Dockerfile.ci

# syntax=docker/dockerfile:1.7

# CI toolchain images are intentionally linux/amd64. The current Woodpecker
# runners are amd64 and use the cross image to produce arm64 application
# artifacts. Update ci/images.lock only after all four targets self-test.
FROM rust:1.88-bookworm@sha256:af306cfa71d987911a781c37b59d7d67d934f49684058f96cf72079c3626bfe0 AS core

ARG NODE_VERSION=22.17.1
ARG NODE_SHA256=ff04bc7c3ed7699ceb708dbaaf3580d899ff8bf67f17114f979e83aa74fc5a49
ARG NPM_VERSION=11.9.0
ARG SCCACHE_VERSION=0.8.2
ARG SCCACHE_SHA256=ecda4ddc89a49f1ec6f35bdce5ecbf6f205b399a680d11119d4ce9f6d962104e

ENV DEBIAN_FRONTEND=noninteractive \
    CARGO_INCREMENTAL=0 \
    PLAYWRIGHT_BROWSERS_PATH=/ms-playwright \
    RUSTUP_TOOLCHAIN=1.88.0

RUN apt-get update && apt-get install -y --no-install-recommends \
        build-essential \
        ca-certificates \
        curl \
        file \
        git \
        jq \
        make \
        openssl \
        perl \
        pkg-config \
        protobuf-compiler \
        python3 \
        xz-utils \
    && rm -rf /var/lib/apt/lists/*

RUN curl -fsSLo /tmp/node.tar.xz \
        "https://nodejs.org/dist/v${NODE_VERSION}/node-v${NODE_VERSION}-linux-x64.tar.xz" \
    && echo "${NODE_SHA256}  /tmp/node.tar.xz" | sha256sum -c - \
    && tar -xJf /tmp/node.tar.xz -C /usr/local --strip-components=1 \
    && rm /tmp/node.tar.xz \
    && npm install --global "npm@${NPM_VERSION}" \
    && npm cache clean --force

RUN curl -fsSLo /tmp/sccache.tar.gz \
        "https://github.com/mozilla/sccache/releases/download/v${SCCACHE_VERSION}/sccache-v${SCCACHE_VERSION}-x86_64-unknown-linux-musl.tar.gz" \
    && echo "${SCCACHE_SHA256}  /tmp/sccache.tar.gz" | sha256sum -c - \
    && tar -xzf /tmp/sccache.tar.gz -C /tmp \
    && install -m 0755 "/tmp/sccache-v${SCCACHE_VERSION}-x86_64-unknown-linux-musl/sccache" /usr/local/bin/sccache \
    && rm -rf /tmp/sccache.tar.gz "/tmp/sccache-v${SCCACHE_VERSION}-x86_64-unknown-linux-musl"

RUN rustup component add rustfmt clippy \
    && rustup target add \
        aarch64-unknown-linux-gnu \
        aarch64-unknown-linux-musl \
        x86_64-pc-windows-msvc \
        x86_64-unknown-linux-musl \
    && rustc --version \
    && cargo --version \
    && rustfmt --version \
    && cargo clippy --version \
    && node --version \
    && npm --version \
    && protoc --version \
    && sccache --version \
    && test "$(rustc --version | awk '{print $2}')" = "1.88.0" \
    && test "$(node --version)" = "v${NODE_VERSION}" \
    && test "$(npm --version)" = "${NPM_VERSION}" \
    && test "$(sccache --version | awk '{print $2}')" = "${SCCACHE_VERSION}"

# Compile a minimal crate as an image-level toolchain self-test.
RUN tmpdir="$(mktemp -d)" \
    && cargo new --quiet --bin "$tmpdir/self-test" \
    && cargo build --quiet --manifest-path "$tmpdir/self-test/Cargo.toml" \
    && "$tmpdir/self-test/target/debug/self-test" \
    && rm -rf "$tmpdir"

