# This default may be swapped for any compatible base image
ARG BASE_IMAGE=ubuntu:24.04

# Containerbase is used for tool installation and user/directory setup
FROM ghcr.io/containerbase/base:14.9.5@sha256:2852f7e2784fb21e745325a81c9beb1906be51b79956376eecf9ce57dacf6fd0 AS containerbase


FROM ${BASE_IMAGE} as base

RUN apt-get update -y && apt-get upgrade -y && apt-get clean && rm -rf /var/lib/apt/lists/*

# Containerbase supports custom user
ARG USER_NAME=wss-scanner
ARG USER_ID=1000
ARG USER_HOME=/home/${USER_NAME}

# Set env and shell
ENV BASH_ENV=/usr/local/etc/env
SHELL ["/bin/bash" , "-c"]

# Set up containerbase
COPY --from=containerbase /usr/local/sbin/ /usr/local/sbin/
COPY --from=containerbase /usr/local/containerbase/ /usr/local/containerbase/
RUN install-containerbase && \
    prepare-tool all

# renovate: datasource=github-tags depName=git lookupName=git/git
ARG GIT_VERSION=v2.41.0
RUN install-tool git
# instruction #7: install-tool git
# ┌────────────┬────────────┬───────────────────────────────────────────────────────────────────┐
# │ Severity   │ Count      │ CVEs                                                              │
# ├────────────┼────────────┼───────────────────────────────────────────────────────────────────┤
# │ Critical   │ 5          │ CVE-2026-64564, CVE-2026-64535, CVE-2026-53398, CVE-2026-74394    │
# │            │            │ CVE-2026-63940                                                    │
# ├────────────┼────────────┼───────────────────────────────────────────────────────────────────┤
# │ High       │ 101        │ CVE-2026-64091, CVE-2026-63974, CVE-2026-64093, CVE-2026-64380    │
# │            │            │ CVE-2026-64393, CVE-2026-63954, CVE-2026-68399, CVE-2026-63917    │
# │            │            │ CVE-2025-71315, CVE-2026-53250, CVE-2026-53269, CVE-2026-53275    │
# │            │            │ CVE-2026-53266, CVE-2026-53239, CVE-2026-64390, CVE-2026-64383    │
# │            │            │ CVE-2026-64387, CVE-2025-38717, CVE-2026-72478, CVE-2026-63823    │
# │            │            │ CVE-2026-63946, CVE-2026-63976, CVE-2026-63971, CVE-2026-63809    │
# │            │            │ CVE-2026-63926, CVE-2026-63815, CVE-2026-68284, CVE-2026-63884    │
# │            │            │ CVE-2026-68236, CVE-2026-68329, CVE-2026-68323, CVE-2026-53264    │
# │            │            │ CVE-2026-53262, CVE-2026-64396, CVE-2026-43009, CVE-2025-40190    │
# │            │            │ CVE-2026-64361, CVE-2026-53254, CVE-2026-53256, CVE-2026-64385    │
# │            │            │ CVE-2026-64386, CVE-2026-64423, CVE-2026-72024, CVE-2026-72472    │
# │            │            │ CVE-2026-74506, CVE-2026-31536, CVE-2025-38187, CVE-2026-64432    │
# │            │            │ CVE-2026-74334, CVE-2026-72135, CVE-2026-64548, CVE-2026-23393    │
# │            │            │ CVE-2026-72110, CVE-2026-68085, CVE-2026-72123, CVE-2026-46275    │
# │            │            │ CVE-2026-52909, CVE-2026-68451, CVE-2026-63801, CVE-2026-68470    │
# │            │            │ CVE-2026-53388, CVE-2026-68257, CVE-2025-40064, CVE-2026-64002    │
# │            │            │ CVE-2026-53362, CVE-2026-64018, CVE-2025-40025, CVE-2025-40158    │
# │            │            │ CVE-2026-43263, CVE-2026-46320, CVE-2026-23208, CVE-2026-64191    │
# │            │            │ CVE-2026-64123, CVE-2026-64597, CVE-2026-64567, CVE-2026-64554    │
# │            │            │ CVE-2026-31663, CVE-2025-68360, CVE-2026-74465, CVE-2026-74446    │
# │            │            │ CVE-2026-74411, CVE-2025-68304, CVE-2026-68162, CVE-2026-68196    │
# │            │            │ CVE-2026-68189, CVE-2026-68121, CVE-2026-68117, CVE-2026-53198    │
# │            │            │ CVE-2026-68204, CVE-2026-53185, CVE-2026-53159, CVE-2026-53270    │
# │            │            │ CVE-2026-53399, CVE-2026-64266, CVE-2026-68442, CVE-2026-68446    │
# │            │            │ CVE-2026-23240, CVE-2026-64032, CVE-2026-43116, CVE-2026-53356    │
# │            │            │ CVE-2026-53357                                                    │
# └────────────┴────────────┴───────────────────────────────────────────────────────────────────┘

### !!! Install this version after the other versions, so that it is the default !!! ###
# renovate: datasource=adoptium-java depName=java
ARG JAVA_VERSION=17.0.8+7
RUN install-tool java

# END OF BASE IMAGE

# Download the SAST CLI and set it in $PATH, can be replaced by:
#--build-arg SASTCLI=URL
RUN echo "Downloading latest Mend Unified CLI wrapper"
ARG SASTCLI=https://downloads.mend.io/cli/linux_amd64/mend
RUN curl -f $SASTCLI --create-dirs -o /sast/bin/mend && chmod 0775 /sast/bin/mend
ENV PATH=$PATH:/sast/bin

ENV WS_SAST_SCAN_PREFIX=SAST_

### copy folder
COPY docker-image-scanner/ /
# instruction #11: docker-image-scanner/ /
# ┌────────────┬────────────┬───────────────────────────────────────────────────────────────┐
# │ Severity   │ Count      │ CVEs                                                          │
# ├────────────┼────────────┼───────────────────────────────────────────────────────────────┤
# │ High       │ 4          │ CVE-2022-3510, CVE-2022-3509, CVE-2024-7254, CVE-2022-3171    │
# └────────────┴────────────┴───────────────────────────────────────────────────────────────┘

RUN chmod 755 /start.sh
RUN chgrp -R 0 ${USER_HOME} && chmod -R g=u ${USER_HOME}

ENV SCM_SCANNER_HOME=/etc/usr/local/whitesource/scm-scanner
RUN chmod -R ugo+rw ${SCM_SCANNER_HOME}
ENV LOG4J_FORMAT_MSG_NO_LOOKUPS=true
### Switch User ###
ENV HOME ${USER_HOME}
WORKDIR ${USER_HOME}
USER ${USER_NAME}
ARG JAVA_OPTS
ENV JAVA_OPTS=${JAVA_OPTS}
ENV JDK_JAVA_OPTIONS "--add-opens java.base/java.util=ALL-UNNAMED --add-opens java.base/sun.reflect.generics.reflectiveObjects=ALL-UNNAMED"

EXPOSE 9393

ENTRYPOINT ["docker-entrypoint.sh"]
# Mend traceability labels  
LABEL io.mend.image.dockerfile.path=integration-new/github-scanner-parent/scm-packaging/src/assembly-staging/docker/Dockerfile
LABEL org.opencontainers.image.source=https://github.com/whitesource/github-scanner

CMD ["/start.sh"]
