Dockerfile

# syntax=docker/dockerfile:1
###########################################
###########################################
## Dockerfile to run MegaLinter ##
###########################################
###########################################

# @not-generated

#############################################################################################
## @generated by .automation/build.py using descriptor files, please do not update manually ##
#############################################################################################
#ARGTOP__START
ARG TARGETARCH
# renovate: datasource=crate depName=sarif-fmt
ARG CARGO_SARIF_FMT_VERSION=0.8.0
# renovate: datasource=docker depName=rhysd/actionlint
ARG ACTION_ACTIONLINT_VERSION=1.7.12
# renovate: datasource=docker depName=koalaman/shellcheck
ARG BASH_SHELLCHECK_VERSION=v0.11.0
# renovate: datasource=crate depName=zizmor
ARG CARGO_ZIZMOR_VERSION=1.25.0
# renovate: datasource=crate depName=shellcheck-sarif
ARG CARGO_SHELLCHECK_SARIF_VERSION=0.8.0
# renovate: datasource=docker depName=koalaman/shellcheck-alpine
ARG BASH_SHELLCHECK_VERSION=v0.11.0
# renovate: datasource=docker depName=mvdan/shfmt
ARG BASH_SHFMT_VERSION=v3.14.1-alpine
# renovate: datasource=docker depName=hadolint/hadolint
ARG DOCKERFILE_HADOLINT_VERSION=v2.15.1-alpine
# renovate: datasource=docker depName=mstruebing/editorconfig-checker
ARG EDITORCONFIG_EDITORCONFIG_CHECKER_VERSION=4.0.2
# renovate: datasource=github-tags depName=mgechev/revive
ARG GO_REVIVE_VERSION=v1.17.1
# renovate: datasource=docker depName=golang versioning=semver
ARG GO_IMAGE_VERSION=1.27.3
# renovate: datasource=docker depName=ghcr.io/yannh/kubeconform
ARG KUBERNETES_KUBECONFORM_VERSION=v0.8.0-alpine
# renovate: datasource=github-releases depName=JohnnyMorganz/StyLua extractVersion=^v(?<version>.+)$
ARG CARGO_STYLUA_VERSION=2.6.0
# renovate: datasource=docker depName=yoheimuta/protolint
ARG PROTOBUF_PROTOLINT_VERSION=0.58.0
# renovate: datasource=github-tags depName=checkmarx/dustilock
ARG REPOSITORY_DUSTILOCK_VERSION=1.2.0
# renovate: datasource=docker depName=ghcr.io/betterleaks/betterleaks
ARG REPOSITORY_BETTERLEAKS_VERSION=v1.7.3
# renovate: datasource=docker depName=trufflesecurity/trufflehog
ARG REPOSITORY_TRUFFLEHOG_VERSION=3.99.3
# renovate: datasource=docker depName=jdkato/vale
ARG SPELL_VALE_VERSION=v3.24.0
# renovate: datasource=docker depName=lycheeverse/lychee
ARG SPELL_LYCHEE_VERSION=0.24.2-alpine
# renovate: datasource=docker depName=ghcr.io/terraform-linters/tflint
ARG TERRAFORM_TFLINT_VERSION=0.65.0
# renovate: datasource=docker depName=alpine/terragrunt
ARG TERRAFORM_TERRAGRUNT_VERSION=1.17.0
# renovate: datasource=docker depName=ghcr.io/opentofu/opentofu
ARG TERRAFORM_TOFU_FMT_VERSION=1.13.2-minimal
#ARGTOP__END

#############################################################################################
## @generated by .automation/build.py using descriptor files, please do not update manually ##
#############################################################################################
#FROM__START
FROM alpine:3.24 AS cargo-bin-sarif-fmt
ARG CARGO_SARIF_FMT_VERSION
RUN set -eu; \
    apk add --no-cache build-base musl-dev openssl-dev openssl-libs-static pkgconfig bash perl rust cargo && \
    mkdir -p /out/bin && \
    cargo install --force --locked --root /out "sarif-fmt@${CARGO_SARIF_FMT_VERSION}"; \
    chmod +x /out/bin/sarif-fmt
FROM rhysd/actionlint:${ACTION_ACTIONLINT_VERSION} AS actionlint
# shellcheck is a dependency for actionlint
FROM koalaman/shellcheck:${BASH_SHELLCHECK_VERSION} AS shellcheck
FROM alpine:3.24 AS cargo-bin-zizmor
ARG CARGO_ZIZMOR_VERSION
RUN set -eu; \
    apk add --no-cache build-base musl-dev openssl-dev openssl-libs-static pkgconfig bash perl rust cargo && \
    mkdir -p /out/bin && \
    cargo install --force --locked --root /out "zizmor@${CARGO_ZIZMOR_VERSION}" && \
    chmod +x /out/bin/zizmor
FROM alpine:3.24 AS cargo-bin-shellcheck-sarif
ARG CARGO_SHELLCHECK_SARIF_VERSION
RUN set -eu; mkdir -p /out/bin; \
    apk add --no-cache build-base musl-dev openssl-dev openssl-libs-static pkgconfig bash perl rust cargo; \
    cargo install --force --locked --root /out "shellcheck-sarif@${CARGO_SHELLCHECK_SARIF_VERSION}"; \
    chmod +x /out/bin/shellcheck-sarif
# Next FROM line commented because already managed by another linter
# FROM koalaman/shellcheck:${BASH_SHELLCHECK_VERSION} AS shellcheck
FROM mvdan/shfmt:${BASH_SHFMT_VERSION} AS shfmt
FROM hadolint/hadolint:${DOCKERFILE_HADOLINT_VERSION} AS hadolint
FROM mstruebing/editorconfig-checker:${EDITORCONFIG_EDITORCONFIG_CHECKER_VERSION} AS editorconfig-checker
FROM golang:${GO_IMAGE_VERSION}-alpine AS revive
## The golang image used as a builder is a temporary workaround (https://github.com/mgechev/revive/issues/787)
## for the released revive binaries not returning version numbers (devel).
## The install command should then be what is commented in the go.megalinter-descriptor.yml
ARG GO_REVIVE_VERSION
RUN GOBIN=/usr/bin go install github.com/mgechev/revive@$GO_REVIVE_VERSION
FROM ghcr.io/yannh/kubeconform:${KUBERNETES_KUBECONFORM_VERSION} AS kubeconform
FROM ghcr.io/assignuser/chktex-alpine:latest AS chktex
FROM alpine:3.24 AS cargo-bin-stylua
ARG TARGETARCH
ARG CARGO_STYLUA_VERSION
RUN set -eu; mkdir -p /out/bin; \
    apk add --no-cache curl ca-certificates unzip; \
    case "$TARGETARCH" in \
      amd64) ARCH=x86_64 ;; \
      arm64) ARCH=aarch64 ;; \
      *) echo "unsupported arch: $TARGETARCH" >&2; exit 1 ;; \
    esac; \
    curl -fsSL -o /tmp/stylua.zip \
      "https://github.com/JohnnyMorganz/StyLua/releases/download/v${CARGO_STYLUA_VERSION}/stylua-linux-${ARCH}-musl.zip" && \
    unzip /tmp/stylua.zip -d /out/bin && \
    rm /tmp/stylua.zip && \
    chmod +x /out/bin/stylua
FROM yoheimuta/protolint:${PROTOBUF_PROTOLINT_VERSION} AS protolint
FROM golang:${GO_IMAGE_VERSION}-alpine AS dustilock
ARG REPOSITORY_DUSTILOCK_VERSION
RUN GOBIN=/usr/bin go install github.com/checkmarx/dustilock@v${REPOSITORY_DUSTILOCK_VERSION}
FROM ghcr.io/betterleaks/betterleaks:${REPOSITORY_BETTERLEAKS_VERSION} AS betterleaks
FROM trufflesecurity/trufflehog:${REPOSITORY_TRUFFLEHOG_VERSION} AS trufflehog
FROM jdkato/vale:${SPELL_VALE_VERSION} AS vale
FROM lycheeverse/lychee:${SPELL_LYCHEE_VERSION} AS lychee
FROM ghcr.io/terraform-linters/tflint:v${TERRAFORM_TFLINT_VERSION} AS tflint
FROM alpine/terragrunt:${TERRAFORM_TERRAGRUNT_VERSION} AS terragrunt
# Next FROM line commented because already managed by another linter
# FROM alpine/terragrunt:${TERRAFORM_TERRAGRUNT_VERSION} AS terragrunt
FROM ghcr.io/opentofu/opentofu:${TERRAFORM_TOFU_FMT_VERSION} AS opentofu
# Next FROM line commented because already managed by another linter
# FROM ghcr.io/opentofu/opentofu:${TERRAFORM_TOFU_FMT_VERSION} AS opentofu
#FROM__END

##################
# Build wheel for megalinter python package
##################
FROM ghcr.io/astral-sh/uv:0.12.3 AS uv
FROM python:3.14-alpine3.24 AS build-ml-core
RUN python -m pip install --no-cache-dir "wheel>=0.46.2" "setuptools>=75.8.0" \
    && rm -rf /usr/local/lib/python3.13/site-packages/setuptools/_vendor/wheel*
WORKDIR /
COPY --from=uv /uv /uvx /bin/
# Install dependencies
#UV_SYNC__START
RUN --mount=type=cache,target=/root/.cache/uv \
    --mount=type=bind,source=uv.lock,target=uv.lock \
    --mount=type=bind,source=pyproject.toml,target=pyproject.toml \
    uv sync --frozen --no-install-project --extra llm
# Copy the project into the image
COPY . .
# Sync the project
RUN --mount=type=cache,target=/root/.cache/uv \
    uv sync --frozen --extra llm
#UV_SYNC__END

##################
# Get base image #
##################
FROM python:3.14-alpine3.24
# Python 3.14.7 is the first release fixing the CPython stack limit check and the
# 128 KiB default thread stack size on musl (https://github.com/python/cpython/issues/148260),
# without which deep recursion in a thread segfaults MegaLinter instead of raising
# RecursionError. The base image tag floats, so assert the floor at build time.
RUN python -c 'import sys; assert sys.version_info >= (3, 14, 7), "Python 3.14.7+ required (musl thread stack fixes), got " + sys.version' \
    && python -m pip install --no-cache-dir "wheel>=0.46.2" "setuptools>=75.8.0" \
    && rm -rf /usr/local/lib/python3.13/site-packages/setuptools/_vendor/wheel*

#############################################################################################
## @generated by .automation/build.py using descriptor files, please do not update manually ##
#############################################################################################
#ARG__START
ARG TARGETPLATFORM
# renovate: datasource=github-tags depName=PowerShell/PowerShell
ARG POWERSHELL_VERSION=7.6.7
# renovate: datasource=github-tags depName=sgerrand/alpine-pkg-glibc
ARG ALPINE_GLIBC_PACKAGE_VERSION=2.34-r0
# renovate: datasource=repology depName=alpine_3_24/go versioning=loose
ARG GO_ALPINE_VERSION=1.26.10-r0
# renovate: datasource=github-tags depName=PowerShell/PowerShell
ARG POWERSHELL_VERSION=7.6.7

