ARG BUF_VERSION=1.72.0
FROM bufbuild/buf:${BUF_VERSION} AS buf

FROM golang:1.27.0-bookworm

ARG PROTOC_VERSION=35.0
ARG PROTOC_AMD64_SHA256=a45cda0989c17dd950db55f6fbe1e5814c50fda08e87aa422980ac1f89dddbbc
ARG PROTOC_ARM64_SHA256=36b518ac14d90351cc6598228ed2bbe5afe4e357b1af470b07e0ec1609875de2
ARG PROTOC_GEN_GO_VERSION=1.36.12
ARG PROTOC_GEN_GO_GRPC_VERSION=1.6.2
ARG GO_WINRES_VERSION=0.3.3
ARG TARGETARCH

ENV GOCACHE=/cache/go-build \
    GOMODCACHE=/cache/go/pkg/mod \
    GOPATH=/cache/go \
    PATH=/cache/go/bin:/usr/local/go/bin:/usr/local/bin:/usr/bin:/bin

COPY --from=buf /usr/local/bin/buf /usr/local/bin/buf

RUN apt-get update \
    && apt-get install -y --no-install-recommends ca-certificates curl git make unzip \
    && rm -rf /var/lib/apt/lists/* \
    && case "${TARGETARCH}" in \
         amd64) protoc_arch=x86_64; protoc_sha="${PROTOC_AMD64_SHA256}" ;; \
         arm64) protoc_arch=aarch_64; protoc_sha="${PROTOC_ARM64_SHA256}" ;; \
         *) echo "unsupported toolchain architecture: ${TARGETARCH}" >&2; exit 1 ;; \
       esac \
    && curl -fsSLo /tmp/protoc.zip \
       "https://github.com/protocolbuffers/protobuf/releases/download/v${PROTOC_VERSION}/protoc-${PROTOC_VERSION}-linux-${protoc_arch}.zip" \
    && echo "${protoc_sha}  /tmp/protoc.zip" | sha256sum -c - \
    && unzip -q /tmp/protoc.zip -d /usr/local \
    && rm /tmp/protoc.zip

RUN GOBIN=/usr/local/bin go install "google.golang.org/protobuf/cmd/protoc-gen-go@v${PROTOC_GEN_GO_VERSION}" \
    && GOBIN=/usr/local/bin go install "google.golang.org/grpc/cmd/protoc-gen-go-grpc@v${PROTOC_GEN_GO_GRPC_VERSION}"

# Release packaging generates a temporary, architecture-suffixed Windows
# resource object with this pinned pure-Go tool. It is intentionally part of
# the toolchain image rather than a host prerequisite.
RUN GOBIN=/usr/local/bin go install "github.com/tc-hib/go-winres@v${GO_WINRES_VERSION}"

RUN mkdir -p /cache/go-build /cache/go/pkg/mod /cache/xdg /workspace \
    && chown -R 1001:1001 /cache /workspace

WORKDIR /workspace