# Control runtime: runs `prepare` and `report`, and is the base of every toolchain image.
# A minimal Ubuntu 26.04 with only Python 3, PyYAML, Git and CA certificates, installed at build time from signed
# Ubuntu package metadata with no recommended packages. Nothing is installed or downloaded when a pipeline runs.
# No compiler suite, no -dev libraries and no download tool are installed: nothing in the platform needs them.
# Build context is the repository root. Exact build commands are in IMPLEMENTATION.md.
#
#   UBUNTU_BASE_IMAGE      the Ubuntu 26.04 image, pinned by digest
#   PYTHON3_VERSION        exact Ubuntu package versions; a version the archive no longer serves fails the build
#   PYTHON3_YAML_VERSION
#   GIT_VERSION
#   PYYAML_VERSION         the PyYAML release the python3-yaml package must provide; must equal requirements.txt
ARG UBUNTU_BASE_IMAGE=ubuntu:26.04@sha256:6a06111c3b0a8600feadb270aec771dc239bf407b25625f93f44ab00e11f4d3c
ARG PYTHON3_VERSION=3.14.3-0ubuntu2
ARG PYTHON3_YAML_VERSION=6.0.3-1build1
ARG GIT_VERSION=1:2.53.0-1ubuntu1.1
ARG PYYAML_VERSION=6.0.3

FROM ${UBUNTU_BASE_IMAGE}
ARG UBUNTU_BASE_IMAGE
ARG PYTHON3_VERSION
ARG PYTHON3_YAML_VERSION
ARG GIT_VERSION
ARG PYYAML_VERSION

RUN set -eu; \
    printf '%s' "${UBUNTU_BASE_IMAGE}" | grep -Eq '@sha256:[0-9a-f]{64}$' || { echo 'UBUNTU_BASE_IMAGE must be pinned by @sha256 digest' >&2; exit 1; }; \
    export DEBIAN_FRONTEND=noninteractive; \
    apt-get update; \
    apt-get install --yes --no-install-recommends \
        "python3=${PYTHON3_VERSION}" \
        "python3-yaml=${PYTHON3_YAML_VERSION}" \
        "git=${GIT_VERSION}" \
        ca-certificates; \
    apt-get clean; \
    rm -rf /var/lib/apt/lists/*; \
    PYYAML_EXPECTED="${PYYAML_VERSION}" python3 -I -c 'import os, sys, yaml; assert sys.version_info >= (3, 13), sys.version; assert yaml.__version__ == os.environ["PYYAML_EXPECTED"], yaml.__version__'; \
    git --version

LABEL org.opencontainers.image.base.name="${UBUNTU_BASE_IMAGE}"