# renovate: datasource=npm depName=@salesforce/cli
ARG NPM_SALESFORCE_CLI_VERSION=2.155.7
# renovate: datasource=npm depName=@salesforce/plugin-packaging
ARG NPM_SALESFORCE_PLUGIN_PACKAGING_VERSION=3.0.14
# renovate: datasource=npm depName=sfdx-hardis
ARG SFDX_HARDIS_VERSION=8.19.0
# renovate: datasource=github-tags depName=coursier/coursier
ARG SCALA_COURSIER_VERSION=2.1.26
# renovate: datasource=npm depName=typescript
ARG NPM_TYPESCRIPT_VERSION=6.0.3
# renovate: datasource=pypi depName=ansible-lint
ARG PIP_ANSIBLE_LINT_VERSION=26.10.1
# renovate: datasource=npm depName=@stoplight/spectral-cli
ARG NPM_SPECTRAL_CLI_VERSION=6.17.0
# renovate: datasource=github-tags depName=Azure/arm-ttk
ARG ARM_TTK_VERSION=20250401
ARG ARM_TTK_NAME='arm-ttk.zip'
ARG ARM_TTK_DIRECTORY='/opt/microsoft'
# renovate: datasource=github-tags depName=Azure/bicep
ARG BICEP_VERSION=0.48.1
ARG BICEP_EXE='bicep'
ARG BICEP_DIR='/usr/local/bin'
# renovate: datasource=pypi depName=cpplint
ARG PIP_CPPLINT_VERSION=2.0.2
# renovate: datasource=github-tags depName=clj-kondo/clj-kondo
ARG CLJ_KONDO_VERSION=2026.08.04

# renovate: datasource=github-tags depName=greglook/cljstyle
ARG CLJ_STYLE_VERSION=0.17.642
# renovate: datasource=pypi depName=cfn-lint
ARG PIP_CFN_LINT_VERSION=1.57.2
# renovate: datasource=npm depName=jscpd
ARG NPM_JSCPD_VERSION=5.4.1
# renovate: datasource=nuget depName=csharpier
ARG CSHARP_CSHARPIER_VERSION=1.2.6
# renovate: datasource=nuget depName=roslynator.dotnet.cli
ARG CSHARP_ROSLYNATOR_VERSION=0.13.0
# renovate: datasource=npm depName=stylelint
ARG NPM_STYLELINT_VERSION=17.16.0
# renovate: datasource=npm depName=stylelint-config-standard
ARG NPM_STYLELINT_CONFIG_STANDARD_VERSION=40.0.0
# renovate: datasource=npm depName=stylelint-config-sass-guidelines
ARG NPM_STYLELINT_CONFIG_SASS_GUIDELINES_VERSION=13.0.0
# renovate: datasource=npm depName=stylelint-scss
ARG NPM_STYLELINT_SCSS_VERSION=7.3.0
# renovate: datasource=npm depName=@biomejs/biome
ARG NPM_BIOMEJS_BIOME_VERSION=2.5.15
# renovate: datasource=dart-version depName=dart
ARG DART_VERSION='3.12.2'
# renovate: datasource=github-releases depName=dotenv-linter/dotenv-linter extractVersion=^v(?<version>.+)$
ARG DOTENV_LINTER_VERSION=4.0.0
# renovate: datasource=npm depName=gherkin-lint
ARG NPM_GHERKIN_LINT_VERSION=4.2.4
# renovate: datasource=github-tags depName=golangci/golangci-lint
ARG GO_GOLANGCI_LINT_VERSION=2.15.0
# renovate: datasource=npm depName=npm-groovy-lint
ARG NPM_GROOVY_LINT_VERSION=18.0.0
# renovate: datasource=pypi depName=djlint
ARG PIP_DJLINT_VERSION=1.46.4
# renovate: datasource=npm depName=htmlhint
ARG NPM_HTMLHINT_VERSION=1.9.2
# renovate: datasource=github-releases depName=checkstyle/checkstyle
ARG JAVA_CHECKSTYLE_VERSION=12.1.0
# renovate: datasource=github-tags depName=pmd/pmd extractVersion=^pmd_releases/(?<version>.*)$
ARG PMD_VERSION=7.28.0

# renovate: datasource=npm depName=eslint
ARG NPM_ESLINT_VERSION=10.13.0
# renovate: datasource=npm depName=@eslint/js
ARG NPM_ESLINT_JS_VERSION=10.0.1
# renovate: datasource=npm depName=eslint-config-prettier
ARG NPM_ESLINT_CONFIG_PRETTIER_VERSION=10.1.8
# renovate: datasource=npm depName=eslint-plugin-import-x
ARG NPM_ESLINT_PLUGIN_IMPORT_X_VERSION=4.17.1
# renovate: datasource=npm depName=eslint-plugin-jest
ARG NPM_ESLINT_PLUGIN_JEST_VERSION=29.17.0
# renovate: datasource=npm depName=eslint-plugin-n
ARG NPM_ESLINT_PLUGIN_N_VERSION=18.5.0
# renovate: datasource=npm depName=eslint-plugin-prettier
ARG NPM_ESLINT_PLUGIN_PRETTIER_VERSION=5.5.7
# renovate: datasource=npm depName=eslint-plugin-promise
ARG NPM_ESLINT_PLUGIN_PROMISE_VERSION=7.3.0
# renovate: datasource=npm depName=eslint-plugin-vue
ARG NPM_ESLINT_PLUGIN_VUE_VERSION=10.11.1
# renovate: datasource=npm depName=@microsoft/eslint-formatter-sarif
ARG NPM_MICROSOFT_ESLINT_FORMATTER_SARIF_VERSION=3.1.0
# renovate: datasource=npm depName=standard
ARG NPM_STANDARD_VERSION=17.1.2
# renovate: datasource=npm depName=prettier
ARG NPM_PRETTIER_VERSION=3.9.10
# renovate: datasource=npm depName=@prantlf/jsonlint
ARG NPM_PRANTLF_JSONLINT_VERSION=17.0.1
# renovate: datasource=npm depName=v8r
ARG NPM_V8R_VERSION=6.1.0
# renovate: datasource=npm depName=npm-package-json-lint
ARG NPM_PACKAGE_JSON_LINT_VERSION=11.0.0
# renovate: datasource=npm depName=npm-package-json-lint-config-default
ARG NPM_PACKAGE_JSON_LINT_CONFIG_DEFAULT_VERSION=10.0.0
# renovate: datasource=npm depName=@eslint-react/eslint-plugin
ARG NPM_ESLINT_REACT_ESLINT_PLUGIN_VERSION=5.28.3
# renovate: datasource=github-tags depName=pinterest/ktlint
ARG KTLINT_VERSION=1.8.0

# renovate: datasource=github-tags depName=detekt/detekt
ARG DETEKT_VERSION=1.23.8

# renovate: datasource=github-releases depName=kubescape/kubescape extractVersion=^v(?<version>.+)$
ARG KUBERNETES_KUBESCAPE_VERSION=4.0.14
# renovate: datasource=github-tags depName=cvega/luarocks
ARG LUA_LUACHECK_VERSION=3.3.1

# renovate: datasource=npm depName=markdownlint-cli
ARG NPM_MARKDOWNLINT_CLI_VERSION=0.49.1
# renovate: datasource=npm depName=markdown-table-formatter
ARG NPM_MARKDOWN_TABLE_FORMATTER_VERSION=1.7.0
# renovate: datasource=pypi depName=rumdl
ARG PIP_RUMDL_VERSION=0.3.0
# renovate: datasource=github-tags depName=skaji/cpm
ARG PERL_PERLCRITIC_VERSION=v1.1.5

# renovate: datasource=packagist depName=squizlabs/php_codesniffer
ARG PHP_SQUIZLABS_PHP_CODESNIFFER_VERSION=4.0.4
# renovate: datasource=packagist depName=bartlett/sarif-php-converters
ARG PHP_BARTLETT_SARIF_PHP_CONVERTERS_VERSION=1.8.1
# renovate: datasource=packagist depName=phpstan/phpstan
ARG PHP_PHPSTAN_PHPSTAN_VERSION=2.3.1
# renovate: datasource=packagist depName=phpstan/extension-installer
ARG PHP_PHPSTAN_EXTENSION_INSTALLER_VERSION=1.4.3
# renovate: datasource=packagist depName=vimeo/psalm
ARG PHP_VIMEO_PSALM_VERSION=6.20.1
# renovate: datasource=packagist depName=overtrue/phplint
ARG PHP_OVERTRUE_PHPLINT_VERSION=9.7.3
# renovate: datasource=packagist depName=friendsofphp/php-cs-fixer
ARG PHP_FRIENDSOFPHP_PHP_CS_FIXER_VERSION=v3.95.27
# renovate: datasource=nuget depName=PSScriptAnalyzer registryUrl=https://www.powershellgallery.com/api/v2/
ARG PSSA_VERSION='1.25.0'

# renovate: datasource=pypi depName=pylint
ARG PIP_PYLINT_VERSION=4.1.3
# renovate: datasource=pypi depName=typing-extensions
ARG PIP_TYPING_EXTENSIONS_VERSION=4.16.0
# renovate: datasource=pypi depName=black
ARG PIP_BLACK_VERSION=26.10.1
# renovate: datasource=pypi depName=flake8
ARG PIP_FLAKE8_VERSION=7.4.1
# renovate: datasource=pypi depName=isort
ARG PIP_ISORT_VERSION=9.0.2
# renovate: datasource=pypi depName=bandit
ARG PIP_BANDIT_VERSION=1.9.4
# renovate: datasource=pypi depName=bandit_sarif_formatter
ARG PIP_BANDIT_SARIF_FORMATTER_VERSION=1.1.1
# renovate: datasource=pypi depName=mypy
ARG PIP_MYPY_VERSION=1.19.1
# renovate: datasource=pypi depName=nbqa
ARG PIP_NBQA_VERSION=1.9.1
# renovate: datasource=npm depName=pyright
ARG NPM_PYRIGHT_VERSION=1.1.414
# renovate: datasource=pypi depName=ruff
ARG PIP_RUFF_VERSION=0.17.1
# renovate: datasource=github-tags depName=nxadm/rakudo-pkg extractVersion=^v(?<version>.+)$
ARG RAKU_RAKU_VERSION=2026.09
ARG RAKU_RAKU_ALPINE_VERSION=3.23

