Dockerfile.citests

# Dockerfile for running CI tests in a container.
#
#
# Default: run lint, tests, then vulnerability check (all must pass).
#   docker run --rm fleet-intelligence-agent:test
#
# Copy coverage out:
#   docker run --rm -v "$(pwd)/coverage:/src/coverage" fleet-intelligence-agent:test
#
# Run only one check:
#   docker run --rm fleet-intelligence-agent:test sh -c "cd third_party/fleet-intelligence-sdk && go test ./..."
#   docker run --rm fleet-intelligence-agent:test make test
#   docker run --rm fleet-intelligence-agent:test make lint
#   docker run --rm fleet-intelligence-agent:test make vuln
#
# Run specific package tests:
#   docker run --rm fleet-intelligence-agent:test go test -v ./internal/...
#
FROM golang:1.26.1

ARG TARGETARCH

RUN apt-get update && apt-get install -y --no-install-recommends \
    ca-certificates \
    curl \
    git \
    openssh-client \
    build-essential \
  && rm -rf /var/lib/apt/lists/*

# Install DCGM runtime from NVIDIA repo.
# - amd64: package is datacenter-gpu-manager in debian12/x86_64.
# - arm64: package is datacenter-gpu-manager-4-core in debian12/sbsa.
RUN if [ "${TARGETARCH}" = "amd64" ]; then \
      echo "deb [trusted=yes] https://developer.download.nvidia.com/compute/cuda/repos/debian12/x86_64 /" > /etc/apt/sources.list.d/nvidia-cuda.list && \
      apt-get update && \
      apt-get install -y --no-install-recommends datacenter-gpu-manager && \
      rm -rf /var/lib/apt/lists/*; \
    elif [ "${TARGETARCH}" = "arm64" ]; then \
      echo "deb [trusted=yes] https://developer.download.nvidia.com/compute/cuda/repos/debian12/sbsa /" > /etc/apt/sources.list.d/nvidia-cuda.list && \
      apt-get update && \
      apt-get install -y --no-install-recommends datacenter-gpu-manager-4-core && \
      rm -rf /var/lib/apt/lists/*; \
    else \
      echo "Skipping DCGM install: unsupported TARGETARCH=${TARGETARCH}"; \
    fi

# Install golangci-lint (matches CI / make lint)
RUN curl -sSfL https://raw.githubusercontent.com/golangci/golangci-lint/master/install.sh | sh -s -- -b /usr/local/bin
# Install govulncheck up front (avoids runtime installs as non-root user)
RUN go install golang.org/x/vuln/cmd/govulncheck@latest && mv /go/bin/govulncheck /usr/local/bin/govulncheck

WORKDIR /src

ENV CGO_ENABLED=1
ENV GOFLAGS=-trimpath

COPY . .

# Default: run lint, tests, then vulnerability check (exit on first failure).
# Mirrors CI: lint job (golangci-lint + third_party license check + govulncheck) and unit_test job (make test).
CMD ["sh", "-c", "make lint && make test && make vuln"]