WORKDIR /woodpecker/src

LABEL org.opencontainers.image.title="rustnzb CI core" \
      org.opencontainers.image.description="Pinned Rust, Node, npm, protoc, and sccache toolchain"


FROM core AS cross

ARG ZIG_VERSION=0.13.0
ARG ZIG_SHA256=d45312e61ebcc48032b77bc4cf7fd6915c11fa16e4aad116b66c9468211230ea
ARG CARGO_ZIGBUILD_VERSION=0.20.0
ARG CARGO_XWIN_VERSION=0.18.6
ARG CARGO_DEB_VERSION=2.8.0

RUN apt-get update && apt-get install -y --no-install-recommends \
        clang \
        docker.io \
        lld \
        llvm \
        nsis \
        skopeo \
        zip \
    && rm -rf /var/lib/apt/lists/*

RUN curl -fsSLo /tmp/zig.tar.xz \
        "https://ziglang.org/download/${ZIG_VERSION}/zig-linux-x86_64-${ZIG_VERSION}.tar.xz" \
    && echo "${ZIG_SHA256}  /tmp/zig.tar.xz" | sha256sum -c - \
    && mkdir -p /opt/zig \
    && tar -xJf /tmp/zig.tar.xz -C /opt/zig --strip-components=1 \
    && ln -s /opt/zig/zig /usr/local/bin/zig \
    && rm /tmp/zig.tar.xz

RUN cargo install cargo-zigbuild --version "${CARGO_ZIGBUILD_VERSION}" --locked \
    && cargo install cargo-xwin --version "${CARGO_XWIN_VERSION}" --locked \
    && cargo install cargo-deb --version "${CARGO_DEB_VERSION}" --locked \
    && zig version \
    && cargo install --list | grep -F "cargo-zigbuild v${CARGO_ZIGBUILD_VERSION}:" \
    && cargo install --list | grep -F "cargo-xwin v${CARGO_XWIN_VERSION}:" \
    && cargo install --list | grep -F "cargo-deb v${CARGO_DEB_VERSION}:" \
    && makensis -VERSION \
    && skopeo --version

LABEL org.opencontainers.image.title="rustnzb CI cross" \
      org.opencontainers.image.description="Core plus pinned Zig, cargo-zigbuild, cargo-xwin, cargo-deb, LLVM/lld, and packaging tools"


FROM core AS e2e

# This lockfile pins @playwright/test. Browser installation happens only while
# building this image; ordinary E2E task execution never installs a browser or
# operating-system packages.
COPY e2e/package.json e2e/package-lock.json /tmp/e2e-image/
RUN cd /tmp/e2e-image \
    && npm ci --ignore-scripts --no-audit --no-fund \
    && npx playwright install --with-deps chromium \
    && npx playwright --version \
    && chromium="$(find /ms-playwright -type f -name chrome -o -name chromium | head -n 1)" \
    && test -n "$chromium" \
    && "$chromium" --headless --no-sandbox --disable-gpu --dump-dom about:blank >/tmp/chromium-self-test.html \
    && grep -q '<html' /tmp/chromium-self-test.html \
    && rm -rf /tmp/e2e-image /tmp/chromium-self-test.html /root/.cache/ms-playwright

LABEL org.opencontainers.image.title="rustnzb CI e2e" \
      org.opencontainers.image.description="Core plus the Playwright Chromium build pinned by e2e/package-lock.json"


FROM core AS desktop

RUN apt-get update && apt-get install -y --no-install-recommends \
        libappindicator3-dev \
        librsvg2-dev \
        libwebkit2gtk-4.1-dev \
        patchelf \
    && rm -rf /var/lib/apt/lists/* \
    && pkg-config --exists webkit2gtk-4.1 \
    && pkg-config --exists ayatana-appindicator3-0.1 \
    && pkg-config --exists librsvg-2.0 \
    && patchelf --version

LABEL org.opencontainers.image.title="rustnzb CI desktop" \
      org.opencontainers.image.description="Core plus WebKitGTK, AppIndicator, librsvg, and patchelf for Tauri tests"