FROM ghcr.io/actions/actions-runner@sha256:0cfdcc701ce933c6d243c6b0b2da767366dc9f2e99961d4c3754b0b78084cdda

ARG NODE_VERSION=24.18.0
ARG NODE_SHA256=55aa7153f9d88f28d765fcdad5ae6945b5c0f98a36881703817e4c450fa76742
ARG PNPM_VERSION=11.5.2
ARG BUN_VERSION=1.3.14
ARG BUN_SHA256=951ee2aee855f08595aeec6225226a298d3fea83a3dcd6465c09cbccdf7e848f
ARG UV_VERSION=0.12.2
ARG UV_SHA256=d66e96b5f1ca3b99806eee283a8125d33a0bd669e6e6d9bc4ab7ffda63c41bf4
ARG PYTHON_VERSION=3.13.7

USER root

ENV DEBIAN_FRONTEND=noninteractive \
    LANG=C.UTF-8 \
    HOME=/home/runner \
    PNPM_HOME=/home/runner/.local/share/pnpm \
    PNPM_STORE_DIR=/cache/pnpm/store \
    VENV_ARCHIVE_DIR=/cache/venv-archives \
    NPM_CONFIG_USERCONFIG=/etc/npmrc \
    COREPACK_ENABLE_DOWNLOAD_PROMPT=0 \
    FT_FROM_HOOK=1 \
    FT_HINTS=1 \
    PATH=/opt/python/bin:/usr/local/node/bin:/home/runner/.local/share/pnpm:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin

RUN apt-get update \
 && apt-get install -y --no-install-recommends ca-certificates curl git tini unzip xz-utils zstd \
 && rm -rf /var/lib/apt/lists/*

RUN curl -fsSLo /tmp/node.tar.xz "https://nodejs.org/dist/v${NODE_VERSION}/node-v${NODE_VERSION}-linux-x64.tar.xz" \
 && echo "${NODE_SHA256}  /tmp/node.tar.xz" | sha256sum -c - \
 && mkdir -p /usr/local/node \
 && tar -xJf /tmp/node.tar.xz -C /usr/local/node --strip-components=1 \
 && rm /tmp/node.tar.xz \
 && /usr/local/node/bin/corepack enable --install-directory /usr/local/node/bin \
 && /usr/local/node/bin/corepack prepare "pnpm@${PNPM_VERSION}" --activate

RUN curl -fsSLo /tmp/bun.zip "https://github.com/oven-sh/bun/releases/download/bun-v${BUN_VERSION}/bun-linux-x64.zip" \
 && echo "${BUN_SHA256}  /tmp/bun.zip" | sha256sum -c - \
 && unzip -q /tmp/bun.zip -d /tmp/bun \
 && install -m 0755 /tmp/bun/bun-linux-x64/bun /usr/local/bin/bun \
 && ln -s /usr/local/bin/bun /usr/local/bin/bunx \
 && rm -rf /tmp/bun.zip /tmp/bun

RUN curl -fsSLo /tmp/uv.tar.gz "https://github.com/astral-sh/uv/releases/download/${UV_VERSION}/uv-x86_64-unknown-linux-gnu.tar.gz" \
 && echo "${UV_SHA256}  /tmp/uv.tar.gz" | sha256sum -c - \
 && tar -xzf /tmp/uv.tar.gz -C /tmp \
 && install -m 0755 /tmp/uv-x86_64-unknown-linux-gnu/uv /usr/local/bin/uv \
 && install -m 0755 /tmp/uv-x86_64-unknown-linux-gnu/uvx /usr/local/bin/uvx \
 && rm -rf /tmp/uv.tar.gz /tmp/uv-x86_64-unknown-linux-gnu \
 && UV_PYTHON_INSTALL_DIR=/opt/python-managed uv python install "${PYTHON_VERSION}" \
 && ln -s "/opt/python-managed/cpython-${PYTHON_VERSION}-linux-x86_64-gnu/bin" /opt/python \
 && ln -s /opt/python/python3.13 /usr/local/bin/python3 \
 && ln -s /opt/python/python3.13 /usr/local/bin/python

RUN mkdir -p /home/runner/.local/share/pnpm /cache/pnpm/store /cache/venv-archives \
 && chown -R runner:runner /home/runner/.local /cache

# As in modules/sandbox/image/Containerfile, executable permission must survive
# keep-id/user-namespace ownership differences. Isolation comes from dropped pod
# capabilities and no privilege escalation, not owner-only modes on entrypoints.
COPY --chmod=0755 cache-warm.sh /usr/local/bin/cache-warm
COPY npmrc /etc/npmrc

USER runner
WORKDIR /home/runner
ENTRYPOINT ["/usr/bin/tini", "--"]
CMD ["/home/runner/run.sh"]