Dockerfile

# syntax=docker/dockerfile:1
# MEGALINTER FLAVOR [cupcake]: MegaLinter for the most commonly used languages
###########################################
###########################################
## Dockerfile to run MegaLinter ##
###########################################
###########################################

# @not-generated

#############################################################################################
## @generated by .automation/build.py using descriptor files, please do not update manually ##
#############################################################################################
#ARGTOP__START
# renovate: datasource=docker depName=rhysd/actionlint
ARG ACTION_ACTIONLINT_VERSION=1.7.7
# renovate: datasource=docker depName=koalaman/shellcheck
ARG BASH_SHELLCHECK_VERSION=v0.10.0
# renovate: datasource=docker depName=mvdan/shfmt
ARG BASH_SHFMT_VERSION=v3.12.0-alpine
# renovate: datasource=docker depName=hadolint/hadolint
ARG DOCKERFILE_HADOLINT_VERSION=v2.12.0-alpine
# renovate: datasource=docker depName=mstruebing/editorconfig-checker
ARG EDITORCONFIG_EDITORCONFIG_CHECKER_VERSION=v3.3.0
# renovate: datasource=github-tags depName=mgechev/revive
ARG GO_REVIVE_VERSION=v1.11.0
# renovate: datasource=docker depName=ghcr.io/yannh/kubeconform
ARG KUBERNETES_KUBECONFORM_VERSION=v0.7.0-alpine
# renovate: datasource=docker depName=zricethezav/gitleaks
ARG REPOSITORY_GITLEAKS_VERSION=v8.27.2
# renovate: datasource=docker depName=checkmarx/kics
ARG REPOSITORY_KICS_VERSION=v2.1.11-alpine
# renovate: datasource=docker depName=trufflesecurity/trufflehog
ARG REPOSITORY_TRUFFLEHOG_VERSION=3.90.0
# renovate: datasource=docker depName=lycheeverse/lychee
ARG SPELL_LYCHEE_VERSION=sha-7c4b132-alpine
# renovate: datasource=docker depName=ghcr.io/terraform-linters/tflint
ARG TERRAFORM_TFLINT_VERSION=0.58.1
# renovate: datasource=docker depName=tenable/terrascan
ARG TERRAFORM_TERRASCAN_VERSION=1.19.9
# renovate: datasource=docker depName=alpine/terragrunt
ARG TERRAFORM_TERRAGRUNT_VERSION=1.12.2
#ARGTOP__END

#############################################################################################
## @generated by .automation/build.py using descriptor files, please do not update manually ##
#############################################################################################
#FROM__START
FROM rhysd/actionlint:${ACTION_ACTIONLINT_VERSION} AS actionlint
# shellcheck is a dependency for actionlint
FROM koalaman/shellcheck:${BASH_SHELLCHECK_VERSION} AS shellcheck
# Next FROM line commented because already managed by another linter
# FROM koalaman/shellcheck:${BASH_SHELLCHECK_VERSION} AS shellcheck
FROM mvdan/shfmt:${BASH_SHFMT_VERSION} AS shfmt
FROM hadolint/hadolint:${DOCKERFILE_HADOLINT_VERSION} AS hadolint
FROM mstruebing/editorconfig-checker:${EDITORCONFIG_EDITORCONFIG_CHECKER_VERSION} AS editorconfig-checker
FROM golang:1-alpine AS revive
## The golang image used as a builder is a temporary workaround (https://github.com/mgechev/revive/issues/787)
## for the released revive binaries not returning version numbers (devel).
## The install command should then be what is commented in the go.megalinter-descriptor.yml
ARG GO_REVIVE_VERSION
RUN GOBIN=/usr/bin go install github.com/mgechev/revive@$GO_REVIVE_VERSION
FROM ghcr.io/yannh/kubeconform:${KUBERNETES_KUBECONFORM_VERSION} AS kubeconform
FROM zricethezav/gitleaks:${REPOSITORY_GITLEAKS_VERSION} AS gitleaks
FROM checkmarx/kics:${REPOSITORY_KICS_VERSION} AS kics
FROM trufflesecurity/trufflehog:${REPOSITORY_TRUFFLEHOG_VERSION} AS trufflehog
FROM lycheeverse/lychee:${SPELL_LYCHEE_VERSION} AS lychee
FROM ghcr.io/terraform-linters/tflint:v${TERRAFORM_TFLINT_VERSION} AS tflint
FROM tenable/terrascan:${TERRAFORM_TERRASCAN_VERSION} AS terrascan
FROM alpine/terragrunt:${TERRAFORM_TERRAGRUNT_VERSION} AS terragrunt
# Next FROM line commented because already managed by another linter
# FROM alpine/terragrunt:${TERRAFORM_TERRAGRUNT_VERSION} AS terragrunt
#FROM__END

