# Ubuntu-based validation image mirroring .github/workflows/build.yml
# Linux job. Used to validate the working tree builds + passes tests on
# Linux without waiting for GitHub Actions.
#
# Build:
#   docker build -t fold-linux-validate -f docker/Dockerfile.linux-validate .
#
# Run validation against the current source tree (mounts read-only,
# writes build artifacts to an ephemeral container path):
#   docker run --rm -v "$PWD":/workspace:ro fold-linux-validate
#
# To shell into the image for debugging:
#   docker run --rm -it -v "$PWD":/workspace:ro fold-linux-validate bash

FROM ubuntu:24.04

ARG LLVM_VERSION=19
ARG DEBIAN_FRONTEND=noninteractive

# System deps: mirror the apt list in .github/workflows/build.yml + the
# Conan toolchain bootstrap (python + pip + git for VCS-fetched recipes).
RUN apt-get update && apt-get install -y --no-install-recommends \
        ca-certificates \
        clang-${LLVM_VERSION} \
        llvm-${LLVM_VERSION}-dev \
        libclang-${LLVM_VERSION}-dev \
        libclang-cpp${LLVM_VERSION}-dev \
        libz3-dev \
        libsqlite3-dev \
        meson \
        ninja-build \
        pkg-config \
        nlohmann-json3-dev \
        libcli11-dev \
        libspdlog-dev \
        libfmt-dev \
        python3 \
        python3-pip \
        python3-venv \
        git \
        curl \
        cmake \
        make \
        rsync \
    && rm -rf /var/lib/apt/lists/*

# Symlink versioned binaries to unversioned names. Conan recipes
# (pkgconf, etc.) shell out to bare `clang`/`clang++` during their own
# meson configure step and ignore CC/CXX env, so the symlinks are
# load-bearing for the Conan build leg.
RUN ln -sf /usr/bin/clang-${LLVM_VERSION} /usr/local/bin/clang \
    && ln -sf /usr/bin/clang++-${LLVM_VERSION} /usr/local/bin/clang++ \
    && ln -sf /usr/bin/llvm-config-${LLVM_VERSION} /usr/local/bin/llvm-config

ENV CC=clang-${LLVM_VERSION}
ENV CXX=clang++-${LLVM_VERSION}
ENV LLVM_CONFIG=llvm-config-${LLVM_VERSION}

# Conan in an isolated venv so it doesn't fight Ubuntu's PEP-668.
# Profile detection runs at container startup (in run-validate) so it
# sees the final CC/CXX env and the runtime user's $HOME, not the
# image-build root's.
RUN python3 -m venv /opt/conan-venv \
    && /opt/conan-venv/bin/pip install --no-cache-dir 'conan>=2,<3' \
    && ln -s /opt/conan-venv/bin/conan /usr/local/bin/conan

# Drive the same pipeline the GitHub Actions Linux job runs. Source is
# mounted read-only at /workspace; we rsync into /build so the meson
# build dir lives on the container's writable layer and doesn't touch
# the host.
WORKDIR /build
COPY docker/run-validate.sh /usr/local/bin/run-validate
RUN chmod +x /usr/local/bin/run-validate

ENTRYPOINT ["/usr/local/bin/run-validate"]