# Routemark recipe: python-node. A project kind, as text: Python with uv, and Node with pnpm.
#
# Routemark ships this file and never an image. You build it on your own machine with your own `docker build`
# (the README beside this file gives the command), and a project whose `routemark.toml` says
# `containment = "image"` runs its delegate and its checks in a container from what you built.
#
# The tools are pinned exactly, each by its version (the README's table says which). The Debian packages are
# pinned by the base image's Debian release alone: what it ships on the day of the build, its fixes included.
#
# What it holds, and why:
# - node:22.23.4-trixie-slim: Debian 13 with Node 22, npm and npx.
# - uv and uvx from uv's own published image, by version: one static binary each, nothing run from the internet.
# - OpenCode from npm, by version.
# - Python installed by uv at build time, outside the delegate's home, so a run's `uv sync` downloads only the
#   project's own packages; linked onto the PATH as `python3` and `python`.
# - No compilers: a project whose lock file needs a source build fails `uv sync` here; add build-essential
#   to the apt-get line below if yours does.

FROM node:22.23.4-trixie-slim

ARG OPENCODE_VERSION=2.1.3
ARG PNPM_VERSION=10.32.1
ARG PYTHON_VERSION=3.13.12

ENV DEBIAN_FRONTEND=noninteractive
RUN apt-get update \
    && apt-get install -y --no-install-recommends ca-certificates curl git just \
    && rm -rf /var/lib/apt/lists/*

COPY --from=ghcr.io/astral-sh/uv:0.10.7 /uv /uvx /usr/local/bin/

RUN npm install -g "@opencode/cli@${OPENCODE_VERSION}" "pnpm@${PNPM_VERSION}" \
    && npm cache clean --force

# The delegate's home is private to one run: Routemark mounts an empty folder of the run's here, and the
# harness's own settings read-only inside it. The four XDG folders are pinned under it so the harness keeps its
# state there and nowhere else.
ENV HOME=/home/delegate \
    XDG_CONFIG_HOME=/home/delegate/.config \
    XDG_DATA_HOME=/home/delegate/.local/share \
    XDG_CACHE_HOME=/home/delegate/.cache \
    XDG_STATE_HOME=/home/delegate/.local/state \
    UV_PYTHON_INSTALL_DIR=/opt/uv/python \
    UV_CACHE_DIR=/home/delegate/.cache/uv \
    OPENCODE_DISABLE_AUTOUPDATE=1

RUN uv python install "${PYTHON_VERSION}" \
    && mkdir -p /home/delegate /work

# uv keeps that Python off the PATH: two links put it there as `python3` and `python`, to what uv itself names.
RUN found="$(uv python find "${PYTHON_VERSION}")" \
    && ln -s "$found" /usr/local/bin/python3 \
    && ln -s "$found" /usr/local/bin/python

# The run's copy of the project is mounted here, read-write.
WORKDIR /work