##################
# Build wheel for megalinter python package
##################
FROM ghcr.io/astral-sh/uv:0.7.22 AS uv
FROM python:3.13-alpine3.21 AS build-ml-core
WORKDIR /
COPY --from=uv /uv /uvx /bin/
# Install dependencies
RUN --mount=type=cache,target=/root/.cache/uv \
    --mount=type=bind,source=uv.lock,target=uv.lock \
    --mount=type=bind,source=pyproject.toml,target=pyproject.toml \
    uv sync --frozen --no-install-project
# Copy the project into the image
COPY . .
# Sync the project
RUN --mount=type=cache,target=/root/.cache/uv \
    uv sync --frozen

##################
# Get base image #
##################
FROM python:3.13-alpine3.21

#############################################################################################
## @generated by .automation/build.py using descriptor files, please do not update manually ##
#############################################################################################
#ARG__START
# renovate: datasource=crate depName=sarif-fmt
ARG CARGO_SARIF_FMT_VERSION=0.8.0
# renovate: datasource=github-tags depName=sgerrand/alpine-pkg-glibc
ARG ALPINE_GLIBC_PACKAGE_VERSION=2.34-r0
# renovate: datasource=npm depName=typescript
ARG NPM_TYPESCRIPT_VERSION=5.8.3
# renovate: datasource=pypi depName=ansible-lint
ARG PIP_ANSIBLE_LINT_VERSION=25.6.1
# renovate: datasource=crate depName=shellcheck-sarif
ARG CARGO_SHELLCHECK_SARIF_VERSION=0.8.0
# renovate: datasource=pypi depName=cpplint
ARG PIP_CPPLINT_VERSION=2.0.2
# renovate: datasource=github-tags depName=clj-kondo/clj-kondo
ARG CLJ_KONDO_VERSION=2025.01.16

# renovate: datasource=github-tags depName=greglook/cljstyle
ARG CLJ_STYLE_VERSION=0.17.642
# renovate: datasource=pypi depName=cfn-lint
ARG PIP_CFN_LINT_VERSION=1.38.0
# renovate: datasource=npm depName=jscpd
ARG NPM_JSCPD_VERSION=4.0.5
# renovate: datasource=npm depName=stylelint
ARG NPM_STYLELINT_VERSION=16.22.0
# renovate: datasource=npm depName=stylelint-config-standard
ARG NPM_STYLELINT_CONFIG_STANDARD_VERSION=38.0.0
# renovate: datasource=npm depName=stylelint-config-sass-guidelines
ARG NPM_STYLELINT_CONFIG_SASS_GUIDELINES_VERSION=12.1.0
# renovate: datasource=npm depName=stylelint-scss
ARG NPM_STYLELINT_SCSS_VERSION=6.12.1
# renovate: datasource=github-tags depName=golangci/golangci-lint
ARG GO_GOLANGCI_LINT_VERSION=2.2.2
# renovate: datasource=npm depName=graphql
ARG NPM_GRAPHQL_VERSION=16.11.0
# renovate: datasource=npm depName=graphql-schema-linter
ARG NPM_GRAPHQL_SCHEMA_LINTER_VERSION=3.0.1
# renovate: datasource=npm depName=npm-groovy-lint
ARG NPM_GROOVY_LINT_VERSION=15.2.0
# renovate: datasource=pypi depName=djlint
ARG PIP_DJLINT_VERSION=1.36.4
# renovate: datasource=npm depName=htmlhint
ARG NPM_HTMLHINT_VERSION=1.6.3
# renovate: datasource=github-tags depName=pmd/pmd extractVersion=^pmd_releases/(?<version>.*)$
ARG PMD_VERSION=7.15.0