# renovate: datasource=pypi depName=checkov
ARG PIP_CHECKOV_VERSION=3.3.29
# renovate: datasource=nuget depName=Microsoft.CST.DevSkim.CLI
ARG REPOSITORY_DEVSKIM_VERSION=1.0.70
# renovate: datasource=github-tags depName=anchore/grype
ARG REPOSITORY_GRYPE_VERSION=0.120.1
# renovate: datasource=github-releases depName=loeffel-io/ls-lint extractVersion=^v(?<version>.+)$
ARG REPOSITORY_LS_LINT_VERSION=2.3.2
# renovate: datasource=repology depName=alpine_3_24/osv-scanner versioning=loose
ARG REPOSITORY_OSV_SCANNER_VERSION=2.3.8-r3
# renovate: datasource=npm depName=secretlint
ARG NPM_SECRETLINT_VERSION=13.0.7
# renovate: datasource=npm depName=@secretlint/secretlint-rule-preset-recommend
ARG NPM_SECRETLINT_SECRETLINT_RULE_PRESET_RECOMMEND_VERSION=13.0.7
# renovate: datasource=npm depName=@secretlint/secretlint-formatter-sarif
ARG NPM_SECRETLINT_SECRETLINT_FORMATTER_SARIF_VERSION=13.0.7
# renovate: datasource=pypi depName=semgrep
ARG PIP_SEMGREP_VERSION=1.182.0
# renovate: datasource=github-tags depName=anchore/syft
ARG REPOSITORY_SYFT_VERSION=1.54.1
# renovate: datasource=github-tags depName=aquasecurity/trivy
ARG REPOSITORY_TRIVY_VERSION=0.76.1
ARG TRIVY_DB_REPOSITORY=mirror.gcr.io/aquasec/trivy-db:2,ghcr.io/aquasecurity/trivy-db:2,public.ecr.aws/aquasecurity/trivy-db:2
# renovate: datasource=github-tags depName=aquasecurity/trivy
ARG REPOSITORY_TRIVY_SBOM_VERSION=0.76.1
# renovate: datasource=github-tags depName=mongodb/kingfisher
ARG REPOSITORY_KINGFISHER_VERSION=2.14.0
# renovate: datasource=pypi depName=robotframework-robocop
ARG PIP_ROBOT_FRAMEWORK_ROBOCOP_VERSION=9.1.0
# renovate: datasource=pypi depName=Pygments
ARG PIP_PYGMENTS_VERSION=2.21.0
# renovate: datasource=pypi depName=restructuredtext_lint
ARG PIP_RESTRUCTUREDTEXT_LINT_VERSION=2.0.2
# renovate: datasource=pypi depName=rstcheck
ARG PIP_RSTCHECK_VERSION=6.3.0
# renovate: datasource=pypi depName=click
ARG PIP_RSTCHECK_CLICK_VERSION=8.5.0
# renovate: datasource=pypi depName=rstfmt
ARG PIP_RSTFMT_VERSION=0.0.14
# renovate: datasource=rubygems depName=rubocop
ARG GEM_RUBOCOP_VERSION=1.92.0
# renovate: datasource=rubygems depName=rubocop-github
ARG GEM_RUBOCOP_GITHUB_VERSION=0.29.0
# renovate: datasource=rubygems depName=rubocop-performance
ARG GEM_RUBOCOP_PERFORMANCE_VERSION=1.27.0
# renovate: datasource=rubygems depName=rubocop-rails
ARG GEM_RUBOCOP_RAILS_VERSION=2.38.0
# renovate: datasource=rubygems depName=rubocop-rake
ARG GEM_RUBOCOP_RAKE_VERSION=0.7.1
# renovate: datasource=rubygems depName=rubocop-rspec
ARG GEM_RUBOCOP_RSPEC_VERSION=3.10.2
# renovate: datasource=npm depName=@salesforce/plugin-code-analyzer
ARG SALESFORCE_CODE_ANALYZER_VERSION=5.16.0
# renovate: datasource=github-tags depName=scalacenter/scalafix
ARG SCALA_SCALAFIX_VERSION=0.14.9
# renovate: datasource=pypi depName=snakemake
ARG PIP_SNAKEMAKE_VERSION=9.27.0
# renovate: datasource=pypi depName=snakefmt
ARG PIP_SNAKEFMT_VERSION=2.1.0
# renovate: datasource=npm depName=cspell
ARG NPM_CSPELL_VERSION=10.4.0
# renovate: datasource=pypi depName=proselint
ARG PIP_PROSELINT_VERSION=0.16.0
# renovate: datasource=pypi depName=codespell
ARG PIP_CODESPELL_VERSION=2.4.3
# renovate: datasource=pypi depName=sqlfluff
ARG PIP_SQLFLUFF_VERSION=4.4.0
# renovate: datasource=github-releases depName=realm/SwiftLint
ARG SWIFT_SWIFTLINT_VERSION=0.65.1
# renovate: datasource=npm depName=@ibm/tekton-lint
ARG NPM_IBM_TEKTON_LINT_VERSION=1.2.4
# renovate: datasource=npm depName=prettyjson
ARG NPM_PRETTYJSON_VERSION=1.2.5
# renovate: datasource=npm depName=@typescript-eslint/eslint-plugin
ARG NPM_TYPESCRIPT_ESLINT_ESLINT_PLUGIN_VERSION=8.71.2
# renovate: datasource=npm depName=@typescript-eslint/parser
ARG NPM_TYPESCRIPT_ESLINT_PARSER_VERSION=8.71.2
# renovate: datasource=npm depName=typescript-eslint
ARG NPM_TYPESCRIPT_ESLINT_VERSION=8.71.2
# renovate: datasource=npm depName=ts-standard
ARG NPM_TS_STANDARD_VERSION=12.0.2
# renovate: datasource=pypi depName=yamllint
ARG PIP_YAMLLINT_VERSION=1.38.0
# renovate: datasource=pypi depName=pip
ARG PIP_PIP_VERSION=26.2.2
# renovate: datasource=pypi depName=virtualenv
ARG PIP_VIRTUALENV_VERSION=21.14.13
# renovate: datasource=github-tags depName=rust-lang/rust
ARG RUST_RUST_VERSION=1.99.1

ARG TARGETARCH
ARG CARGO_SARIF_FMT_VERSION
ARG ACTION_ACTIONLINT_VERSION
ARG BASH_SHELLCHECK_VERSION
ARG CARGO_ZIZMOR_VERSION
ARG CARGO_SHELLCHECK_SARIF_VERSION
ARG BASH_SHFMT_VERSION
ARG DOCKERFILE_HADOLINT_VERSION
ARG EDITORCONFIG_EDITORCONFIG_CHECKER_VERSION
ARG GO_REVIVE_VERSION
ARG GO_IMAGE_VERSION
ARG KUBERNETES_KUBECONFORM_VERSION
ARG CARGO_STYLUA_VERSION
ARG PROTOBUF_PROTOLINT_VERSION
ARG REPOSITORY_DUSTILOCK_VERSION
ARG REPOSITORY_BETTERLEAKS_VERSION
ARG REPOSITORY_TRUFFLEHOG_VERSION
ARG SPELL_VALE_VERSION
ARG SPELL_LYCHEE_VERSION
ARG TERRAFORM_TFLINT_VERSION
ARG TERRAFORM_TERRAGRUNT_VERSION
ARG TERRAFORM_TOFU_FMT_VERSION
#ARG__END

####################
# Run APK installs #
####################

WORKDIR /
COPY --from=uv /uv /uvx /bin/

#############################################################################################
## @generated by .automation/build.py using descriptor files, please do not update manually ##
#############################################################################################
#APK__START
RUN apk -U --no-cache upgrade \
    && apk add --no-cache \
                bash \
                ca-certificates \
                curl \
                gcompat \
                git \
                git-lfs \
                libgcc \
                libstdc++ \
                openssh \
                su-exec \
                icu-libs \
                openjdk21 \
                lua5.3 \
                perl \
                gnupg \
                php84 \
                php84-phar \
                php84-mbstring \
                php84-xmlwriter \
                php84-tokenizer \
                php84-ctype \
                php84-curl \
                php84-dom \
                php84-opcache \
                php84-openssl \
                php84-common \
                php84-simplexml \
                php84-iconv \
                dpkg \
                gcc \
                musl-dev \
                coreutils \
                py3-pyflakes \
                npm \
                nodejs-current \
                cppcheck \
                cmd:clang-format \
                helm \
                openssl \
                libcurl \
                libxml2 \
                libxml2-utils \
                R \
                re2 \
                unzip \
                yarn \
                ruby \
                ruby-bundler \
    && git config --global core.autocrlf true
#APK__END

# PATH for golang & python
ENV GOROOT=/usr/lib/go \
    GOPATH=/go
    # PYTHONPYCACHEPREFIX="$HOME/.cache/cpython/" NV: not working for all packages :/
# hadolint ignore=DL3044
ENV PATH="$PATH":"$GOROOT"/bin:"$GOPATH"/bin
RUN mkdir -p ${GOPATH}/src ${GOPATH}/bin || true && \
    # Ignore npm package issues
    yarn config set ignore-engines true || true

##############################
# Installs rust dependencies #
#############################################################################################
## @generated by .automation/build.py using descriptor files, please do not update manually ##
#############################################################################################

#CARGO__START
RUN export RUSTUP_HOME=/usr/local/rustup CARGO_HOME=/usr/local/cargo \
    && curl https://sh.rustup.rs -sSf | sh -s -- -y --profile minimal --default-toolchain ${RUST_RUST_VERSION} --no-modify-path \
    && export PATH="${CARGO_HOME}/bin:${PATH}" \
    && rustup default stable \
    && rustup component add clippy \
    && for bin in "${CARGO_HOME}"/bin/*; do \
         ln -sf "$bin" /usr/local/bin/"$(basename "$bin")"; \
       done \
    && rm -rf "${CARGO_HOME}/registry" "${CARGO_HOME}/git" /root/.cache/sccache
ENV RUSTUP_HOME=/usr/local/rustup
ENV CARGO_HOME=/usr/local/cargo
ENV PATH="/usr/local/cargo/bin:${PATH}"
#CARGO__END

##############################
# COPY instructions #
#############################################################################################
## @generated by .automation/build.py using descriptor files, please do not update manually ##
#############################################################################################

#COPY__START
COPY --link --from=cargo-bin-sarif-fmt /out/bin/sarif-fmt /usr/bin/sarif-fmt
COPY --link --from=composer/composer:2-bin /composer /usr/bin/composer
COPY --link --from=actionlint /usr/local/bin/actionlint /usr/bin/actionlint
# shellcheck is a dependency for actionlint
COPY --link --from=shellcheck /bin/shellcheck /usr/bin/shellcheck
COPY --link --from=cargo-bin-zizmor /out/bin/zizmor /usr/bin/zizmor
COPY --link --from=cargo-bin-shellcheck-sarif /out/bin/shellcheck-sarif /usr/bin/shellcheck-sarif
# Next COPY line commented because already managed by another linter
# COPY --link --from=shellcheck /bin/shellcheck /usr/bin/shellcheck
COPY --link --from=shfmt /bin/shfmt /usr/bin/
COPY --link --from=hadolint /bin/hadolint /usr/bin/hadolint
COPY --link --from=editorconfig-checker /usr/bin/editorconfig-checker /usr/bin/editorconfig-checker
COPY --link --from=revive /usr/bin/revive /usr/bin/revive
COPY --link --from=kubeconform /kubeconform /usr/bin/
COPY --link --from=chktex /usr/bin/chktex /usr/bin/
COPY --link --from=cargo-bin-stylua /out/bin/stylua /usr/bin/stylua
COPY --link --from=protolint /usr/local/bin/protolint /usr/bin/
COPY --link --from=dustilock /usr/bin/dustilock /usr/bin/dustilock
COPY --link --from=betterleaks /usr/bin/betterleaks /usr/bin/
COPY --link --from=trufflehog /usr/bin/trufflehog /usr/bin/
COPY --link --from=vale /bin/vale /bin/vale
COPY --link --from=lychee /usr/local/bin/lychee /usr/bin/
COPY --link --from=tflint /usr/local/bin/tflint /usr/bin/
COPY --link --from=terragrunt /usr/local/bin/terragrunt /usr/bin/
COPY --link --from=terragrunt /bin/terraform /usr/bin/
COPY --link --from=opentofu /usr/local/bin/tofu /usr/bin/
# Next COPY line commented because already managed by another linter
# COPY --link --from=opentofu /usr/local/bin/tofu /usr/bin/
#COPY__END

##############################
# Installs ruby dependencies #
#############################################################################################
## @generated by .automation/build.py using descriptor files, please do not update manually ##
#############################################################################################

