FROM ubuntu:jammy as builder

ARG CLI_VERSION
ARG BUILD_DATE
ARG TARGETARCH

# For now these are kept here but ensure they are in sync with building_env.sh
ENV TFSEC_VERSION=1.28.1 \
    GITLEAKS_VERSION=8.17.0 \
    KUBESEC_VERSION=2.13.0 \
    KUBE_SCORE_VERSION=1.17.0 \
    PATH=/usr/local/src/:${PATH}:/usr/local/bin/shiftleft/:/usr/local/bin/shiftleft/nodejs/bin \
    ARCH=$TARGETARCH

USER root

RUN echo 'APT::Install-Suggests "0";' >> /etc/apt/apt.conf.d/00-docker
RUN echo 'APT::Install-Recommends "0";' >> /etc/apt/apt.conf.d/00-docker

# Dependencies to install other tools, node is downloaded as the apt version is too old
RUN apt-get update && apt-get install -y gcc git python3 python3-dev \
        python3-pip python3-setuptools curl
COPY dynamic-lang.sh /
COPY building_env.sh /
RUN chmod +x /dynamic-lang.sh && /dynamic-lang.sh /usr/local/bin/shiftleft/
COPY requirements.txt /usr/local/src/
COPY scan /usr/local/src/
COPY lib /usr/local/src/lib
COPY tools_config/ /usr/local/src/

RUN python3 -m pip install --upgrade pip
RUN python3 -m pip install --no-cache-dir -r /usr/local/src/requirements.txt
RUN /usr/local/bin/shiftleft/nodejs/bin/npm install --no-audit --progress=false --only=production -g @cyclonedx/cdxgen  @microsoft/rush --unsafe-perm
RUN apt-get remove -y gcc python3-dev curl && apt-get autoremove -y && apt-get clean -y

FROM ubuntu:jammy as sast-scan-tools

LABEL maintainer="ShiftLeftSecurity" \
      org.label-schema.schema-version="1.0" \
      org.label-schema.vendor="shiftleft" \
      org.label-schema.name="sast-scan" \
      org.label-schema.version=$CLI_VERSION \
      org.label-schema.license="Apache-2.0" \
      org.label-schema.description="Container with various opensource static analysis security testing tools (shellcheck, gosec, tfsec, gitleaks, ...) for multiple programming languages" \
      org.label-schema.url="https://www.qwiet.ai" \
      org.label-schema.usage="https://github.com/ShiftLeftSecurity/sast-scan" \
      org.label-schema.build-date=$BUILD_DATE \
      org.label-schema.vcs-url="https://github.com/ShiftLeftSecurity/sast-scan.git" \
      org.label-schema.docker.cmd="docker run --rm -it --name sast-scan shiftleft/scan-slim"

ENV APP_SRC_DIR=/usr/local/src \
    DEPSCAN_CMD="/usr/local/bin/depscan" \
    PMD_CMD="" \
    PYTHONUNBUFFERED=1 \
    NVD_EXCLUDE_TYPES="o,h" \
    GIT_PYTHON_GIT_EXECUTABLE=/usr/bin/git \
    PATH=/usr/local/src/:/usr/local/bin/shiftleft/:/usr/local/bin/shiftleft/nodejs/bin:/usr/bin:${PATH}:

COPY --from=builder /usr /usr

WORKDIR /app

CMD [ "python3", "/usr/local/src/scan" ]
