Dockerfile.foreman-agent-builder

# Foreman coder-Job builder image (#620) and in-cluster foreman-agent
# toolchain image (#797).
#
# The coder Job (pkg/foreman/agent/tools/coder_job_template.yaml) runs
# `foreman-agent run-task`, whose `bash` tool shells out to
# `make fmt vet lint test` to verify the model's change. That needs the
# full toolchain (go + make + git), which the published, intentionally
# minimal Dockerfile.foreman-agent (alpine + git, no go/make) does not
# carry. This image bundles the foreman-agent binary with that toolchain.
#
# #797: the in-cluster foreman-agent also needs golangci-lint and
# controller-gen so its fast gate can run gofmt / go vet / go build /
# golangci-lint / go test without submitting a separate gate Job.
#
# Two stages:
#   1. builder -- compile the static foreman-agent binary, identical to
#      Dockerfile.foreman-agent's build stage.
#   2. runtime -- FROM golang at go.mod's version (make check-go-version
#      keeps the tag equal to it). It already ships go, make, and git, so
#      the coder's bash gate checks run unmodified.
#
# The binary lands at /usr/local/bin/foreman-agent (on PATH) so the
# template's `command: ["foreman-agent"]` resolves by bare name. We do
# NOT set an ENTRYPOINT: an ENTRYPOINT would prepend itself to the
# container's command and break that bare-name invocation.

# Build stage: full Go toolchain on a small base.
FROM --platform=$BUILDPLATFORM golang:1.27.3-alpine AS builder

ARG TARGETOS
ARG TARGETARCH

WORKDIR /workspace

# Dependency layer cache.
COPY go.mod go.sum ./
RUN go mod download

COPY api/ api/
COPY cmd/ cmd/
COPY internal/ internal/
COPY pkg/ pkg/

# Static build so the binary runs regardless of the runtime base's libc.
RUN CGO_ENABLED=0 GOOS=${TARGETOS:-linux} GOARCH=${TARGETARCH} \
    go build -trimpath -ldflags="-s -w" -o foreman-agent ./cmd/foreman-agent

# Runtime stage: golang at go.mod's version, so it already has go, make, and
# git for the coder's `make fmt vet lint test`.
FROM golang:1.27.3

# TARGETARCH is supplied by buildx; declare it so the helm fetch below can
# pick the right release asset for the runtime platform.
ARG TARGETARCH

# make is the only gate-check dependency the golang image does not already
# ship (go and git are present in the official image). curl + ca-certs are
# needed to fetch helm.
RUN apt-get update \
    && apt-get install -y --no-install-recommends make curl ca-certificates \
    && rm -rf /var/lib/apt/lists/*

# helm: coder tasks that edit Helm charts verify locally with
# `helm template` / `helm lint`. The golang image does not ship helm, so without
# this a chart-editing coder cannot run the verification its task asks for
# (the run_gate_job gate also lints charts). Pinned for reproducibility.
ARG HELM_VERSION=v3.22.1
RUN curl -fsSL "https://get.helm.sh/helm-${HELM_VERSION}-linux-${TARGETARCH:-amd64}.tar.gz" \
        | tar -xz -C /tmp \
    && mv "/tmp/linux-${TARGETARCH:-amd64}/helm" /usr/local/bin/helm \
    && chmod +x /usr/local/bin/helm \
    && rm -rf /tmp/linux-* \
    && helm version

# golangci-lint: the in-cluster foreman-agent fast gate runs
# `golangci-lint run` as part of its verification. Pinned to the same
# version the Makefile uses (GOLANGCI_LINT_VERSION).
ARG GOLANGCI_LINT_VERSION=v2.15.0
RUN go install "github.com/golangci/golangci-lint/v2/cmd/golangci-lint@${GOLANGCI_LINT_VERSION}" \
    && golangci-lint version

# controller-gen: the in-cluster foreman-agent fast gate may need to
# regenerate CRDs / DeepCopy methods as part of its verification. Pinned
# to the same version the Makefile uses (CONTROLLER_TOOLS_VERSION).
ARG CONTROLLER_TOOLS_VERSION=v0.23.0
RUN go install "sigs.k8s.io/controller-tools/cmd/controller-gen@${CONTROLLER_TOOLS_VERSION}" \
    && controller-gen --version

# /usr/local/bin is on PATH in the golang image, so the template's bare
# `command: ["foreman-agent"]` resolves here.
COPY --from=builder /workspace/foreman-agent /usr/local/bin/foreman-agent

# No ENTRYPOINT on purpose: the Job template supplies
# `command: ["foreman-agent"]` and relies on PATH resolution.