Dockerfile.agent

# Stage 1: Install production dependencies
ARG BUN_BASE_IMAGE=oven/bun:1.3.8-debian
FROM ${BUN_BASE_IMAGE} AS deps
WORKDIR /app
COPY package.json bun.lock ./
RUN bun install --production --frozen-lockfile --omit optional
COPY tsconfig.json ./
COPY src/ ./src/
RUN bun build src/execution/agent-entrypoint.ts --target=bun --packages=external --outfile=dist/execution/agent-entrypoint.js

# Stage 2: Agent job image
FROM ${BUN_BASE_IMAGE}

# git is required for workspace manager (git clone)
# clang-format provides git-clang-format for default explicit formatter suggestions
# python3 + kodi-addon-checker required for addon lint checks
RUN apt-get update && apt-get install -y --no-install-recommends git clang-format ca-certificates python3 python3-pip && pip3 install --no-cache-dir --break-system-packages kodi-addon-checker==0.0.36 && rm -rf /var/lib/apt/lists/*

# Pre-accept bypassPermissions mode so the SDK CLI doesn't prompt/fail non-interactively
RUN mkdir -p /home/bun/.claude && \
    echo '{"bypassPermissionsModeAccepted":true,"hasTrustDialogAccepted":true}' > /home/bun/.claude/settings.json && \
    chown -R bun:bun /home/bun/.claude

WORKDIR /app

# Copy production dependencies from deps stage
COPY --from=deps /app/node_modules ./node_modules

# Copy compiled application
COPY package.json bun.lock tsconfig.json ./
COPY --from=deps /app/dist ./dist

# Ensure runtime files copied from root-owned build stages are readable by the
# non-root bun user in Azure Container Apps jobs.
RUN chmod a+rx /app && \
    chmod a+r /app/package.json /app/bun.lock /app/tsconfig.json && \
    chmod -R a+rX /app/dist /app/node_modules

# Run as non-root user (oven/bun images include 'bun' user)
USER bun

# No EXPOSE — agent jobs have no incoming ports
CMD ["bun", "run", "dist/execution/agent-entrypoint.js"]