FROM python:3.13-slim

# Install gh CLI from official apt source
RUN apt-get update && apt-get install -y --no-install-recommends \
        curl \
        ca-certificates \
        gpg \
    && curl -fsSL https://cli.github.com/packages/githubcli-archive-keyring.gpg \
        | gpg --dearmor -o /usr/share/keyrings/githubcli-archive-keyring.gpg \
    && echo "deb [arch=$(dpkg --print-architecture) signed-by=/usr/share/keyrings/githubcli-archive-keyring.gpg] https://cli.github.com/packages stable main" \
        > /etc/apt/sources.list.d/github-cli.list \
    && apt-get update && apt-get install -y --no-install-recommends gh \
    && apt-get purge -y gpg \
    && rm -rf /var/lib/apt/lists/*

# Install pipx and focal-cli from PyPI
RUN pip install --no-cache-dir pipx \
    && pipx install focal-cli \
    && pipx ensurepath

# Non-root user
RUN useradd --create-home --shell /bin/bash focal
USER focal
ENV HOME=/home/focal
ENV PATH="/home/focal/.local/bin:$PATH"

# GH_TOKEN must be provided at runtime: docker run -e GH_TOKEN=ghp_xxx ...
ENTRYPOINT ["focal"]
