# This default may be swapped for any compatible base image
ARG BASE_IMAGE=ubuntu:24.04

# Containerbase is used for tool installation and user/directory setup
FROM ghcr.io/containerbase/base:14.21.1@sha256:150b9ce5d54835ff80f01f6b0e451de5157ab6fda57c29cfd5c40e1ebd5f58d4 AS containerbase


FROM ${BASE_IMAGE} as base

RUN apt-get update -y && apt-get upgrade -y && apt-get clean && rm -rf /var/lib/apt/lists/*

# Containerbase supports custom user
ARG USER_NAME=wss-scanner
ARG USER_ID=1000
ARG USER_HOME=/home/${USER_NAME}

# Set env and shell
ENV BASH_ENV=/usr/local/etc/env
SHELL ["/bin/bash" , "-c"]

# Set up containerbase
COPY --from=containerbase /usr/local/sbin/ /usr/local/sbin/
COPY --from=containerbase /usr/local/containerbase/ /usr/local/containerbase/
RUN install-containerbase && \
    prepare-tool all

# renovate: datasource=github-tags depName=git lookupName=git/git
ARG GIT_VERSION=v2.41.0
RUN install-tool git
# instruction #7: install-tool git
# ┌────────────┬────────────┬───────────────────────────────────────────────────────────────────┐
# │ Severity   │ Count      │ CVEs                                                              │
# ├────────────┼────────────┼───────────────────────────────────────────────────────────────────┤
# │ Critical   │ 14         │ CVE-2026-63825, CVE-2026-89530, CVE-2026-93221, CVE-2026-68426    │
# │            │            │ CVE-2026-90037, CVE-2026-89659, CVE-2026-89708, CVE-2026-98725    │
# │            │            │ CVE-2026-64523, CVE-2026-98365, CVE-2026-89652, CVE-2026-98621    │
# │            │            │ CVE-2026-90162, CVE-2026-98805                                    │
# ├────────────┼────────────┼───────────────────────────────────────────────────────────────────┤
# │ High       │ 189        │ CVE-2026-80668, CVE-2026-80671, CVE-2025-38204, CVE-2026-98709    │
# │            │            │ CVE-2026-98707, CVE-2026-74744, CVE-2026-74714, CVE-2026-68081    │
# │            │            │ CVE-2026-74752, CVE-2026-98706, CVE-2026-98701, CVE-2026-98708    │
# │            │            │ CVE-2026-68103, CVE-2026-74715, CVE-2026-80681, CVE-2022-50240    │
# │            │            │ CVE-2026-98738, CVE-2026-98734, CVE-2026-98742, CVE-2026-89810    │
# │            │            │ CVE-2026-72111, CVE-2026-98735, CVE-2026-98763, CVE-2026-89837    │
# │            │            │ CVE-2025-37743, CVE-2026-97429, CVE-2024-44964, CVE-2026-98741    │
# │            │            │ CVE-2026-97415, CVE-2026-98737, CVE-2026-98739, CVE-2026-98733    │
# │            │            │ CVE-2026-89803, CVE-2026-90003, CVE-2026-98704, CVE-2026-97442    │
# │            │            │ CVE-2026-98115, CVE-2026-53250, CVE-2026-98104, CVE-2026-98107    │
# │            │            │ CVE-2025-40158, CVE-2026-80905, CVE-2026-72493, CVE-2025-38717    │
# │            │            │ CVE-2026-72413, CVE-2026-72423, CVE-2025-71315, CVE-2026-68451    │
# │            │            │ CVE-2026-74724, CVE-2026-74723, CVE-2026-68323, CVE-2026-43042    │
# │            │            │ CVE-2026-43034, CVE-2026-43048, CVE-2026-98164, CVE-2026-98167    │
# │            │            │ CVE-2026-90204, CVE-2026-43009, CVE-2025-40190, CVE-2026-72162    │
# │            │            │ CVE-2026-64077, CVE-2026-64078, CVE-2026-90343, CVE-2026-68409    │
# │            │            │ CVE-2026-68404, CVE-2026-64036, CVE-2026-80991, CVE-2024-56591    │
# │            │            │ CVE-2026-90313, CVE-2026-31536, CVE-2026-98260, CVE-2026-53377    │
# │            │            │ CVE-2025-40074, CVE-2026-98699, CVE-2026-80937, CVE-2026-98229    │
# │            │            │ CVE-2025-40025, CVE-2026-74334, CVE-2026-74344, CVE-2025-39933    │
# │            │            │ CVE-2026-74317, CVE-2026-52991, CVE-2026-52946, CVE-2024-40954    │
# │            │            │ CVE-2026-90392, CVE-2026-98754, CVE-2025-40344, CVE-2026-80691    │
# │            │            │ CVE-2024-46742, CVE-2026-98752, CVE-2026-90227, CVE-2026-80692    │
# │            │            │ CVE-2026-80693, CVE-2026-98134, CVE-2026-80864, CVE-2026-68471    │
# │            │            │ CVE-2026-64052, CVE-2026-68401, CVE-2026-90321, CVE-2026-90317    │
# │            │            │ CVE-2026-80982, CVE-2026-74268, CVE-2026-74269, CVE-2026-74314    │
# │            │            │ CVE-2026-90398, CVE-2026-89448, CVE-2026-90417, CVE-2026-98359    │
# │            │            │ CVE-2026-43213, CVE-2024-35948, CVE-2026-74388, CVE-2026-74454    │
# │            │            │ CVE-2026-98420, CVE-2026-74465, CVE-2026-74446, CVE-2026-97960    │
# │            │            │ CVE-2026-97906, CVE-2026-89564, CVE-2026-89580, CVE-2026-98487    │
# │            │            │ CVE-2026-89520, CVE-2026-98491, CVE-2026-89528, CVE-2026-89531    │
# │            │            │ CVE-2026-89537, CVE-2026-98462, CVE-2026-98441, CVE-2026-98442    │
# │            │            │ CVE-2026-98439, CVE-2026-98548, CVE-2026-98532, CVE-2025-68251    │
# │            │            │ CVE-2026-98515, CVE-2026-74530, CVE-2026-74535, CVE-2026-98503    │
# │            │            │ CVE-2026-63879, CVE-2026-74700, CVE-2026-74506, CVE-2026-89685    │
# │            │            │ CVE-2026-89676, CVE-2026-89675, CVE-2026-98586, CVE-2026-98589    │
# │            │            │ CVE-2026-98591, CVE-2026-98573, CVE-2026-98794, CVE-2026-23208    │
# │            │            │ CVE-2026-90256, CVE-2026-53281, CVE-2026-80891, CVE-2026-90205    │
# │            │            │ CVE-2026-80852, CVE-2026-80841, CVE-2025-40170, CVE-2025-40168    │
# │            │            │ CVE-2025-37776, CVE-2026-68447, CVE-2026-90375, CVE-2026-74347    │
# │            │            │ CVE-2026-46330, CVE-2025-71073, CVE-2026-80837, CVE-2026-98364    │
# │            │            │ CVE-2026-98332, CVE-2025-68304, CVE-2026-43379, CVE-2026-98490    │
# │            │            │ CVE-2024-52560, CVE-2026-98456, CVE-2026-98457, CVE-2026-98432    │
# │            │            │ CVE-2026-74385, CVE-2026-74533, CVE-2026-74510, CVE-2026-98171    │
# │            │            │ CVE-2026-90320, CVE-2026-98590, CVE-2026-89633, CVE-2026-89631    │
# │            │            │ CVE-2026-98567, CVE-2026-98561, CVE-2026-98570, CVE-2026-98642    │
# │            │            │ CVE-2026-74677, CVE-2026-93792, CVE-2026-98634, CVE-2026-93790    │
# │            │            │ CVE-2026-93787                                                    │
# └────────────┴────────────┴───────────────────────────────────────────────────────────────────┘