#GEM__START
RUN apk add --no-cache --virtual .ml-build-deps gcc libffi-dev make musl-dev ruby-dev build-base re2-dev py3-pybind11-dev && \
    echo 'gem: --no-document' >> ~/.gemrc && \
    gem install \
          rubocop:${GEM_RUBOCOP_VERSION} \
          rubocop-github:${GEM_RUBOCOP_GITHUB_VERSION} \
          rubocop-performance:${GEM_RUBOCOP_PERFORMANCE_VERSION} \
          rubocop-rails:${GEM_RUBOCOP_RAILS_VERSION} \
          rubocop-rake:${GEM_RUBOCOP_RAKE_VERSION} \
          rubocop-rspec:${GEM_RUBOCOP_RSPEC_VERSION} \
    && apk del .ml-build-deps
#GEM__END

################################
# Installs python dependencies #
#############################################################################################
## @generated by .automation/build.py using descriptor files, please do not update manually ##
#############################################################################################

#PIPVENV__START
RUN apk add --no-cache --virtual .ml-build-deps gcc libffi-dev make musl-dev ruby-dev build-base re2-dev py3-pybind11-dev && \
    export UV_LINK_MODE=hardlink \
    && uv pip install --system --no-cache pip==${PIP_PIP_VERSION} virtualenv==${PIP_VIRTUALENV_VERSION} \
    && uv venv --seed --no-project --no-managed-python "/venvs/ansible-lint" \
    && VIRTUAL_ENV="/venvs/ansible-lint" uv pip install ansible-lint==${PIP_ANSIBLE_LINT_VERSION} \
    && VIRTUAL_ENV="/venvs/ansible-lint" uv pip install --upgrade "wheel>=0.46.2" "setuptools>=75.8.0" \
    && VIRTUAL_ENV="/venvs/ansible-lint" rm -rf /venvs/ansible-lint/lib/python3.13/site-packages/setuptools/_vendor/wheel* \
    && uv venv --seed --no-project --no-managed-python "/venvs/cpplint" \
    && VIRTUAL_ENV="/venvs/cpplint" uv pip install cpplint==${PIP_CPPLINT_VERSION} \
    && VIRTUAL_ENV="/venvs/cpplint" uv pip install --upgrade "wheel>=0.46.2" "setuptools>=75.8.0" \
    && VIRTUAL_ENV="/venvs/cpplint" rm -rf /venvs/cpplint/lib/python3.13/site-packages/setuptools/_vendor/wheel* \
    && uv venv --seed --no-project --no-managed-python "/venvs/cfn-lint" \
    && VIRTUAL_ENV="/venvs/cfn-lint" uv pip install cfn-lint[sarif]==${PIP_CFN_LINT_VERSION} \
    && VIRTUAL_ENV="/venvs/cfn-lint" uv pip install --upgrade "wheel>=0.46.2" "setuptools>=75.8.0" \
    && VIRTUAL_ENV="/venvs/cfn-lint" rm -rf /venvs/cfn-lint/lib/python3.13/site-packages/setuptools/_vendor/wheel* \
    && uv venv --seed --no-project --no-managed-python "/venvs/djlint" \
    && VIRTUAL_ENV="/venvs/djlint" uv pip install djlint==${PIP_DJLINT_VERSION} \
    && VIRTUAL_ENV="/venvs/djlint" uv pip install --upgrade "wheel>=0.46.2" "setuptools>=75.8.0" \
    && VIRTUAL_ENV="/venvs/djlint" rm -rf /venvs/djlint/lib/python3.13/site-packages/setuptools/_vendor/wheel* \
    && uv venv --seed --no-project --no-managed-python "/venvs/rumdl" \
    && VIRTUAL_ENV="/venvs/rumdl" uv pip install rumdl==${PIP_RUMDL_VERSION} \
    && VIRTUAL_ENV="/venvs/rumdl" uv pip install --upgrade "wheel>=0.46.2" "setuptools>=75.8.0" \
    && VIRTUAL_ENV="/venvs/rumdl" rm -rf /venvs/rumdl/lib/python3.13/site-packages/setuptools/_vendor/wheel* \
    && uv venv --seed --no-project --no-managed-python "/venvs/pylint" \
    && VIRTUAL_ENV="/venvs/pylint" uv pip install pylint==${PIP_PYLINT_VERSION} typing-extensions==${PIP_TYPING_EXTENSIONS_VERSION} \
    && VIRTUAL_ENV="/venvs/pylint" uv pip install --upgrade "wheel>=0.46.2" "setuptools>=75.8.0" \
    && VIRTUAL_ENV="/venvs/pylint" rm -rf /venvs/pylint/lib/python3.13/site-packages/setuptools/_vendor/wheel* \
    && uv venv --seed --no-project --no-managed-python "/venvs/black" \
    && VIRTUAL_ENV="/venvs/black" uv pip install black[jupyter]==${PIP_BLACK_VERSION} \
    && VIRTUAL_ENV="/venvs/black" uv pip install --upgrade "wheel>=0.46.2" "setuptools>=75.8.0" \
    && VIRTUAL_ENV="/venvs/black" rm -rf /venvs/black/lib/python3.13/site-packages/setuptools/_vendor/wheel* \
    && uv venv --seed --no-project --no-managed-python "/venvs/flake8" \
    && VIRTUAL_ENV="/venvs/flake8" uv pip install flake8==${PIP_FLAKE8_VERSION} \
    && VIRTUAL_ENV="/venvs/flake8" uv pip install --upgrade "wheel>=0.46.2" "setuptools>=75.8.0" \
    && VIRTUAL_ENV="/venvs/flake8" rm -rf /venvs/flake8/lib/python3.13/site-packages/setuptools/_vendor/wheel* \
    && uv venv --seed --no-project --no-managed-python "/venvs/isort" \
    && VIRTUAL_ENV="/venvs/isort" uv pip install black==${PIP_BLACK_VERSION} isort==${PIP_ISORT_VERSION} \
    && VIRTUAL_ENV="/venvs/isort" uv pip install --upgrade "wheel>=0.46.2" "setuptools>=75.8.0" \
    && VIRTUAL_ENV="/venvs/isort" rm -rf /venvs/isort/lib/python3.13/site-packages/setuptools/_vendor/wheel* \
    && uv venv --seed --no-project --no-managed-python "/venvs/bandit" \
    && VIRTUAL_ENV="/venvs/bandit" uv pip install bandit==${PIP_BANDIT_VERSION} bandit_sarif_formatter==${PIP_BANDIT_SARIF_FORMATTER_VERSION} bandit[toml]==${PIP_BANDIT_VERSION} \
    && VIRTUAL_ENV="/venvs/bandit" uv pip install --upgrade "wheel>=0.46.2" "setuptools>=75.8.0" \
    && VIRTUAL_ENV="/venvs/bandit" rm -rf /venvs/bandit/lib/python3.13/site-packages/setuptools/_vendor/wheel* \
    && uv venv --seed --no-project --no-managed-python "/venvs/mypy" \
    && VIRTUAL_ENV="/venvs/mypy" uv pip install mypy==${PIP_MYPY_VERSION} \
    && VIRTUAL_ENV="/venvs/mypy" uv pip install --upgrade "wheel>=0.46.2" "setuptools>=75.8.0" \
    && VIRTUAL_ENV="/venvs/mypy" rm -rf /venvs/mypy/lib/python3.13/site-packages/setuptools/_vendor/wheel* \
    && uv venv --seed --no-project --no-managed-python "/venvs/nbqa" \
    && VIRTUAL_ENV="/venvs/nbqa" uv pip install nbqa==${PIP_NBQA_VERSION} mypy==${PIP_MYPY_VERSION} \
    && VIRTUAL_ENV="/venvs/nbqa" uv pip install --upgrade "wheel>=0.46.2" "setuptools>=75.8.0" \
    && VIRTUAL_ENV="/venvs/nbqa" rm -rf /venvs/nbqa/lib/python3.13/site-packages/setuptools/_vendor/wheel* \
    && uv venv --seed --no-project --no-managed-python "/venvs/ruff" \
    && VIRTUAL_ENV="/venvs/ruff" uv pip install ruff==${PIP_RUFF_VERSION} \
    && VIRTUAL_ENV="/venvs/ruff" uv pip install --upgrade "wheel>=0.46.2" "setuptools>=75.8.0" \
    && VIRTUAL_ENV="/venvs/ruff" rm -rf /venvs/ruff/lib/python3.13/site-packages/setuptools/_vendor/wheel* \
    && uv venv --seed --no-project --no-managed-python "/venvs/ruff-format" \
    && VIRTUAL_ENV="/venvs/ruff-format" uv pip install ruff==${PIP_RUFF_VERSION} \
    && VIRTUAL_ENV="/venvs/ruff-format" uv pip install --upgrade "wheel>=0.46.2" "setuptools>=75.8.0" \
    && VIRTUAL_ENV="/venvs/ruff-format" rm -rf /venvs/ruff-format/lib/python3.13/site-packages/setuptools/_vendor/wheel* \
    && uv venv --seed --no-project --no-managed-python "/venvs/checkov" \
    && VIRTUAL_ENV="/venvs/checkov" uv pip install checkov==${PIP_CHECKOV_VERSION} \
    && VIRTUAL_ENV="/venvs/checkov" uv pip install --upgrade "wheel>=0.46.2" "setuptools>=75.8.0" \
    && VIRTUAL_ENV="/venvs/checkov" rm -rf /venvs/checkov/lib/python3.13/site-packages/setuptools/_vendor/wheel* \
    && uv venv --seed --no-project --no-managed-python "/venvs/semgrep" \
    && VIRTUAL_ENV="/venvs/semgrep" uv pip install semgrep==${PIP_SEMGREP_VERSION} \
    && VIRTUAL_ENV="/venvs/semgrep" uv pip install --upgrade "wheel>=0.46.2" "setuptools>=75.8.0" \
    && VIRTUAL_ENV="/venvs/semgrep" rm -rf /venvs/semgrep/lib/python3.13/site-packages/setuptools/_vendor/wheel* \
    && uv venv --seed --no-project --no-managed-python "/venvs/robocop" \
    && VIRTUAL_ENV="/venvs/robocop" uv pip install robotframework-robocop==${PIP_ROBOT_FRAMEWORK_ROBOCOP_VERSION} \
    && VIRTUAL_ENV="/venvs/robocop" uv pip install --upgrade "wheel>=0.46.2" "setuptools>=75.8.0" \
    && VIRTUAL_ENV="/venvs/robocop" rm -rf /venvs/robocop/lib/python3.13/site-packages/setuptools/_vendor/wheel* \
    && uv venv --seed --no-project --no-managed-python "/venvs/rst-lint" \
    && VIRTUAL_ENV="/venvs/rst-lint" uv pip install Pygments==${PIP_PYGMENTS_VERSION} restructuredtext_lint==${PIP_RESTRUCTUREDTEXT_LINT_VERSION} \
    && VIRTUAL_ENV="/venvs/rst-lint" uv pip install --upgrade "wheel>=0.46.2" "setuptools>=75.8.0" \
    && VIRTUAL_ENV="/venvs/rst-lint" rm -rf /venvs/rst-lint/lib/python3.13/site-packages/setuptools/_vendor/wheel* \
    && uv venv --seed --no-project --no-managed-python "/venvs/rstcheck" \
    && VIRTUAL_ENV="/venvs/rstcheck" uv pip install click==${PIP_RSTCHECK_CLICK_VERSION} rstcheck[toml,sphinx]==${PIP_RSTCHECK_VERSION} \
    && VIRTUAL_ENV="/venvs/rstcheck" uv pip install --upgrade "wheel>=0.46.2" "setuptools>=75.8.0" \
    && VIRTUAL_ENV="/venvs/rstcheck" rm -rf /venvs/rstcheck/lib/python3.13/site-packages/setuptools/_vendor/wheel* \
    && uv venv --seed --no-project --no-managed-python "/venvs/rstfmt" \
    && VIRTUAL_ENV="/venvs/rstfmt" uv pip install rstfmt==${PIP_RSTFMT_VERSION} \
    && VIRTUAL_ENV="/venvs/rstfmt" uv pip install --upgrade "wheel>=0.46.2" "setuptools>=75.8.0" \
    && VIRTUAL_ENV="/venvs/rstfmt" rm -rf /venvs/rstfmt/lib/python3.13/site-packages/setuptools/_vendor/wheel* \
    && uv venv --seed --no-project --no-managed-python "/venvs/snakemake" \
    && VIRTUAL_ENV="/venvs/snakemake" uv pip install snakemake==${PIP_SNAKEMAKE_VERSION} \
    && VIRTUAL_ENV="/venvs/snakemake" uv pip install --upgrade "wheel>=0.46.2" "setuptools>=75.8.0" \
    && VIRTUAL_ENV="/venvs/snakemake" rm -rf /venvs/snakemake/lib/python3.13/site-packages/setuptools/_vendor/wheel* \
    && uv venv --seed --no-project --no-managed-python "/venvs/snakefmt" \
    && VIRTUAL_ENV="/venvs/snakefmt" uv pip install snakefmt==${PIP_SNAKEFMT_VERSION} \
    && VIRTUAL_ENV="/venvs/snakefmt" uv pip install --upgrade "wheel>=0.46.2" "setuptools>=75.8.0" \
    && VIRTUAL_ENV="/venvs/snakefmt" rm -rf /venvs/snakefmt/lib/python3.13/site-packages/setuptools/_vendor/wheel* \
    && uv venv --seed --no-project --no-managed-python "/venvs/proselint" \
    && VIRTUAL_ENV="/venvs/proselint" uv pip install proselint==${PIP_PROSELINT_VERSION} \
    && VIRTUAL_ENV="/venvs/proselint" uv pip install --upgrade "wheel>=0.46.2" "setuptools>=75.8.0" \
    && VIRTUAL_ENV="/venvs/proselint" rm -rf /venvs/proselint/lib/python3.13/site-packages/setuptools/_vendor/wheel* \
    && uv venv --seed --no-project --no-managed-python "/venvs/codespell" \
    && VIRTUAL_ENV="/venvs/codespell" uv pip install codespell==${PIP_CODESPELL_VERSION} \
    && VIRTUAL_ENV="/venvs/codespell" uv pip install --upgrade "wheel>=0.46.2" "setuptools>=75.8.0" \
    && VIRTUAL_ENV="/venvs/codespell" rm -rf /venvs/codespell/lib/python3.13/site-packages/setuptools/_vendor/wheel* \
    && uv venv --seed --no-project --no-managed-python "/venvs/sqlfluff" \
    && VIRTUAL_ENV="/venvs/sqlfluff" uv pip install sqlfluff==${PIP_SQLFLUFF_VERSION} \
    && VIRTUAL_ENV="/venvs/sqlfluff" uv pip install --upgrade "wheel>=0.46.2" "setuptools>=75.8.0" \
    && VIRTUAL_ENV="/venvs/sqlfluff" rm -rf /venvs/sqlfluff/lib/python3.13/site-packages/setuptools/_vendor/wheel* \
    && uv venv --seed --no-project --no-managed-python "/venvs/yamllint" \
    && VIRTUAL_ENV="/venvs/yamllint" uv pip install yamllint==${PIP_YAMLLINT_VERSION} \
    && VIRTUAL_ENV="/venvs/yamllint" uv pip install --upgrade "wheel>=0.46.2" "setuptools>=75.8.0" \
    && VIRTUAL_ENV="/venvs/yamllint" rm -rf /venvs/yamllint/lib/python3.13/site-packages/setuptools/_vendor/wheel* \
    && find /venvs \( -type f \( -iname \*.pyc -o -iname \*.pyo \) -o -type d -iname __pycache__ \) -delete \
    && rm -rf /root/.cache \
    && apk del .ml-build-deps
ENV PATH="${PATH}":/venvs/ansible-lint/bin:/venvs/cpplint/bin:/venvs/cfn-lint/bin:/venvs/djlint/bin:/venvs/rumdl/bin:/venvs/pylint/bin:/venvs/black/bin:/venvs/flake8/bin:/venvs/isort/bin:/venvs/bandit/bin:/venvs/mypy/bin:/venvs/nbqa/bin:/venvs/ruff/bin:/venvs/ruff-format/bin:/venvs/checkov/bin:/venvs/semgrep/bin:/venvs/robocop/bin:/venvs/rst-lint/bin:/venvs/rstcheck/bin:/venvs/rstfmt/bin:/venvs/snakemake/bin:/venvs/snakefmt/bin:/venvs/proselint/bin:/venvs/codespell/bin:/venvs/sqlfluff/bin:/venvs/yamllint/bin
#PIPVENV__END

