# Build environment for modding/hacked/ (vendored from
# https://github.com/inkyblackness/hacked, see ../README.md). Fetches the Go
# toolchain and this module's dependencies once, here, at image-build time, so
# ../hacked-build-run-image.sh can compile fully offline afterward. Rebuild
# with ../hacked-build-image.sh whenever a version below changes, or whenever
# ../hacked/go.mod or go.sum changes (its dependencies are baked into the
# image's module cache).
FROM ubuntu:22.04

# go.mod's own "go" directive is a minimum toolchain version, not a version to
# fetch - pin a stable release that already satisfies it so `go build` never
# needs to fetch a newer toolchain over the network at build time.
ARG GO_VERSION=1.27.1

# build-essential/pkg-config/curl/ca-certificates/git/gosu: base toolchain.
# mingw-w64: the Windows cross-build. libgl1-mesa-dev/xorg-dev: go-gl/glfw's
# cgo bindings (Linux build only - the Windows cross-build talks to the Win32
# API directly, via mingw-w64's own headers). libgtk-3-dev:
# github.com/sqweek/dialog's Linux backend uses GTK3 via cgo (`pkg-config
# gtk+-3.0`) for native file/message dialogs. zip: packages the Windows build
# (see build-hacked.sh) - tar, for the Linux .tgz, is already part of the
# base image.
RUN apt-get update \
    && DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends \
        build-essential pkg-config curl ca-certificates git gosu \
        mingw-w64 \
        libgl1-mesa-dev xorg-dev \
        libgtk-3-dev \
        zip \
    && rm -rf /var/lib/apt/lists/*

RUN curl -sSLO "https://go.dev/dl/go${GO_VERSION}.linux-amd64.tar.gz" \
    && tar -C /usr/local -xzf "go${GO_VERSION}.linux-amd64.tar.gz" \
    && rm "go${GO_VERSION}.linux-amd64.tar.gz"
ENV PATH=/usr/local/go/bin:${PATH}
ENV GOTOOLCHAIN=local
ENV GOPATH=/opt/go

# Populates /opt/go/pkg/mod with every dependency hacked/go.mod pins, so the
# container never needs network access to build it. Only go.mod/go.sum are
# copied in for this - not the rest of the source - so editing hacked's own
# .go files doesn't invalidate this layer's cache.
COPY hacked/go.mod hacked/go.sum /tmp/hacked-deps/
RUN cd /tmp/hacked-deps && go mod download && rm -rf /tmp/hacked-deps

COPY hacked-build-image/docker-entrypoint.sh /usr/local/bin/docker-entrypoint.sh
COPY hacked-build-image/build-hacked.sh /usr/local/bin/build-hacked.sh
# 755, not +x: the entrypoint drops to a `builder` user matching the *host's*
# UID/GID (see docker-entrypoint.sh), which is never in these root-owned
# files' group, so it needs the image's own explicit world-read+execute here -
# `chmod +x` alone only adds execute bits on top of whatever "other"
# permissions the source file happened to have (host umask-dependent).
RUN chmod 755 /usr/local/bin/docker-entrypoint.sh /usr/local/bin/build-hacked.sh

WORKDIR /workspace
ENTRYPOINT ["/usr/local/bin/docker-entrypoint.sh"]
CMD ["/usr/local/bin/build-hacked.sh"]

# Marks a shell as already running inside this image, same convention as the
# main project's own build-image (see ../../build-image/Dockerfile) - lets
# ../Makefile compile directly instead of trying to docker-run this image
# again from inside itself (e.g. a CI job already using this image as its
# container).
ENV HACKED_BUILD_IMAGE=1