# syntax=docker/dockerfile:1
# ═══════════════════════════════════════════════════════════════
# Forge Guard — multi-arch Docker image
# ═══════════════════════════════════════════════════════════════
#
# Pre-configured with Foundry (forge, cast, anvil, chisel) plus the
# forge-guard binary, so CI users without Rust can run audits,
# deployment guards, simulations, and fuzz campaigns out of the box.
#
# docker pull ghcr.io/codetibo/forge-guard:latest
# docker run --rm -v "$PWD":/workspace ghcr.io/codetibo/forge-guard audit
#
# Built for linux/amd64 and linux/arm64 by .github/workflows/docker.yml
# on every v* tag push.
# ── Stage 1: build forge-guard from source ─────────────────────
# Latest stable Rust, matching CI (dtolnay/rust-toolchain@stable);
# the lockfile requires rustc >= 1.88 (via globset -> ignore).
FROM rust:1-bookworm AS builder
WORKDIR /build
# Layer caching: copy manifests first, then source.
COPY Cargo.toml Cargo.lock ./
COPY src ./src
RUN cargo build --release
# ── Stage 2: runtime — Foundry + forge-guard ───────────────────
# The official Foundry image ships forge, cast, anvil, and chisel in
# /usr/local/bin on Ubuntu 22.04 for both amd64 and arm64.
FROM ghcr.io/foundry-rs/foundry:stable
COPY --from=builder /build/target/release/forge-guard /usr/local/bin/forge-guard
# Where CI projects get mounted: docker run -v "$PWD":/workspace ...
WORKDIR /workspace
# forge-guard is the primary command; forge/cast/anvil/chisel remain
# reachable via --entrypoint for ad-hoc Foundry use.
ENTRYPOINT ["forge-guard"]
CMD ["--help"]
LABEL org.opencontainers.image.source="https://github.com/codetibo/forge-guard" \
org.opencontainers.image.description="Pre-deployment smart contract auditing framework for Foundry" \
org.opencontainers.image.licenses="MIT"