############################
# Install NPM dependencies #
#############################################################################################
## @generated by .automation/build.py using descriptor files, please do not update manually ##
#############################################################################################

ENV NODE_OPTIONS="--max-old-space-size=8192" \
    NODE_ENV=production
#NPM__START
WORKDIR /node-deps
RUN npm config set prefix /usr/local \
    && npm --no-cache install --ignore-scripts --omit=dev \
                @salesforce/cli@${NPM_SALESFORCE_CLI_VERSION} \
                typescript@${NPM_TYPESCRIPT_VERSION} \
                jscpd@${NPM_JSCPD_VERSION} \
                stylelint@${NPM_STYLELINT_VERSION} \
                stylelint-config-standard@${NPM_STYLELINT_CONFIG_STANDARD_VERSION} \
                stylelint-config-sass-guidelines@${NPM_STYLELINT_CONFIG_SASS_GUIDELINES_VERSION} \
                stylelint-scss@${NPM_STYLELINT_SCSS_VERSION} \
                @biomejs/biome@${NPM_BIOMEJS_BIOME_VERSION} \
                gherkin-lint@${NPM_GHERKIN_LINT_VERSION} \
                npm-groovy-lint@${NPM_GROOVY_LINT_VERSION} \
                htmlhint@${NPM_HTMLHINT_VERSION} \
                eslint@${NPM_ESLINT_VERSION} \
                @eslint/js@${NPM_ESLINT_JS_VERSION} \
                eslint-config-prettier@${NPM_ESLINT_CONFIG_PRETTIER_VERSION} \
                eslint-plugin-import-x@${NPM_ESLINT_PLUGIN_IMPORT_X_VERSION} \
                eslint-plugin-jest@${NPM_ESLINT_PLUGIN_JEST_VERSION} \
                eslint-plugin-n@${NPM_ESLINT_PLUGIN_N_VERSION} \
                eslint-plugin-prettier@${NPM_ESLINT_PLUGIN_PRETTIER_VERSION} \
                eslint-plugin-promise@${NPM_ESLINT_PLUGIN_PROMISE_VERSION} \
                eslint-plugin-vue@${NPM_ESLINT_PLUGIN_VUE_VERSION} \
                @microsoft/eslint-formatter-sarif@${NPM_MICROSOFT_ESLINT_FORMATTER_SARIF_VERSION} \
                standard@${NPM_STANDARD_VERSION} \
                prettier@${NPM_PRETTIER_VERSION} \
                @prantlf/jsonlint@${NPM_PRANTLF_JSONLINT_VERSION} \
                v8r@${NPM_V8R_VERSION} \
                npm-package-json-lint@${NPM_PACKAGE_JSON_LINT_VERSION} \
                npm-package-json-lint-config-default@${NPM_PACKAGE_JSON_LINT_CONFIG_DEFAULT_VERSION} \
                @eslint-react/eslint-plugin@${NPM_ESLINT_REACT_ESLINT_PLUGIN_VERSION} \
                markdownlint-cli@${NPM_MARKDOWNLINT_CLI_VERSION} \
                markdown-table-formatter@${NPM_MARKDOWN_TABLE_FORMATTER_VERSION} \
                pyright@${NPM_PYRIGHT_VERSION} \
                secretlint@${NPM_SECRETLINT_VERSION} \
                @secretlint/secretlint-rule-preset-recommend@${NPM_SECRETLINT_SECRETLINT_RULE_PRESET_RECOMMEND_VERSION} \
                @secretlint/secretlint-formatter-sarif@${NPM_SECRETLINT_SECRETLINT_FORMATTER_SARIF_VERSION} \
                cspell@${NPM_CSPELL_VERSION} \
                @ibm/tekton-lint@${NPM_IBM_TEKTON_LINT_VERSION} \
                prettyjson@${NPM_PRETTYJSON_VERSION} \
                @typescript-eslint/eslint-plugin@${NPM_TYPESCRIPT_ESLINT_ESLINT_PLUGIN_VERSION} \
                @typescript-eslint/parser@${NPM_TYPESCRIPT_ESLINT_PARSER_VERSION} \
                typescript-eslint@${NPM_TYPESCRIPT_ESLINT_VERSION} \
                ts-standard@${NPM_TS_STANDARD_VERSION} && \
    echo "Cleaning npm cache…" \
    && (npm cache clean --force || true) \
    && echo "Changing owner of node_modules files…" \
    && chown -R "$(id -u)":"$(id -g)" node_modules # fix for https://github.com/npm/cli/issues/5900 \
    && echo "Removing extra node_module files…" \
    && find . \( -not -path "/proc" \) -and \( -type f \( -iname "*.d.ts" -o -iname "*.map" -o -iname "*.npmignore" -o -iname "*.travis.yml" -o -iname "*.md" -o -iname "*.markdown" -o -iname ".package-lock.json" -o -iname "package-lock.json" \) \) -delete \
    && echo "Removing test and doc directories from node_modules…" \
    && find ./node_modules -type d \( -iname "__tests__" -o -iname "test" -o -iname "tests" -o -iname "docs" -o -iname ".github" \) -prune -exec rm -rf {} + \
    && rm -rf /root/.npm
WORKDIR /

