# syntax=docker/dockerfile:1.7

FROM golang:1.26-alpine AS controller
WORKDIR /src
COPY controller.go .
RUN CGO_ENABLED=0 go build -trimpath -ldflags="-s -w" -o /out/memby-builder-controller controller.go

FROM eclipse-temurin:17-jdk-jammy

ARG ANDROID_COMMAND_LINE_TOOLS_VERSION=15859902
ARG ANDROID_COMMAND_LINE_TOOLS_SHA256=4e4c464f145a7512b57d088ac6c278c03c9eea610886b35a5e0804e74eedf583
ARG ANDROID_PLATFORM=35
ARG ANDROID_BUILD_TOOLS=35.0.0

ENV ANDROID_HOME=/opt/android-sdk \
    ANDROID_SDK_ROOT=/opt/android-sdk \
    GRADLE_USER_HOME=/home/memby/.gradle \
    PATH=/opt/android-sdk/cmdline-tools/latest/bin:/opt/android-sdk/platform-tools:/opt/android-sdk/build-tools/35.0.0:${PATH}

RUN --mount=type=cache,target=/var/cache/apt,sharing=locked \
    --mount=type=cache,target=/var/lib/apt,sharing=locked \
    apt-get update && \
    DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends \
        ca-certificates curl git unzip && \
    rm -rf /var/lib/apt/lists/*

RUN mkdir -p "${ANDROID_HOME}/cmdline-tools" /tmp/android-tools && \
    curl --fail --location --show-error --silent \
        "https://dl.google.com/android/repository/commandlinetools-linux-${ANDROID_COMMAND_LINE_TOOLS_VERSION}_latest.zip" \
        --output /tmp/android-tools.zip && \
    echo "${ANDROID_COMMAND_LINE_TOOLS_SHA256}  /tmp/android-tools.zip" | sha256sum --check --strict && \
    unzip -q /tmp/android-tools.zip -d /tmp/android-tools && \
    mv /tmp/android-tools/cmdline-tools "${ANDROID_HOME}/cmdline-tools/latest" && \
    yes | sdkmanager --licenses >/dev/null && \
    sdkmanager \
        "platform-tools" \
        "platforms;android-${ANDROID_PLATFORM}" \
        "build-tools;${ANDROID_BUILD_TOOLS}" && \
    rm -rf /tmp/android-tools /tmp/android-tools.zip /root/.android

# Match the distroless gateway's non-root uid so both services can safely use the
# memby-releases volume. The signing material remains a read-only Compose secret.
RUN groupadd --gid 65532 memby && \
    useradd --uid 65532 --gid 65532 --create-home --home-dir /home/memby memby && \
    mkdir -p /work /data/releases "${GRADLE_USER_HOME}" && \
    chown -R 65532:65532 /work /data/releases /home/memby

COPY --chmod=0755 release.sh /usr/local/bin/memby-builder
COPY --from=controller --chmod=0755 /out/memby-builder-controller /usr/local/bin/memby-builder-controller

USER 65532:65532
WORKDIR /work
ENTRYPOINT ["/usr/local/bin/memby-builder"]
CMD ["release"]