# Self-hosted GitHub Actions runner for EarningsCall/earningscall-development.
# Runs all of this repo's workflows in an isolated container on hzdev. Compared
# to GitHub's ubuntu-latest the image needs to bake in what those workflows use
# beyond a checkout + setup-python:
#   - gh CLI      (upgrade-deps.yml: `gh pr list` / `gh pr create`)
#   - AWS CLI v2  (release.yml: `aws s3 ...` / `aws sts ...`)
#   - uv          (test-downstream.yml installs the cca dependency set)
# No Node is installed — the actions/runner agent bundles its own runtime for
# JS actions (checkout, setup-python, upload-artifact, ...), and no job runs
# node/yarn directly (unlike cca's build-cdk).
FROM ubuntu:24.04

ENV DEBIAN_FRONTEND=noninteractive

# Passed in at build time (see build.sh) so we always track the latest runner.
ARG RUNNER_VERSION

# Base tooling.
#   - build-essential / python3-dev: native wheels that don't ship a manylinux
#     build fall back to compiling from source.
#   - libicu74: the actions/runner agent (.NET) needs it on Ubuntu 24.04.
#   - python3*: Ubuntu 24.04 ships CPython 3.12 as the default python3. This is a
#     baseline only — actions/setup-python@v6 overlays the job's Python (3.10-3.14
#     across this repo's matrices) into the per-job tool cache, and that writable,
#     non-root Python is what jobs use.
RUN apt-get update && apt-get install -y --no-install-recommends \
      ca-certificates curl git jq unzip tar xz-utils gnupg \
      build-essential pkg-config \
      python3 python3-dev python3-venv python3-pip \
      libicu74 \
  && rm -rf /var/lib/apt/lists/*

# gh CLI — upgrade-deps.yml shells out to it (preinstalled on GitHub-hosted
# runners, absent from a bare Ubuntu image).
RUN curl -fsSL https://cli.github.com/packages/githubcli-archive-keyring.gpg \
      -o /usr/share/keyrings/githubcli-archive-keyring.gpg \
  && echo "deb [arch=amd64 signed-by=/usr/share/keyrings/githubcli-archive-keyring.gpg] https://cli.github.com/packages stable main" \
      > /etc/apt/sources.list.d/github-cli.list \
  && apt-get update && apt-get install -y --no-install-recommends gh \
  && rm -rf /var/lib/apt/lists/*

# AWS CLI v2 — release.yml runs `aws s3 cp` / `aws sts get-caller-identity`
# directly (also preinstalled on GitHub-hosted runners).
RUN curl -fsSL "https://awscli.amazonaws.com/awscli-exe-linux-x86_64.zip" -o /tmp/awscliv2.zip \
  && unzip -q /tmp/awscliv2.zip -d /tmp \
  && /tmp/aws/install \
  && rm -rf /tmp/aws /tmp/awscliv2.zip

# uv (Astral). Pin into /usr/local/bin so it is on PATH for every user;
# test-downstream.yml detects it there and skips its curl-installer fallback.
# setup-python puts a writable Python first on PATH, so the workflow's
# `uv pip install --system` lands in that tool-cache Python (not root-owned
# /usr/lib/python3), which is why the container can install deps as non-root.
RUN curl -LsSf https://astral.sh/uv/install.sh \
      | env UV_INSTALL_DIR=/usr/local/bin INSTALLER_NO_MODIFY_PATH=1 sh

# Non-root runner user with a PINNED uid/gid, matching the other runner families
# on hzdev (cca-backend-runner also pins 1001). Do NOT rely on the implicit
# useradd id — it drifts between base-image builds.
RUN groupadd -g 1001 runner \
  && useradd -m -u 1001 -g 1001 -s /bin/bash runner
USER runner
# Pre-create the cache mountpoint so the named volume mounted at ~/.cache
# initializes owned by `runner` rather than root. The whole ~/.cache is a volume
# (not just ~/.cache/uv as on cca-backend) because this repo's workflows install
# with BOTH uv and plain pip, and both caches live under it.
RUN mkdir -p /home/runner/.cache
WORKDIR /home/runner/actions-runner

# GitHub Actions runner agent.
RUN curl -fsSL -o runner.tar.gz \
      "https://github.com/actions/runner/releases/download/v${RUNNER_VERSION}/actions-runner-linux-x64-${RUNNER_VERSION}.tar.gz" \
  && tar xzf runner.tar.gz \
  && rm runner.tar.gz

# --chmod so the image doesn't depend on the checkout preserving the file mode.
COPY --chown=runner:runner --chmod=0755 entrypoint.sh /home/runner/entrypoint.sh
ENTRYPOINT ["/home/runner/entrypoint.sh"]
