Dockerfile.pre-commit

# syntax=docker/dockerfile:1
# SPDX-FileCopyrightText: Copyright 2026 Arm Limited and/or its affiliates
# SPDX-License-Identifier: Apache-2.0
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
#     https://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.


# APT revisions follow the selected distribution so security updates stay resolvable.
# hadolint global ignore=DL3008

# Match the development image's Python minor and Debian distribution for the same check environment.
FROM python:3.13-slim-trixie

ENV DEBIAN_FRONTEND=noninteractive \
  PIP_DISABLE_PIP_VERSION_CHECK=1 \
  PYTHONDONTWRITEBYTECODE=1 \
  PYTHONUNBUFFERED=1

# Keep workflow diagnostics consistent with Dockerfile and scripts/setup-lxc-dev.sh.
ARG ACTIONLINT_VERSION=1.7.12

SHELL ["/bin/bash", "-o", "pipefail", "-c"]

RUN set -eux; \
  apt-get update; \
  apt-get install -y --no-install-recommends \
  ca-certificates \
  curl \
  git \
  shellcheck \
  shfmt; \
  rm -rf /var/lib/apt/lists/*; \
  arch="$(dpkg --print-architecture)"; \
  case "${arch}" in \
    amd64) actionlint_arch="amd64" ;; \
    i386) actionlint_arch="386" ;; \
    arm64) actionlint_arch="arm64" ;; \
    armel|armhf) actionlint_arch="armv6" ;; \
    *) echo "Unsupported actionlint architecture: ${arch}" >&2; exit 1 ;; \
  esac; \
  actionlint_archive="actionlint_${ACTIONLINT_VERSION}_linux_${actionlint_arch}.tar.gz"; \
  actionlint_base_url="https://github.com/rhysd/actionlint/releases/download/v${ACTIONLINT_VERSION}"; \
  tmp_dir="$(mktemp -d)"; \
  curl --location --retry 3 --retry-all-errors --retry-delay 2 -fsSLo "${tmp_dir}/${actionlint_archive}" "${actionlint_base_url}/${actionlint_archive}"; \
  curl --location --retry 3 --retry-all-errors --retry-delay 2 -fsSLo "${tmp_dir}/checksums.txt" "${actionlint_base_url}/actionlint_${ACTIONLINT_VERSION}_checksums.txt"; \
  checksum="$(grep " ${actionlint_archive}$" "${tmp_dir}/checksums.txt")"; \
  echo "${checksum%% *}  ${tmp_dir}/${actionlint_archive}" | sha256sum --check --strict; \
  tar -xzf "${tmp_dir}/${actionlint_archive}" -C "${tmp_dir}" actionlint; \
  install -m 0755 "${tmp_dir}/actionlint" /usr/local/bin/actionlint; \
  rm -rf "${tmp_dir}"; \
  actionlint -version; \
  shellcheck --version

COPY tools/opk-ci /tmp/opk-tools/opk-ci
# Formatter versions must agree with development and CI to avoid formatting churn.
COPY requirements/sdk.txt /tmp/opk-requirements/sdk.txt

RUN python3 -m pip install --no-cache-dir -c /tmp/opk-requirements/sdk.txt /tmp/opk-tools/opk-ci && \
  rm -rf /tmp/opk-tools && \
  groupadd --system repo-checks && \
  useradd \
  --system \
  --gid repo-checks \
  --create-home \
  --home-dir /home/repo-checks \
  --shell /bin/sh \
  repo-checks

ENV HOME=/home/repo-checks

# The system account is created above; its allocated UID need not match the host.
# hadolint ignore=DL3066
USER repo-checks