#NPM__END

# Add node packages to path #
ENV PATH="/node-deps/node_modules/.bin:${PATH}" \
    NODE_PATH="/node-deps/node_modules"

#############################################################################################
## @generated by .automation/build.py using descriptor files, please do not update manually ##
#############################################################################################
#OTHER__START
# ARM installation
RUN case ${TARGETPLATFORM} in \
  "linux/amd64")  POWERSHELL_ARCH=musl-x64 ;; \
  "linux/arm64")  POWERSHELL_ARCH=arm64    ;; \
esac \
    && curl -L https://github.com/PowerShell/PowerShell/releases/download/v${POWERSHELL_VERSION}/powershell-${POWERSHELL_VERSION}-linux-${POWERSHELL_ARCH}.tar.gz -o /tmp/powershell.tar.gz \
    && mkdir -p /opt/microsoft/powershell/7 \
    && tar zxf /tmp/powershell.tar.gz -C /opt/microsoft/powershell/7 \
    && chmod +x /opt/microsoft/powershell/7/pwsh \
    && ln -s /opt/microsoft/powershell/7/pwsh /usr/bin/pwsh \
# CSHARP installation
    && apk add --no-cache dotnet10-sdk && install -d /usr/local/dotnet-tools
ENV PATH="${PATH}:/usr/local/dotnet-tools"
# DART installation
ENV LANG=C.UTF-8
RUN ALPINE_GLIBC_BASE_URL="https://github.com/sgerrand/alpine-pkg-glibc/releases/download" && \
    ALPINE_GLIBC_BASE_PACKAGE_FILENAME="glibc-$ALPINE_GLIBC_PACKAGE_VERSION.apk" && \
    ALPINE_GLIBC_BIN_PACKAGE_FILENAME="glibc-bin-$ALPINE_GLIBC_PACKAGE_VERSION.apk" && \
    ALPINE_GLIBC_I18N_PACKAGE_FILENAME="glibc-i18n-$ALPINE_GLIBC_PACKAGE_VERSION.apk" && \
    apk add --no-cache --virtual=.build-dependencies wget ca-certificates && \
    echo \
        "-----BEGIN PUBLIC KEY-----\
        MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEApZ2u1KJKUu/fW4A25y9m\
        y70AGEa/J3Wi5ibNVGNn1gT1r0VfgeWd0pUybS4UmcHdiNzxJPgoWQhV2SSW1JYu\
        tOqKZF5QSN6X937PTUpNBjUvLtTQ1ve1fp39uf/lEXPpFpOPL88LKnDBgbh7wkCp\
        m2KzLVGChf83MS0ShL6G9EQIAUxLm99VpgRjwqTQ/KfzGtpke1wqws4au0Ab4qPY\
        KXvMLSPLUp7cfulWvhmZSegr5AdhNw5KNizPqCJT8ZrGvgHypXyiFvvAH5YRtSsc\
        Zvo9GI2e2MaZyo9/lvb+LbLEJZKEQckqRj4P26gmASrZEPStwc+yqy1ShHLA0j6m\
        1QIDAQAB\
        -----END PUBLIC KEY-----" | sed 's/   */\n/g' > "/etc/apk/keys/sgerrand.rsa.pub" && \
    wget --quiet --tries=10 --waitretry=10 \
        "$ALPINE_GLIBC_BASE_URL/$ALPINE_GLIBC_PACKAGE_VERSION/$ALPINE_GLIBC_BASE_PACKAGE_FILENAME" \
        "$ALPINE_GLIBC_BASE_URL/$ALPINE_GLIBC_PACKAGE_VERSION/$ALPINE_GLIBC_BIN_PACKAGE_FILENAME" \
        "$ALPINE_GLIBC_BASE_URL/$ALPINE_GLIBC_PACKAGE_VERSION/$ALPINE_GLIBC_I18N_PACKAGE_FILENAME" && \
    mv /etc/nsswitch.conf /etc/nsswitch.conf.bak && \
    apk add --no-cache --force-overwrite \
        "$ALPINE_GLIBC_BASE_PACKAGE_FILENAME" \
        "$ALPINE_GLIBC_BIN_PACKAGE_FILENAME" \
        "$ALPINE_GLIBC_I18N_PACKAGE_FILENAME" && \
    \
    mv /etc/nsswitch.conf.bak /etc/nsswitch.conf && \
    rm "/etc/apk/keys/sgerrand.rsa.pub" && \
    (/usr/glibc-compat/bin/localedef --force --inputfile POSIX --charmap UTF-8 "$LANG" || true) && \
    echo "export LANG=$LANG" > /etc/profile.d/locale.sh && \
    \
    apk del glibc-i18n && \
    \
    rm "/root/.wget-hsts" && \
    apk del .build-dependencies && \
    rm \
        "$ALPINE_GLIBC_BASE_PACKAGE_FILENAME" \
        "$ALPINE_GLIBC_BIN_PACKAGE_FILENAME" \
        "$ALPINE_GLIBC_I18N_PACKAGE_FILENAME" \
# GO installation
    && apk add --no-cache \
    go=${GO_ALPINE_VERSION}
# JAVA installation
ENV JAVA_HOME=/usr/lib/jvm/java-21-openjdk
ENV PATH="$JAVA_HOME/bin:${PATH}"
# KOTLIN installation
# Next line commented because already managed by another linter
# ENV JAVA_HOME=/usr/lib/jvm/java-21-openjdk
# Next line commented because already managed by another linter
# ENV PATH="$JAVA_HOME/bin:${PATH}"
# PHP installation
RUN update-alternatives --install /usr/bin/php php /usr/bin/php84 110
# Managed with COPY --link --from=composer/composer:2-bin /composer /usr/bin/composer
ENV COMPOSER_HOME=/usr/local/composer
ENV PATH="/usr/local/composer/vendor/bin:${PATH}"
# POWERSHELL installation
# Next line commented because already managed by another linter
# RUN case ${TARGETPLATFORM} in \
#   "linux/amd64")  POWERSHELL_ARCH=musl-x64 ;; \
#   "linux/arm64")  POWERSHELL_ARCH=arm64    ;; \
# esac \
#     && curl -L https://github.com/PowerShell/PowerShell/releases/download/v${POWERSHELL_VERSION}/powershell-${POWERSHELL_VERSION}-linux-${POWERSHELL_ARCH}.tar.gz -o /tmp/powershell.tar.gz \
#     && mkdir -p /opt/microsoft/powershell/7 \
#     && tar zxf /tmp/powershell.tar.gz -C /opt/microsoft/powershell/7 \
#     && chmod +x /opt/microsoft/powershell/7/pwsh \
#     && ln -s /opt/microsoft/powershell/7/pwsh /usr/bin/pwsh
# SALESFORCE installation
# Next line commented because already managed by another linter
# ENV JAVA_HOME=/usr/lib/jvm/java-21-openjdk
# Next line commented because already managed by another linter
# ENV PATH="$JAVA_HOME/bin:${PATH}"
ENV XDG_DATA_HOME=/usr/local/share
RUN sf plugins install @salesforce/plugin-packaging@${NPM_SALESFORCE_PLUGIN_PACKAGING_VERSION} \
    && echo y|sf plugins install sfdx-hardis@${SFDX_HARDIS_VERSION} \
    && (npm cache clean --force || true) \
    && rm -rf /root/.npm/_cacache
ENV SF_AUTOUPDATE_DISABLE=true SF_CLI_DISABLE_AUTOUPDATE=true
# SCALA installation
# Next line commented because already managed by another linter
# ENV JAVA_HOME=/usr/lib/jvm/java-21-openjdk
# Next line commented because already managed by another linter
# ENV PATH="$JAVA_HOME/bin:${PATH}"
RUN curl --retry-all-errors --retry 10 -fLo coursier https://github.com/coursier/coursier/releases/download/v${SCALA_COURSIER_VERSION}/coursier.jar && \
        chmod +x coursier \
# TYPESCRIPT installation
# VBDOTNET installation
# Next line commented because already managed by another linter
# RUN apk add --no-cache dotnet10-sdk && install -d /usr/local/dotnet-tools
# Next line commented because already managed by another linter
# ENV PATH="${PATH}:/usr/local/dotnet-tools"
# actionlint installation
# Managed with COPY --link --from=actionlint /usr/local/bin/actionlint /usr/bin/actionlint
#              # shellcheck is a dependency for actionlint
# Managed with COPY --link --from=shellcheck /bin/shellcheck /usr/bin/shellcheck
# zizmor installation
# Managed with COPY --link --from=cargo-bin-zizmor /out/bin/zizmor /usr/bin/zizmor
# ansible-lint installation
# spectral installation
    && npm --no-cache install --ignore-scripts --omit=dev --prefix /node-deps-spectral @stoplight/spectral-cli@${NPM_SPECTRAL_CLI_VERSION} \
    && ln -s /node-deps-spectral/node_modules/.bin/spectral /usr/bin/spectral \
    && (npm cache clean --force || true) \
    && find /node-deps-spectral/node_modules -type f \( -iname "*.d.ts" -o -iname "*.map" -o -iname "*.md" -o -iname "*.markdown" \) -delete \
    && find /node-deps-spectral/node_modules -type d \( -iname "__tests__" -o -iname "test" -o -iname "tests" -o -iname "docs" -o -iname ".github" \) -prune -exec rm -rf {} + \
    && rm -rf /root/.npm
# arm-ttk installation
ENV ARM_TTK_PSD1="${ARM_TTK_DIRECTORY}/arm-ttk/arm-ttk/arm-ttk.psd1"
RUN curl --retry 5 --retry-delay 5 -sLO "https://github.com/Azure/arm-ttk/releases/download/${ARM_TTK_VERSION}/${ARM_TTK_NAME}" \
    && unzip "${ARM_TTK_NAME}" -d "${ARM_TTK_DIRECTORY}" \
    && rm "${ARM_TTK_NAME}" \
    && ln -sTf "${ARM_TTK_PSD1}" /usr/bin/arm-ttk \
    && chmod a+x /usr/bin/arm-ttk \
# bash-exec installation
    && printf '#!/bin/bash \n\nif [[ -x "$1" ]]; then exit 0; else echo "Error: File:[$1] is not executable"; exit 1; fi' > /usr/bin/bash-exec \
    && chmod +x /usr/bin/bash-exec \
# shellcheck installation
# Managed with COPY --link --from=cargo-bin-shellcheck-sarif /out/bin/shellcheck-sarif /usr/bin/shellcheck-sarif
# Managed with # Next COPY line commented because already managed by another linter
#              # COPY --link --from=shellcheck /bin/shellcheck /usr/bin/shellcheck
# shfmt installation
# Managed with COPY --link --from=shfmt /bin/shfmt /usr/bin/
# bicep_linter installation
    && case ${TARGETPLATFORM} in \
  "linux/amd64")  BICEP_ARCH=musl-x64 ;; \
  "linux/arm64")  BICEP_ARCH=arm64    ;; \
esac \
&& curl --retry 5 --retry-delay 5 -sLo ${BICEP_EXE} "https://github.com/Azure/bicep/releases/download/v${BICEP_VERSION}/bicep-linux-${BICEP_ARCH}" \
&& chmod +x "${BICEP_EXE}" \
&& mv "${BICEP_EXE}" "${BICEP_DIR}" \
# cpplint installation
# clj-kondo installation
    && curl --retry 5 --retry-delay 5 -sLO https://raw.githubusercontent.com/clj-kondo/clj-kondo/refs/tags/v${CLJ_KONDO_VERSION}/script/install-clj-kondo \
    && chmod +x install-clj-kondo \
    && ./install-clj-kondo --version "$CLJ_KONDO_VERSION" \
# cljstyle installation
    && curl --retry 5 --retry-delay 5 -sLO https://raw.githubusercontent.com/greglook/cljstyle/main/util/install-cljstyle \
    && chmod +x install-cljstyle \
    && ./install-cljstyle --static --version "$CLJ_STYLE_VERSION" \
# cfn-lint installation
# jscpd installation
# cpplint installation
# csharpier installation
    && dotnet tool install --allow-roll-forward --tool-path /usr/local/dotnet-tools csharpier --version "${CSHARP_CSHARPIER_VERSION}" \
# roslynator installation
    && dotnet tool install --allow-roll-forward --tool-path /usr/local/dotnet-tools roslynator.dotnet.cli --version "${CSHARP_ROSLYNATOR_VERSION}" \
# stylelint installation
# biome installation
# dartanalyzer installation
    && case ${TARGETPLATFORM} in \
  "linux/amd64")  DART_ARCH=x64   ;; \
  "linux/arm64")  DART_ARCH=arm64 ;; \
esac \
    && DART_URL="https://storage.googleapis.com/dart-archive/channels/stable/release/${DART_VERSION}/sdk/dartsdk-linux-${DART_ARCH}-release.zip" \
    && for attempt in 1 2 3 4 5; do \
         echo "Downloading Dart SDK (attempt ${attempt}/5)" \
         && wget --tries=5 -T 60 -q -O /tmp/dart-sdk.zip "${DART_URL}" \
         && unzip -tq /tmp/dart-sdk.zip > /dev/null 2>&1 \
         && break; \
         echo "Dart SDK download/verify failed (attempt ${attempt}/5), retrying in 15s" \
         && rm -f /tmp/dart-sdk.zip \
         && sleep 15; \
       done \
    && unzip -q /tmp/dart-sdk.zip -d /tmp \
    && mkdir -p /usr/lib/dart \
    && mv /tmp/dart-sdk/* /usr/lib/dart/ \
    && chmod +x /usr/lib/dart/bin/dart \
    && chmod +x /usr/lib/dart/bin/dartaotruntime \
    && rm -rf /tmp/dart-sdk /tmp/dart-sdk.zip

