FROM python:3.12-slim

# Tools required by collectors:
#   curl   -> collect_endpoints()  (HTTP health checks)
#   procps -> collect_resources()  (free -h for memory)
#   docker.io -> collect_containers(), collect_errors()  (docker ps, docker logs)
#   git    -> collect_git_versions()  (git log in mounted repos)
#   gh     -> collect_ci()  (GitHub Actions status)
RUN apt-get update && apt-get install -y --no-install-recommends \
        curl \
        procps \
        git \
        ca-certificates \
        gnupg \
 && install -m 0755 -d /etc/apt/keyrings \
 && curl -fsSL https://download.docker.com/linux/debian/gpg \
        -o /etc/apt/keyrings/docker.asc \
 && chmod a+r /etc/apt/keyrings/docker.asc \
 && echo "deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/docker.asc] https://download.docker.com/linux/debian $(. /etc/os-release && echo $VERSION_CODENAME) stable" \
        > /etc/apt/sources.list.d/docker.list \
 && curl -fsSL https://cli.github.com/packages/githubcli-archive-keyring.gpg \
        -o /usr/share/keyrings/githubcli-archive-keyring.gpg \
 && echo "deb [arch=$(dpkg --print-architecture) signed-by=/usr/share/keyrings/githubcli-archive-keyring.gpg] https://cli.github.com/packages stable main" \
        > /etc/apt/sources.list.d/github-cli.list \
 && apt-get update && apt-get install -y --no-install-recommends docker-ce-cli gh \
 && rm -rf /var/lib/apt/lists/*

# Git safe.directory: status bot runs as root but mounts host repos owned
# by ubuntu — allow git to read them without "dubious ownership" errors
RUN git config --global --add safe.directory '*'

WORKDIR /app
COPY requirements.txt .
RUN pip install --no-cache-dir -r requirements.txt
COPY . .
CMD ["python", "bot.py"]