# renovate: datasource=npm depName=eslint
ARG NPM_ESLINT_VERSION=8.57.1
# renovate: datasource=npm depName=eslint-config-airbnb
ARG NPM_ESLINT_CONFIG_AIRBNB_VERSION=19.0.4
# renovate: datasource=npm depName=eslint-config-prettier
ARG NPM_ESLINT_CONFIG_PRETTIER_VERSION=10.1.5
# renovate: datasource=npm depName=eslint-config-standard
ARG NPM_ESLINT_CONFIG_STANDARD_VERSION=17.1.0
# renovate: datasource=npm depName=eslint-plugin-import
ARG NPM_ESLINT_PLUGIN_IMPORT_VERSION=2.32.0
# renovate: datasource=npm depName=eslint-plugin-jest
ARG NPM_ESLINT_PLUGIN_JEST_VERSION=29.0.1
# renovate: datasource=npm depName=eslint-plugin-n
ARG NPM_ESLINT_PLUGIN_N_VERSION=16.6.2
# renovate: datasource=npm depName=eslint-plugin-prettier
ARG NPM_ESLINT_PLUGIN_PRETTIER_VERSION=5.5.1
# renovate: datasource=npm depName=eslint-plugin-promise
ARG NPM_ESLINT_PLUGIN_PROMISE_VERSION=6.6.0
# renovate: datasource=npm depName=eslint-plugin-vue
ARG NPM_ESLINT_PLUGIN_VUE_VERSION=10.3.0
# renovate: datasource=npm depName=@babel/core
ARG NPM_BABEL_CORE_VERSION=7.28.0
# renovate: datasource=npm depName=@babel/eslint-parser
ARG NPM_BABEL_ESLINT_PARSER_VERSION=7.28.0
# renovate: datasource=npm depName=@microsoft/eslint-formatter-sarif
ARG NPM_MICROSOFT_ESLINT_FORMATTER_SARIF_VERSION=3.1.0
# renovate: datasource=npm depName=standard
ARG NPM_STANDARD_VERSION=17.1.2
# renovate: datasource=npm depName=prettier
ARG NPM_PRETTIER_VERSION=3.6.2
# renovate: datasource=npm depName=@prantlf/jsonlint
ARG NPM_PRANTLF_JSONLINT_VERSION=16.0.0
# renovate: datasource=npm depName=v8r
ARG NPM_V8R_VERSION=5.0.0
# renovate: datasource=npm depName=npm-package-json-lint
ARG NPM_PACKAGE_JSON_LINT_VERSION=9.0.0
# renovate: datasource=npm depName=npm-package-json-lint-config-default
ARG NPM_PACKAGE_JSON_LINT_CONFIG_DEFAULT_VERSION=8.0.1
# renovate: datasource=npm depName=eslint-plugin-react
ARG NPM_ESLINT_PLUGIN_REACT_VERSION=7.37.5
# renovate: datasource=npm depName=eslint-plugin-jsx-a11y
ARG NPM_ESLINT_PLUGIN_JSX_ALLY_VERSION=6.10.2
# renovate: datasource=github-tags depName=pinterest/ktlint
ARG KTLINT_VERSION=1.7.0