### !!! Install this version after the other versions, so that it is the default !!! ###
# renovate: datasource=adoptium-java depName=java
ARG JAVA_VERSION=17.0.8+7
RUN install-tool java

# END OF BASE IMAGE

# Download the SAST CLI and set it in $PATH, can be replaced by:
#--build-arg SASTCLI=URL
RUN echo "Downloading latest Mend Unified CLI wrapper"
ARG SASTCLI=https://downloads.mend.io/cli/linux_amd64/mend
RUN curl -f $SASTCLI --create-dirs -o /sast/bin/mend && chmod 0775 /sast/bin/mend
# instruction #10: curl -f $sastcli --create-dirs -o /sast/bin/mend && chmod 0775 /sast/bin/mend
# ┌────────────┬────────────┬────────────────────────────────────────────────────┐
# │ Severity   │ Count      │ CVEs                                               │
# ├────────────┼────────────┼────────────────────────────────────────────────────┤
# └────────────┴────────────┴────────────────────────────────────────────────────┘
ENV PATH=$PATH:/sast/bin

ENV WS_SAST_SCAN_PREFIX=SAST_

### copy folder
COPY docker-image-scanner/ /
# instruction #11: docker-image-scanner/ /
# ┌────────────┬────────────┬─────────────────────────────────────────────────────────────────┐
# │ Severity   │ Count      │ CVEs                                                            │
# ├────────────┼────────────┼─────────────────────────────────────────────────────────────────┤
# │ High       │ 6          │ CVE-2026-102554, CVE-2022-3510, CVE-2022-3509, CVE-2022-3171    │
# │            │            │ CVE-2024-7254, CVE-2026-75140                                   │
# └────────────┴────────────┴─────────────────────────────────────────────────────────────────┘

RUN chmod 755 /start.sh
RUN chgrp -R 0 ${USER_HOME} && chmod -R g=u ${USER_HOME}

ENV SCM_SCANNER_HOME=/etc/usr/local/whitesource/scm-scanner
RUN chmod -R ugo+rw ${SCM_SCANNER_HOME}
ENV LOG4J_FORMAT_MSG_NO_LOOKUPS=true
### Switch User ###
ENV HOME ${USER_HOME}
WORKDIR ${USER_HOME}
USER ${USER_NAME}
ARG JAVA_OPTS
ENV JAVA_OPTS=${JAVA_OPTS}
ENV JDK_JAVA_OPTIONS "--add-opens java.base/java.util=ALL-UNNAMED --add-opens java.base/sun.reflect.generics.reflectiveObjects=ALL-UNNAMED"

EXPOSE 9393

ENTRYPOINT ["docker-entrypoint.sh"]
# Mend traceability labels
LABEL io.mend.image.dockerfile.path=integration-new/github-scanner-parent/scm-packaging/src/assembly-staging/docker/Dockerfile
LABEL org.opencontainers.image.source=https://github.com/whitesource/github-scanner

CMD ["/start.sh"]
