rust-bucket-cli 0.9.5

# Generated by rust-bucket v0.9.5. DO NOT EDIT BY HAND.

FROM rust:1.92-bookworm

ARG CACHE_BUST=4

# Install system dependencies
RUN apt-get update && apt-get install -y --no-install-recommends \
    git \
    curl \
    ca-certificates \
    pkg-config \
    libssl-dev \
    && rm -rf /var/lib/apt/lists/*

# Install cargo-nextest (required test runner per TESTING.md)
# Build from source to avoid architecture compatibility issues
RUN cargo install cargo-nextest --locked

# Install beads_rust task tracker (required per AGENTS.md)
# br must be available on PATH.
# Install a checksum-verified prebuilt binary instead of building from source:
# br's fsqlite backend uses nightly-only Rust features, so no published br
# version compiles on the stable toolchain. Upstream ships checksummed prebuilt
# binaries per release, which we pin for reproducibility.
# See: https://github.com/Dicklesworthstone/beads_rust/releases
ARG BR_VERSION=0.2.15
RUN set -eux; \
    arch="$(dpkg --print-architecture)"; \
    case "$arch" in \
      amd64) br_arch="linux_musl_amd64" ;; \
      arm64) br_arch="linux_musl_arm64" ;; \
      *) echo "unsupported arch: $arch" >&2; exit 1 ;; \
    esac; \
    base="https://github.com/Dicklesworthstone/beads_rust/releases/download/v${BR_VERSION}"; \
    curl -fsSL -o /tmp/br.tar.gz "${base}/br-${BR_VERSION}-${br_arch}.tar.gz"; \
    curl -fsSL -o /tmp/br.sha "${base}/br-${BR_VERSION}-${br_arch}.tar.gz.sha256"; \
    expected="$(awk '{print $1}' /tmp/br.sha)"; \
    actual="$(sha256sum /tmp/br.tar.gz | awk '{print $1}')"; \
    [ "$expected" = "$actual" ] || { echo "br checksum mismatch: $expected != $actual" >&2; exit 1; }; \
    tar -xzf /tmp/br.tar.gz -C /usr/local/bin br; \
    rm -f /tmp/br.tar.gz /tmp/br.sha; \
    br --version

# Ensure all tool binaries are on PATH
ENV PATH="/root/.local/bin:/root/.cargo/bin:${PATH}"

# Installs ratchets (pinned) for validating project ratchets
RUN cargo install ratchets@0.3.1

# Installs cargo-deny (pinned) for security, license, and dependency policy checks
# Version must support the deny.toml schema v2 (cargo-deny >= 0.14)
RUN cargo install cargo-deny@0.19.9 --locked

# Set working directory
WORKDIR /workspace

# Verify installations
RUN echo "=== Verifying installations ===" && \
    cargo --version && \
    cargo-nextest --version && \
    br --version && \
    ratchets --version && \
    cargo-deny --version && \
    echo "=== All verifications complete ==="

# Default command
CMD ["bash"]