# Example container for running validate-repo unattended.
#
# This is the portable unit you hand to any scheduler (cron, CI, an Airflow
# KubernetesPodOperator / DockerOperator, etc.). It bakes in: the Claude Code
# CLI, dbt + the project's packages (so `dbt parse` works), the gemma-dbt
# plugin (so the skill is available headless), and this automation folder.
#
# Build from a context that contains BOTH your dbt project and a checkout of
# the gemma-dbt plugin. Adjust the COPY paths to your layout.
#
#   docker build -f Dockerfile.example -t dbt-audit:dev .
#
# Then run it (report only — no PR):
#   docker run --rm -e ANTHROPIC_API_KEY -e DBT_PROJECT_DIR=/work/dbt \
#     -e PLUGIN_DIR=/opt/gemma-dbt -v "$PWD/out:/work/dbt/audit" dbt-audit:dev
FROM node:22-slim

# System deps: git + gh for PRs, gettext-base for envsubst, python/uv for dbt.
RUN apt-get update && apt-get install -y --no-install-recommends \
      git curl ca-certificates python3 python3-venv gettext-base \
  && curl -fsSL https://cli.github.com/packages/githubcli-archive-keyring.gpg \
      | tee /usr/share/keyrings/githubcli-archive-keyring.gpg > /dev/null \
  && echo "deb [arch=$(dpkg --print-architecture) signed-by=/usr/share/keyrings/githubcli-archive-keyring.gpg] https://cli.github.com/packages stable main" \
      > /etc/apt/sources.list.d/github-cli.list \
  && apt-get update && apt-get install -y gh \
  && rm -rf /var/lib/apt/lists/*

# uv (Python package manager) and the Claude Code CLI.
COPY --from=ghcr.io/astral-sh/uv:latest /uv /usr/local/bin/uv
RUN npm install -g @anthropic-ai/claude-code

# The gemma-dbt plugin (a checkout or extracted .zip). PLUGIN_DIR points here.
COPY gemma-dbt /opt/gemma-dbt

# The dbt project to audit. Install its Python deps + dbt packages so the
# skill's Phase A `dbt parse` succeeds. `dbt parse` does not touch the
# warehouse and returns no rows — it only needs a resolvable profile.
WORKDIR /work/dbt
COPY dbt/ ./
# If you enable the optional Phase-2 auto-fixes (RUN_FIXES=true), the container
# runs `git add` over this tree, so its ignore rules MUST be present or the
# artefacts generated just below (dbt_packages/, target/, logs/) get staged as
# phantom additions. `COPY dbt/ ./` includes a dbt-level .gitignore; if your
# ignore rules live at the repo root, COPY that too. Likewise, never exclude a
# tracked path from the build context (.dockerignore / a partial COPY) — it would
# be staged as a phantom deletion. run-audit.sh also guards against both at
# runtime (see FIXES_MAX_FILES), but a correct image avoids the guard tripping.
RUN uv sync --frozen --no-dev 2>/dev/null || pip3 install --break-system-packages dbt-bigquery
RUN dbt deps || true
ENV DBT_PROFILES_DIR=/work/dbt

# The automation scripts (this folder).
COPY gemma-dbt/skills/validate-repo/automation /opt/audit
RUN chmod +x /opt/audit/run-audit.sh

# Run as non-root: `claude --dangerously-skip-permissions` refuses to start as
# root. Give the user a home for the CLI's config/cache.
RUN useradd --create-home --uid 1001 audit && chown -R audit:audit /work /opt
USER audit
ENV HOME=/home/audit

ENV DBT_PROJECT_DIR=/work/dbt
ENV PLUGIN_DIR=/opt/gemma-dbt
WORKDIR /work
ENTRYPOINT ["/opt/audit/run-audit.sh"]