FROM node:24-alpine@sha256:44fce696f38ba8c987c4db89954051000bbd05ffd8d8659ba15ed4a8602e937f

# Default to the latest Claude Code. Pinning a fixed version is the wrong
# default here: old releases eventually stop working against the API, so a
# stale pin silently rots the agent pipelines. Override only to dodge a known
# broken release, e.g.  --build-arg CLAUDE_CODE_VERSION=2.1.217
ARG CLAUDE_CODE_VERSION=latest

RUN apk add --no-cache \
      bash \
      ca-certificates \
      curl \
      git \
      jq \
      openssh-client \
      openssl \
      python3 \
      py3-yaml

# Install Claude Code, then make the resulting layer byte-stable so that a
# rebuild of the SAME version DEDUPS in the Gitea registry instead of orphaning
# a fresh ~260 MB copy on every build (#351, follow-up from #336). npm picks the
# musl-linked native binary automatically on this alpine base.
#
# Two sources of per-build churn are eliminated inside this one layer:
#   1. the npm cache under /root/.npm — its index/log files carry build-time
#      content and timestamps, and it never belongs in the image anyway.
#   2. install-time mtimes on every installed file and on the directories this
#      RUN modified — normalized to a fixed date. Without this the tar bytes
#      (and thus the layer digest) differ each build even when the version is
#      unchanged, defeating registry dedup.
# Content itself is deterministic per version: the registry tarballs are
# immutable, so same version in -> same bytes out once timestamps are pinned.
RUN npm install -g @anthropic-ai/claude-code@${CLAUDE_CODE_VERSION} \
 && claude --version \
 && npm cache clean --force \
 && rm -rf /root/.npm /tmp/* \
 && find /usr/local/lib/node_modules/@anthropic-ai -exec touch -h -t 202001010000.00 {} + \
 && touch -h -t 202001010000.00 \
      /usr/local/bin/claude \
      /usr/local/lib/node_modules/@anthropic-ai \
      /usr/local/lib/node_modules \
      /usr/local/lib \
      /usr/local/bin \
      /usr/local \
      /usr \
      /root \
      /tmp
