode").
# `go test -c` compiles the test binaries (caching test-only deps) without running them.
# `go mod download all` under -mod=mod augments go.sum with tool/lint module hashes;
# restore the checked-in go.sum afterwards (it already covers the cmd/prometheus build,
# and the module cache keeps the downloaded zips) so the work tree stays pristine.
RUN GOWORK=off go mod download all && \
    git checkout -- go.sum go.mod && \
    GOWORK=off go test -c -o /dev/null ./cmd/prometheus && \
    GOWORK=off go test -tags=olympus_new -c -o /dev/null ./cmd/prometheus && \
    git checkout -- go.sum go.mod

# v1.1 CTRF node-id scoring: official ctrf-io reporter for `go test -json` (pinned
# tag, resolved via proxy.golang.org + checksum db at BUILD time, so test time is
# offline-safe). GOFLAGS/-mod=mod is module-local; clear it for the detached
# pkg@version install. Binary lands in $(go env GOPATH)/bin (/root/go/bin here).
RUN GOWORK=off GOFLAGS= go install github.com/ctrf-io/go-ctrf-json-reporter/cmd/go-ctrf-json-reporter@v0.1.0
ENV PATH="/root/go/bin:${PATH}"

# Reporter/cache-warming installs must leave the work tree pristine.
RUN test -z "$(git status --porcelain)"

# Disable git commit hooks (husky etc.): dev-workflow tooling, not task content.
# Broken hook environments otherwise block the agent's (and oracle's) commits.
RUN cd /app && git config core.hooksPath /dev/null

CMD ["/bin/bash"]
