Dockerfile

FROM golang:1.24-bookworm AS cue-builder

# Keep the action import path working when callers build the Docker action
# without passing build args, while still letting repo-owned `just` commands
# override the version from `.mise.toml`.
ARG CUE_VERSION=v0.15.0
RUN GOBIN=/cue-bin go install cuelang.org/go/cmd/cue@${CUE_VERSION}

FROM rust:1.85.0-bookworm AS dev

ARG CARGO_LLVM_COV_VERSION=0.6.15

# Keep the image focused on the repo's build and verification toolchain so local
# development and CI execute against the same Rust and CUE versions selected for
# the repository.
RUN rustup component add clippy rustfmt llvm-tools \
    && cargo install --locked cargo-llvm-cov --version "${CARGO_LLVM_COV_VERSION}"
COPY --from=cue-builder /cue-bin/cue /usr/local/bin/cue

WORKDIR /workspace

FROM rust:1.85.0-bookworm AS runtime-builder

WORKDIR /workspace
COPY Cargo.toml Cargo.lock ./
COPY schema ./schema
COPY src ./src
RUN cargo build --locked --release

FROM debian:bookworm-slim AS runtime

RUN apt-get update \
    && apt-get install --yes --no-install-recommends ca-certificates curl jq \
    && rm -rf /var/lib/apt/lists/*

WORKDIR /workspace
# The binary resolves bundled schemas relative to CARGO_MANIFEST_DIR, so the runtime image
# must preserve the schema directory at /workspace/schema.
COPY --from=runtime-builder /workspace/schema ./schema
COPY --from=runtime-builder /workspace/target/release/github-actionspec /usr/local/bin/github-actionspec
COPY --from=cue-builder /cue-bin/cue /usr/local/bin/cue
COPY scripts/action/entrypoint.sh /usr/local/bin/github-actionspec-action
RUN chmod +x /usr/local/bin/github-actionspec-action

ENTRYPOINT ["github-actionspec"]