# SPDX-License-Identifier: GPL-3.0-or-later
#
# Base image for the dogfooding harness (Stage 2). Carries the Bear-under-test
# installed as a real release install (correct INTERCEPT_LIBDIR layout) plus
# the cdb-compare binary. Built from a 'git archive HEAD' context so only
# committed files reach the image (dogfood-run-containerized: the repo working
# tree and the devcontainer image stay unmodified).
#
# Multi-stage: the builder carries the Rust toolchain; the final stage does
# not, so the shipped base stays free of a build toolchain.

# ARG must precede the first FROM so it can parameterize the base image; both
# stages reference the same pinned digest.
ARG BASE_IMAGE

FROM ${BASE_IMAGE} AS builder

ENV RUSTUP_HOME=/root/.rustup \
    CARGO_HOME=/root/.cargo \
    PATH=/root/.cargo/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin

# Build deps: c-development for the cc toolchain the cc-crate/preload link
# needs, lld because the ELF version script uses multiple version tags that
# GNU ld rejects (lld is required on Linux per the repo host requirements),
# curl for the rustup bootstrap. rustup gives a known >= 1.85 toolchain for
# the Rust 2024 edition regardless of what fedora's packaged rust happens to
# be (mirrors the devcontainer, which also bootstraps via rustup).
RUN dnf -y install curl ca-certificates lld git \
    && dnf -y group install c-development \
    && dnf -y clean all \
    && rm -rf /var/cache/dnf \
    && curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs \
        | sh -s -- -y --profile minimal --default-toolchain stable

WORKDIR /work
COPY . /work

# Build the workspace release binaries (Bear) and the comparator, then install
# Bear with the default INTERCEPT_LIBDIR=lib so bear-driver resolves
# ../lib/libexec.so. PREFIX=/opt/bear gives the fixed layout
# /opt/bear/bin/bear -> /opt/bear/libexec/bear/bin/bear-driver.
RUN cargo build --release \
    && cargo build --release -p bear-test-tools --bin cdb-compare \
    && PREFIX=/opt/bear sh scripts/install.sh \
    && install -m 755 target/release/cdb-compare /opt/bear/bin/cdb-compare

# rprof (github.com/rizsotto/rprof): a single-process resource profiler, pinned
# by release tag, baked into the base so the harness can profile bear-driver's
# CPU/memory during a build (dogfood-metrics-collect). Built here in the
# toolchain-carrying builder and installed into /opt/bear/bin so the final stage
# inherits it on PATH with no Rust toolchain (multi-stage: copy just the
# binary). rprof measures the single launched process and ignores its
# descendants, so `rprof run -- bear -- <build>` profiles exactly bear-driver
# (the `bear` entry script execs the driver; the compilers are descendants).
ARG RPROF_REF=v1.0.0
RUN git clone https://github.com/rizsotto/rprof /tmp/rprof \
    && git -C /tmp/rprof checkout "${RPROF_REF}" \
    && cargo build --release --manifest-path /tmp/rprof/Cargo.toml \
    && install -m 755 /tmp/rprof/target/release/rprof /opt/bear/bin/rprof \
    && rm -rf /tmp/rprof

FROM ${BASE_IMAGE} AS final

# Copy the installed Bear tree and the comparator; no Rust toolchain here.
COPY --from=builder /opt/bear /opt/bear

ENV PATH=/opt/bear/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin

# Clang tooling for the clang-consumer check (dogfood-clang-consumer): clang +
# clang-tools-extra give clangd, clang-tidy, and clang itself. These are CONSUMER
# tools (like cdb-compare) - they read a captured compilation database and try to
# build the AST for each entry - so they belong in the final stage, NOT the
# toolchain-only builder. Every per-target image layers on this base, so the
# clang-consumer check needs no per-target change. The base grows by the clang
# install (accepted: it is the tool the database exists to feed).
RUN dnf -y install clang clang-tools-extra \
    && dnf -y clean all \
    && rm -rf /var/cache/dnf

# Sanity: the entry script and driver must be present and runnable, rprof (the
# metrics capability) must be on PATH, and the clang consumer (clang-tidy, for
# the clang-consumer check) must run.
RUN bear --version && rprof --version && clang-tidy --version