ENV PATH="/usr/lib/dart/bin:${PATH}"
# hadolint installation
# Managed with COPY --link --from=hadolint /bin/hadolint /usr/bin/hadolint
# editorconfig-checker installation
# Managed with COPY --link --from=editorconfig-checker /usr/bin/editorconfig-checker /usr/bin/editorconfig-checker
# dotenv-linter installation
RUN set -eu; \
    case "$TARGETPLATFORM" in \
      linux/amd64) ARCH=x86_64 ;; \
      linux/arm64) ARCH=aarch64 ;; \
      *) echo "unsupported platform: $TARGETPLATFORM" >&2; exit 1 ;; \
    esac; \
    curl --retry 5 --retry-delay 5 -fsSL \
      "https://github.com/dotenv-linter/dotenv-linter/releases/download/v${DOTENV_LINTER_VERSION}/dotenv-linter-alpine-${ARCH}.tar.gz" \
      | tar -xz -C /usr/local/bin \
# gherkin-lint installation
# golangci-lint installation
    && wget -O- -nv https://golangci-lint.run/install.sh | sh -s "v${GO_GOLANGCI_LINT_VERSION}" \
    && golangci-lint --version \
# revive installation
# Managed with COPY --link --from=revive /usr/bin/revive /usr/bin/revive
# biome installation
# npm-groovy-lint installation
# Next line commented because already managed by another linter
# ENV JAVA_HOME=/usr/lib/jvm/java-21-openjdk
# Next line commented because already managed by another linter
# ENV PATH="$JAVA_HOME/bin:${PATH}"
# djlint installation
# htmlhint installation
# checkstyle installation
    && curl --retry 5 --retry-delay 5 -sSL \
    "https://github.com/checkstyle/checkstyle/releases/download/checkstyle-${JAVA_CHECKSTYLE_VERSION}/checkstyle-${JAVA_CHECKSTYLE_VERSION}-all.jar" \
    --output /usr/bin/checkstyle \
# pmd installation
    && wget --quiet https://github.com/pmd/pmd/releases/download/pmd_releases%2F${PMD_VERSION}/pmd-dist-${PMD_VERSION}-bin.zip && \
    unzip pmd-dist-${PMD_VERSION}-bin.zip || echo "Error unzipping" && \
    rm pmd-dist-${PMD_VERSION}-bin.zip || echo "Error rm" && \
    mv pmd-bin-${PMD_VERSION} /usr/bin/pmd || echo "Error mv" && \
    chmod +x /usr/bin/pmd/bin/pmd || echo "Error chmod" \
# eslint installation
# standard installation
# prettier installation
# biome installation
# jsonlint installation
# v8r installation
# prettier installation
# npm-package-json-lint installation
# biome installation
# eslint installation
# biome installation
# ktlint installation
    && curl --retry 5 --retry-delay 5 -sSLO https://github.com/pinterest/ktlint/releases/download/${KTLINT_VERSION}/ktlint && \
    chmod a+x ktlint && \
    mv "ktlint" /usr/bin/ \
# detekt installation
    && curl --retry 5 --retry-delay 5 -sSLO https://github.com/detekt/detekt/releases/download/v${DETEKT_VERSION}/detekt-cli-${DETEKT_VERSION}.zip && \
    unzip detekt-cli-${DETEKT_VERSION}.zip && \
    chmod a+x detekt-cli-${DETEKT_VERSION}/bin/* && \
    chmod a+x detekt-cli-${DETEKT_VERSION}/lib/* && \
    mv -n detekt-cli-${DETEKT_VERSION}/bin/* usr/bin && \
    mv -n detekt-cli-${DETEKT_VERSION}/lib/* usr/lib \
# kubeconform installation
# Managed with COPY --link --from=kubeconform /kubeconform /usr/bin/
# kubescape installation
    && set -eu; \
    case "$TARGETPLATFORM" in \
      linux/amd64) ARCH=amd64 ;; \
      linux/arm64) ARCH=arm64 ;; \
      *) echo "unsupported platform: $TARGETPLATFORM" >&2; exit 1 ;; \
    esac; \
    curl --retry 5 --retry-delay 5 -fsSL -o /tmp/kubescape.apk \
      "https://github.com/kubescape/kubescape/releases/download/v${KUBERNETES_KUBESCAPE_VERSION}/kubescape_${KUBERNETES_KUBESCAPE_VERSION}_linux_${ARCH}.apk" && \
    apk add --no-cache --allow-untrusted /tmp/kubescape.apk && \
    rm /tmp/kubescape.apk \
# chktex installation
# Managed with COPY --link --from=chktex /usr/bin/chktex /usr/bin/
    && cd ~ && touch .chktexrc && cd /
# luacheck installation
# luarocks compiles native rocks during installation: the toolchain is
# only needed within this RUN and evicted from the final layers
RUN apk add --no-cache --virtual .lua-build-deps gcc make musl-dev lua5.3-dev readline-dev \
    && wget --tries=5 https://github.com/cvega/luarocks/archive/v${LUA_LUACHECK_VERSION}-super-linter.tar.gz -O - -q | tar -xzf - \
    && cd luarocks-${LUA_LUACHECK_VERSION}-super-linter \
    && ./configure --with-lua-include=/usr/include/lua5.3 \
    && make \
    && make -b install \
    && cd .. && rm -r luarocks-${LUA_LUACHECK_VERSION}-super-linter/ \
    && luarocks install luacheck \
    && cd / \
    && apk del .lua-build-deps

# stylua installation
# Managed with COPY --link --from=cargo-bin-stylua /out/bin/stylua /usr/bin/stylua
# markdownlint installation
# markdown-table-formatter installation
# rumdl installation
# perlcritic installation
# cpm compiles XS modules during installation: the toolchain is only
# needed within this RUN and evicted from the final layers
RUN apk add --no-cache --virtual .perl-build-deps gcc make musl-dev perl-dev \
    && curl -fsSL https://raw.githubusercontent.com/skaji/cpm/refs/tags/${PERL_PERLCRITIC_VERSION}/cpm | perl - install -g --show-build-log-on-failure --without-build --without-test --without-runtime Perl::Critic \
    && rm -rf /root/.perl-cpm \
    && apk del .perl-build-deps

# phpcs installation
RUN --mount=type=secret,id=GITHUB_TOKEN GITHUB_AUTH_TOKEN="$(cat /run/secrets/GITHUB_TOKEN)" && export GITHUB_AUTH_TOKEN && composer global require squizlabs/php_codesniffer:${PHP_SQUIZLABS_PHP_CODESNIFFER_VERSION} bartlett/sarif-php-converters:${PHP_BARTLETT_SARIF_PHP_CONVERTERS_VERSION}

# phpstan installation
RUN --mount=type=secret,id=GITHUB_TOKEN GITHUB_AUTH_TOKEN="$(cat /run/secrets/GITHUB_TOKEN)" && export GITHUB_AUTH_TOKEN && composer config --global allow-plugins.phpstan/extension-installer true && composer global require phpstan/phpstan:${PHP_PHPSTAN_PHPSTAN_VERSION} phpstan/extension-installer:${PHP_PHPSTAN_EXTENSION_INSTALLER_VERSION} bartlett/sarif-php-converters:${PHP_BARTLETT_SARIF_PHP_CONVERTERS_VERSION}
# psalm installation
RUN --mount=type=secret,id=GITHUB_TOKEN GITHUB_AUTH_TOKEN="$(cat /run/secrets/GITHUB_TOKEN)" && export GITHUB_AUTH_TOKEN && composer global require vimeo/psalm:${PHP_VIMEO_PSALM_VERSION}

# phplint installation
RUN --mount=type=secret,id=GITHUB_TOKEN GITHUB_AUTH_TOKEN="$(cat /run/secrets/GITHUB_TOKEN)" && export GITHUB_AUTH_TOKEN && composer global require overtrue/phplint:${PHP_OVERTRUE_PHPLINT_VERSION} bartlett/sarif-php-converters:${PHP_BARTLETT_SARIF_PHP_CONVERTERS_VERSION}

# php-cs-fixer installation
RUN --mount=type=secret,id=GITHUB_TOKEN GITHUB_AUTH_TOKEN="$(cat /run/secrets/GITHUB_TOKEN)" && export GITHUB_AUTH_TOKEN && composer global require friendsofphp/php-cs-fixer:${PHP_FRIENDSOFPHP_PHP_CS_FIXER_VERSION} --with-all-dependencies

# powershell installation
RUN pwsh -c 'Install-Module -Name PSScriptAnalyzer -RequiredVersion ${PSSA_VERSION} -Scope AllUsers -Force -ErrorAction Stop'
# powershell_formatter installation
# Next line commented because already managed by another linter
# RUN pwsh -c 'Install-Module -Name PSScriptAnalyzer -RequiredVersion ${PSSA_VERSION} -Scope AllUsers -Force -ErrorAction Stop'
# protolint installation
# Managed with COPY --link --from=protolint /usr/local/bin/protolint /usr/bin/
# pylint installation
# black installation
# flake8 installation
# isort installation
# bandit installation
# mypy installation
ENV MYPY_CACHE_DIR=/tmp
# nbqa installation
# Next line commented because already managed by another linter
# ENV MYPY_CACHE_DIR=/tmp
# pyright installation
# ruff installation
# ruff-format installation
# lintr installation
# R packages are compiled from source during installation: the
# toolchain and -dev headers are only needed within this RUN and
# evicted from the final layers
RUN apk add --no-cache --virtual .r-build-deps gcc g++ make musl-dev linux-headers libffi-dev libxml2-dev R-dev \
    && mkdir -p /home/r-library \
    && cp -r /usr/lib/R/library/ /home/r-library/ \
    && Rscript -e "install.packages(c('lintr','purrr','jsonlite'), repos = 'https://cloud.r-project.org/')" \
    && R -e "install.packages(list.dirs('/home/r-library',recursive = FALSE), repos = NULL, type = 'source')" \
    && apk del .r-build-deps

