# Build stage - compile binary for target architecture
FROM --platform=$BUILDPLATFORM golang:1.24 AS builder

ARG TARGETPLATFORM
ARG TARGETOS
ARG TARGETARCH
ARG GIT_HASH
ARG GIT_BRANCH

WORKDIR /workspace
COPY . .

RUN GOOS=$TARGETOS \
    GOARCH=$TARGETARCH \
    CGO_ENABLED=0 \
    go build -buildmode=pie -trimpath -mod=vendor -buildvcs=false \
    -ldflags "-X main.buildTime=$(date -u '+%Y-%m-%d_%I:%M:%S%p') -X main.gitHash=${GIT_HASH} -X main.gitBranch=${GIT_BRANCH}" \
    -o /workspace/agent-control-server main.go

# Final stage - copy binary and helm charts
# Universal image with all vendor tools for one-build, multi-push
FROM ubuntu:25.10

ARG TARGETARCH
ARG DEBIAN_FRONTEND=noninteractive
RUN apt-get update && apt-get install -y unzip wget

# Install all vendor tools for multi-cloud support
RUN if [ "$TARGETARCH" = "arm64" ]; then \
      # AWS - aws-iam-authenticator
      wget -O /usr/local/bin/aws-iam-authenticator https://github.com/kubernetes-sigs/aws-iam-authenticator/releases/download/v0.7.7/aws-iam-authenticator_0.7.7_linux_arm64 && \
      chmod +x /usr/local/bin/aws-iam-authenticator && \
      # GCP - gcloud-sdk
      wget -O /tmp/gcp-cloud-sdk.tar.gz https://storage.googleapis.com/cloud-sdk-release/for_packagers/linux/google-cloud-cli-gke-gcloud-auth-plugin_538.0.0.orig_aarch64.tar.gz && \
      tar xvzf /tmp/gcp-cloud-sdk.tar.gz -C / && rm -f /tmp/gcp-cloud-sdk.tar.gz && \
      # Azure - kube-login
      wget -O /tmp/kubelogin.zip https://github.com/Azure/kubelogin/releases/download/v0.2.10/kubelogin-linux-arm64.zip && \
      unzip /tmp/kubelogin.zip -d /tmp/ && \
      mv /tmp/bin/linux_arm64/kubelogin /usr/local/bin/ && \
      chmod +x /usr/local/bin/kubelogin && \
      rm -rf /tmp/kubelogin.zip /tmp/bin && \
      # AliCloud - ack-ram-tool
      wget -O /tmp/ack-ram-tool.tgz https://github.com/AliyunContainerService/ack-ram-tool/releases/download/v0.20.0-beta.6/ack-ram-tool_0.20.0-beta.6_Linux_arm64.tar.gz && \
      tar xzf /tmp/ack-ram-tool.tgz -C /tmp/ && \
      mv /tmp/ack-ram-tool /usr/local/bin/ && \
      chmod +x /usr/local/bin/ack-ram-tool && \
      rm -rf /tmp/ack-ram-tool.tgz /tmp/README.* /tmp/LICENSE; \
    else \
      # AWS - aws-iam-authenticator
      wget -O /usr/local/bin/aws-iam-authenticator https://github.com/kubernetes-sigs/aws-iam-authenticator/releases/download/v0.7.7/aws-iam-authenticator_0.7.7_linux_amd64 && \
      chmod +x /usr/local/bin/aws-iam-authenticator && \
      # GCP - gcloud-sdk
      wget -O /tmp/gcp-cloud-sdk.tar.gz https://storage.googleapis.com/cloud-sdk-release/for_packagers/linux/google-cloud-cli-gke-gcloud-auth-plugin_538.0.0.orig_amd64.tar.gz && \
      tar xvzf /tmp/gcp-cloud-sdk.tar.gz -C / && rm -f /tmp/gcp-cloud-sdk.tar.gz && \
      # Azure - kube-login
      wget -O /tmp/kubelogin.zip https://github.com/Azure/kubelogin/releases/download/v0.2.10/kubelogin-linux-amd64.zip && \
      unzip /tmp/kubelogin.zip -d /tmp/ && \
      mv /tmp/bin/linux_amd64/kubelogin /usr/local/bin/ && \
      chmod +x /usr/local/bin/kubelogin && \
      rm -rf /tmp/kubelogin.zip /tmp/bin && \
      # AliCloud - ack-ram-tool
      wget -O /tmp/ack-ram-tool.tgz https://github.com/AliyunContainerService/ack-ram-tool/releases/download/v0.20.0-beta.6/ack-ram-tool_0.20.0-beta.6_Linux_x86_64.tar.gz && \
      tar xzf /tmp/ack-ram-tool.tgz -C /tmp/ && \
      mv /tmp/ack-ram-tool /usr/local/bin/ && \
      chmod +x /usr/local/bin/ack-ram-tool && \
      rm -rf /tmp/ack-ram-tool.tgz /tmp/README.* /tmp/LICENSE; \
    fi

# Copy binary and helm from builder - keeping the same paths as original Dockerfile
COPY --from=builder /workspace/agent-control-server /usr/local/bin/agent-control-server
COPY --from=builder /workspace/assets/helm /etc/helm

ENV PATH=$PATH:/google-cloud-sdk/bin
USER 65532:65532
ENTRYPOINT ["/usr/local/bin/agent-control-server"]