FROM public.ecr.aws/x8v8d7g8/mars-base:latest

WORKDIR /app

# Git time-travel: clone, then make the repo's default branch point AT the base
# commit with no future history — a real branch checkout (not a detached HEAD),
# future commits/tags gc'd away so the reference solution can't leak from history.
ARG BASE_SHA=010c4bdb4b8758844fd44eacf38e42b22eba8aea
RUN git clone https://github.com/flightcontrolhq/superjson.git . \
 && DEFAULT="$(git remote show origin | sed -n 's/.*HEAD branch: //p')" \
 && git checkout -B "$DEFAULT" "$BASE_SHA" \
 && git remote remove origin \
 && for b in $(git for-each-ref --format='%(refname:short)' refs/heads | grep -vx "$DEFAULT"); do git branch -D "$b" || true; done \
 && for t in $(git tag); do git merge-base --is-ancestor "$t" HEAD 2>/dev/null || git tag -d "$t"; done \
 && git reflog expire --expire=now --all \
 && git gc --prune=now \
 && (git submodule update --init --recursive || true)

RUN npm ci --include=dev

# v1.1 node-id scoring, CTRF route: vitest's built-in JUnit reporter is used at
# verify time (`--reporter=junit --outputFile=...`) and converted with the
# OFFICIAL ctrf-io converter junit-to-ctrf, pinned. Installed globally (npm -g
# => /usr/lib/node_modules on mars-base, node 24): zero contact with /app's
# package.json/package-lock.json — the work tree stays porcelain-clean.
# The `--version` smoke check fails the build loudly if node is too old
# (junit-to-ctrf engines require node>=20) or the binary is missing.
RUN npm install -g junit-to-ctrf@0.0.14 \
 && junit-to-ctrf --version \
 && [ -z "$(git -C /app status --porcelain)" ]

CMD ["bash"]