# raku installation
RUN case ${TARGETPLATFORM} in \
  "linux/amd64")  RAKU_RAKU_ARCH=x86_64  ;; \
  "linux/arm64")  RAKU_RAKU_ARCH=aarch64 ;; \
esac \
    && curl -L "https://github.com/nxadm/rakudo-pkg/releases/download/v${RAKU_RAKU_VERSION}/rakudo-pkg-Alpine${RAKU_RAKU_ALPINE_VERSION}_${RAKU_RAKU_VERSION}-01_${RAKU_RAKU_ARCH}.apk" > "rakudo-pkg-Alpine${RAKU_RAKU_ALPINE_VERSION}_${RAKU_RAKU_VERSION}-01_${RAKU_RAKU_ARCH}.apk" \
    && apk add --no-cache --allow-untrusted "rakudo-pkg-Alpine${RAKU_RAKU_ALPINE_VERSION}_${RAKU_RAKU_VERSION}-01_${RAKU_RAKU_ARCH}.apk" \
    && rm "rakudo-pkg-Alpine${RAKU_RAKU_ALPINE_VERSION}_${RAKU_RAKU_VERSION}-01_${RAKU_RAKU_ARCH}.apk"

ENV PATH="~/.raku/bin:/opt/rakudo-pkg/bin:/opt/rakudo-pkg/share/perl6/site/bin:$PATH"
# checkov installation
# devskim installation
# Next line commented because already managed by another linter
# RUN apk add --no-cache dotnet10-sdk && install -d /usr/local/dotnet-tools
# Next line commented because already managed by another linter
# ENV PATH="${PATH}:/usr/local/dotnet-tools"
RUN dotnet tool install --allow-roll-forward --tool-path /usr/local/dotnet-tools Microsoft.CST.DevSkim.CLI --version ${REPOSITORY_DEVSKIM_VERSION} \
# dustilock installation
# Managed with COPY --link --from=dustilock /usr/bin/dustilock /usr/bin/dustilock
# betterleaks installation
# Managed with COPY --link --from=betterleaks /usr/bin/betterleaks /usr/bin/
# grype installation
    && curl -sSfL https://raw.githubusercontent.com/anchore/grype/refs/tags/v${REPOSITORY_GRYPE_VERSION}/install.sh | sh -s -- -b /usr/local/bin \
# ls-lint installation
    && set -eu; \
    case "$TARGETPLATFORM" in \
      linux/amd64) ARCH=amd64 ;; \
      linux/arm64) ARCH=arm64 ;; \
      *) echo "unsupported platform: $TARGETPLATFORM" >&2; exit 1 ;; \
    esac; \
    curl --retry 5 --retry-delay 5 -fsSL -o /usr/bin/ls-lint \
      "https://github.com/loeffel-io/ls-lint/releases/download/v${REPOSITORY_LS_LINT_VERSION}/ls-lint-linux-${ARCH}" && \
    chmod +x /usr/bin/ls-lint \
# osv-scanner installation
    && apk add --no-cache \
    osv-scanner=${REPOSITORY_OSV_SCANNER_VERSION}
# secretlint installation
# semgrep installation
# Wrap semgrep so its OCaml 5 runtime does not abort with
# "Failed to allocate signal stack for domain 0", which happens when the
# stack rlimit is unlimited (the case on some CI runners). Cap it to a
# finite value only when unlimited, leaving an already-bounded limit untouched.
RUN mv /venvs/semgrep/bin/semgrep /venvs/semgrep/bin/semgrep-bin \
    && printf '#!/bin/sh\ncase "$(ulimit -s)" in unlimited) ulimit -s 65536 ;; esac\nexec /venvs/semgrep/bin/semgrep-bin "$@"\n' > /venvs/semgrep/bin/semgrep \
    && chmod +x /venvs/semgrep/bin/semgrep
# syft installation
RUN curl -sSfL https://raw.githubusercontent.com/anchore/syft/refs/tags/v${REPOSITORY_SYFT_VERSION}/install.sh | sh -s -- -b /usr/local/bin \
# trivy installation
    && wget --tries=5 -q -O - https://raw.githubusercontent.com/aquasecurity/trivy/main/contrib/install.sh | sh -s -- -b /usr/local/bin "v${REPOSITORY_TRIVY_VERSION}" \
    && for attempt in 1 2 3 4 5; do \
         for db_repository in $(echo "${TRIVY_DB_REPOSITORY}" | tr ',' ' '); do \
           trivy image --download-db-only --no-progress --db-repository "${db_repository}" && break 2; \
         done; \
         [ "${attempt}" -eq 5 ] || sleep $((attempt * 10)); \
       done \
    && test -f "${HOME}/.cache/trivy/db/trivy.db" \
# trivy-sbom installation
    && wget --tries=5 -q -O - https://raw.githubusercontent.com/aquasecurity/trivy/main/contrib/install.sh | sh -s -- -b /usr/local/bin "v${REPOSITORY_TRIVY_SBOM_VERSION}" \
    && for attempt in 1 2 3 4 5; do \
         for db_repository in $(echo "${TRIVY_DB_REPOSITORY}" | tr ',' ' '); do \
           trivy image --download-db-only --no-progress --db-repository "${db_repository}" && break 2; \
         done; \
         [ "${attempt}" -eq 5 ] || sleep $((attempt * 10)); \
       done \
    && test -f "${HOME}/.cache/trivy/db/trivy.db" \
# trufflehog installation
# Managed with COPY --link --from=trufflehog /usr/bin/trufflehog /usr/bin/
# kingfisher installation
    && curl --silent --location https://raw.githubusercontent.com/mongodb/kingfisher/main/scripts/install-kingfisher.sh | bash -s -- /usr/local/bin --tag "v${REPOSITORY_KINGFISHER_VERSION}" \
# robocop installation
# rst-lint installation
# rstcheck installation
# rstfmt installation
# rubocop installation
# code-analyzer-apex installation
    && sf plugins install code-analyzer@${SALESFORCE_CODE_ANALYZER_VERSION} \
    && (npm cache clean --force || true) \
    && rm -rf /root/.npm/_cacache \
# code-analyzer-apexguru installation
# Next line commented because already managed by another linter
# RUN sf plugins install code-analyzer@${SALESFORCE_CODE_ANALYZER_VERSION} \
#     && (npm cache clean --force || true) \
#     && rm -rf /root/.npm/_cacache
# code-analyzer-aura installation
# Next line commented because already managed by another linter
# RUN sf plugins install code-analyzer@${SALESFORCE_CODE_ANALYZER_VERSION} \
#     && (npm cache clean --force || true) \
#     && rm -rf /root/.npm/_cacache
# code-analyzer-lwc installation
# Next line commented because already managed by another linter
# RUN sf plugins install code-analyzer@${SALESFORCE_CODE_ANALYZER_VERSION} \
#     && (npm cache clean --force || true) \
#     && rm -rf /root/.npm/_cacache
# code-analyzer-flow installation
# Next line commented because already managed by another linter
# RUN sf plugins install code-analyzer@${SALESFORCE_CODE_ANALYZER_VERSION} \
#     && (npm cache clean --force || true) \
#     && rm -rf /root/.npm/_cacache
# scalafix installation
    && ./coursier install scalafix:${SCALA_SCALAFIX_VERSION} --quiet --install-dir /usr/bin && rm -rf /root/.cache \
# snakemake installation
# snakefmt installation
# cspell installation
# proselint installation
# vale installation
# Managed with COPY --link --from=vale /bin/vale /bin/vale
# lychee installation
# Managed with COPY --link --from=lychee /usr/local/bin/lychee /usr/bin/
# codespell installation
# sqlfluff installation
# swiftlint installation
    && case "${TARGETARCH}" in \
      amd64) SWIFTLINT_ARCH=amd64 ;; \
      arm64) SWIFTLINT_ARCH=arm64 ;; \
      *) echo "Unsupported architecture: ${TARGETARCH}" && exit 1 ;; \
    esac && \
    curl -fsSL -o /tmp/swiftlint.zip \
      "https://github.com/realm/SwiftLint/releases/download/${SWIFT_SWIFTLINT_VERSION}/swiftlint_linux_${SWIFTLINT_ARCH}.zip" && \
    unzip -o /tmp/swiftlint.zip -d /tmp/swiftlint && \
    install -m 0755 /tmp/swiftlint/swiftlint-static /usr/bin/swiftlint && \
    rm -rf /tmp/swiftlint /tmp/swiftlint.zip
# tekton-lint installation
# tflint installation
# Managed with COPY --link --from=tflint /usr/local/bin/tflint /usr/bin/
# terragrunt installation
# Managed with COPY --link --from=terragrunt /usr/local/bin/terragrunt /usr/bin/
# terraform-fmt installation
# Managed with COPY --link --from=terragrunt /bin/terraform /usr/bin/
# tofu-fmt installation
# Managed with COPY --link --from=opentofu /usr/local/bin/tofu /usr/bin/
# tofu-validate installation
# Managed with # Next COPY line commented because already managed by another linter
#              # COPY --link --from=opentofu /usr/local/bin/tofu /usr/bin/
# eslint installation
# biome installation
# eslint installation
# ts-standard installation
# prettier installation
# biome installation
# prettier installation
# yamllint installation
# v8r installation
#OTHER__END

################################
# Installs python dependencies #
################################
COPY --from=build-ml-core pyproject.toml README.md ./
COPY --from=build-ml-core megalinter /megalinter/
#PIP_PROJECT__START
RUN --mount=type=cache,target=/root/.cache/uv,from=build-ml-core \
    --mount=from=uv,source=/uv,target=/bin/uv \
    uv pip install --system -e ".[llm]"
#PIP_PROJECT__END

#######################################
# Copy scripts and rules to container #
#######################################
COPY megalinter/descriptors /megalinter-descriptors
# Linter versions collected at build time, so runtime does not need to spawn
# one "--version" process per linter (see VERSION_GET_AT_RUNTIME variable)
COPY .automation/generated/linter-versions.json /megalinter-descriptors/linter-versions.json
COPY TEMPLATES /action/lib/.automation

# Copy server scripts
COPY server /server

###########################
# Get the build arguments #
###########################
ARG BUILD_DATE
ARG BUILD_REVISION
ARG BUILD_VERSION

#################################################
# Set ENV values used for debugging the version #
#################################################
ENV BUILD_DATE=$BUILD_DATE \
    BUILD_REVISION=$BUILD_REVISION \
    BUILD_VERSION=$BUILD_VERSION

#FLAVOR__START
ENV MEGALINTER_FLAVOR=all
#FLAVOR__END

#########################################
# Label the instance and set maintainer #
#########################################
LABEL com.github.actions.name="MegaLinter" \
      com.github.actions.description="The ultimate linters aggregator to make sure your projects are clean" \
      com.github.actions.icon="code" \
      com.github.actions.color="red" \
      maintainer="Nicolas Vuillamy <nicolas.vuillamy@gmail.com>" \
      org.opencontainers.image.created=$BUILD_DATE \
      org.opencontainers.image.revision=$BUILD_REVISION \
      org.opencontainers.image.version=$BUILD_VERSION \
      org.opencontainers.image.authors="Nicolas Vuillamy <nicolas.vuillamy@gmail.com>" \
      org.opencontainers.image.url="https://megalinter.io" \
      org.opencontainers.image.source="https://github.com/oxsecurity/megalinter" \
      org.opencontainers.image.documentation="https://megalinter.io" \
      org.opencontainers.image.vendor="Nicolas Vuillamy" \
      org.opencontainers.image.description="Lint your code base with GitHub Actions"

#EXTRA_DOCKERFILE_LINES__START
COPY entrypoint.sh /entrypoint.sh
COPY sh/setup-runtime-user.sh /usr/bin/setup-runtime-user.sh
RUN chmod +x entrypoint.sh && \
    chmod u+x /usr/bin/setup-runtime-user.sh
ENTRYPOINT ["/bin/bash", "/entrypoint.sh"]
#EXTRA_DOCKERFILE_LINES__END