# renovate: datasource=github-tags depName=detekt/detekt
ARG DETEKT_VERSION=1.23.8

# renovate: datasource=github-tags depName=kubescape/kubescape
ARG KUBERNETES_KUBESCAPE_VERSION=3.0.34
# renovate: datasource=npm depName=markdownlint-cli
ARG NPM_MARKDOWNLINT_CLI_VERSION=0.45.0
# renovate: datasource=npm depName=markdown-table-formatter
ARG NPM_MARKDOWN_TABLE_FORMATTER_VERSION=1.6.1
# renovate: datasource=packagist depName=squizlabs/php_codesniffer
ARG PHP_SQUIZLABS_PHP_CODESNIFFER_VERSION=3.13.2
# renovate: datasource=packagist depName=bartlett/sarif-php-converters
ARG PHP_BARTLETT_SARIF_PHP_CONVERTERS_VERSION=1.2.0
# renovate: datasource=packagist depName=phpstan/phpstan
ARG PHP_PHPSTAN_PHPSTAN_VERSION=2.1.17
# renovate: datasource=packagist depName=phpstan/extension-installer
ARG PHP_PHPSTAN_EXTENSION_INSTALLER_VERSION=1.4.3
# renovate: datasource=packagist depName=vimeo/psalm
ARG PHP_VIMEO_PSALM_VERSION=6.13.0
# renovate: datasource=packagist depName=overtrue/phplint
ARG PHP_OVERTRUE_PHPLINT_VERSION=9.6.2
# renovate: datasource=packagist depName=friendsofphp/php-cs-fixer
ARG PHP_FRIENDSOFPHP_PHP_CS_FIXER_VERSION=v3.84.0
# renovate: datasource=pypi depName=pylint
ARG PIP_PYLINT_VERSION=3.3.7
# renovate: datasource=pypi depName=typing-extensions
ARG PIP_TYPING_EXTENSIONS_VERSION=4.14.1
# renovate: datasource=pypi depName=black
ARG PIP_BLACK_VERSION=25.1.0
# renovate: datasource=pypi depName=flake8
ARG PIP_FLAKE8_VERSION=7.3.0
# renovate: datasource=pypi depName=isort
ARG PIP_ISORT_VERSION=6.0.1
# renovate: datasource=pypi depName=mypy
ARG PIP_MYPY_VERSION=1.17.0
# renovate: datasource=npm depName=pyright
ARG NPM_PYRIGHT_VERSION=1.1.403
# renovate: datasource=pypi depName=ruff
ARG PIP_RUFF_VERSION=0.12.4
# renovate: datasource=pypi depName=checkov
ARG PIP_CHECKOV_VERSION=3.2.413
# renovate: datasource=github-tags depName=anchore/grype
ARG REPOSITORY_GRYPE_VERSION=0.96.0
# renovate: datasource=npm depName=@ls-lint/ls-lint
ARG NPM_LS_LINT_LS_LINT_VERSION=2.3.1
# renovate: datasource=npm depName=secretlint
ARG NPM_SECRETLINT_VERSION=10.2.1
# renovate: datasource=npm depName=@secretlint/secretlint-rule-preset-recommend
ARG NPM_SECRETLINT_SECRETLINT_RULE_PRESET_RECOMMEND_VERSION=10.2.1
# renovate: datasource=npm depName=@secretlint/secretlint-formatter-sarif
ARG NPM_SECRETLINT_SECRETLINT_FORMATTER_SARIF_VERSION=10.2.1
# renovate: datasource=pypi depName=semgrep
ARG PIP_SEMGREP_VERSION=1.116.0
# renovate: datasource=github-tags depName=anchore/syft
ARG REPOSITORY_SYFT_VERSION=1.28.0
# renovate: datasource=github-tags depName=aquasecurity/trivy
ARG REPOSITORY_TRIVY_VERSION=0.64.1
# renovate: datasource=github-tags depName=aquasecurity/trivy
ARG REPOSITORY_TRIVY_SBOM_VERSION=0.64.1
# renovate: datasource=pypi depName=Pygments
ARG PIP_PYGMENTS_VERSION=2.19.2
# renovate: datasource=pypi depName=restructuredtext_lint
ARG PIP_RESTRUCTUREDTEXT_LINT_VERSION=1.4.0
# renovate: datasource=pypi depName=rstcheck
ARG PIP_RSTCHECK_VERSION=6.2.5
# renovate: datasource=pypi depName=click
ARG PIP_RSTCHECK_CLICK_VERSION=8.2.1
# renovate: datasource=pypi depName=rstfmt
ARG PIP_RSTFMT_VERSION=0.0.14
# renovate: datasource=rubygems depName=rubocop
ARG GEM_RUBOCOP_VERSION=1.78.0
# renovate: datasource=rubygems depName=rubocop-github
ARG GEM_RUBOCOP_GITHUB_VERSION=0.26.0
# renovate: datasource=rubygems depName=rubocop-performance
ARG GEM_RUBOCOP_PERFORMANCE_VERSION=1.25.0
# renovate: datasource=rubygems depName=rubocop-rails
ARG GEM_RUBOCOP_RAILS_VERSION=2.32.0
# renovate: datasource=rubygems depName=rubocop-rake
ARG GEM_RUBOCOP_RAKE_VERSION=0.7.1
# renovate: datasource=rubygems depName=rubocop-rspec
ARG GEM_RUBOCOP_RSPEC_VERSION=3.6.0
# renovate: datasource=npm depName=cspell
ARG NPM_CSPELL_VERSION=9.2.0
# renovate: datasource=pypi depName=proselint
ARG PIP_PROSELINT_VERSION=0.14.0
# renovate: datasource=pypi depName=sqlfluff
ARG PIP_SQLFLUFF_VERSION=3.4.2
# renovate: datasource=npm depName=prettyjson
ARG NPM_PRETTYJSON_VERSION=1.2.5
# renovate: datasource=npm depName=@typescript-eslint/eslint-plugin
ARG NPM_TYPESCRIPT_ESLINT_ESLINT_PLUGIN_VERSION=8.37.0
# renovate: datasource=npm depName=@typescript-eslint/parser
ARG NPM_TYPESCRIPT_ESLINT_PARSER_VERSION=8.37.0
# renovate: datasource=npm depName=ts-standard
ARG NPM_TS_STANDARD_VERSION=12.0.2
# renovate: datasource=pypi depName=yamllint
ARG PIP_YAMLLINT_VERSION=1.37.1
# renovate: datasource=pypi depName=pip
ARG PIP_PIP_VERSION=25.1.1
# renovate: datasource=pypi depName=virtualenv
ARG PIP_VIRTUALENV_VERSION=20.31.2
# renovate: datasource=github-tags depName=rust-lang/rust
ARG RUST_RUST_VERSION=1.88.0

ARG ACTION_ACTIONLINT_VERSION
ARG BASH_SHELLCHECK_VERSION
ARG BASH_SHFMT_VERSION
ARG DOCKERFILE_HADOLINT_VERSION
ARG EDITORCONFIG_EDITORCONFIG_CHECKER_VERSION
ARG GO_REVIVE_VERSION
ARG KUBERNETES_KUBECONFORM_VERSION
ARG REPOSITORY_GITLEAKS_VERSION
ARG REPOSITORY_KICS_VERSION
ARG REPOSITORY_TRUFFLEHOG_VERSION
ARG SPELL_LYCHEE_VERSION
ARG TERRAFORM_TFLINT_VERSION
ARG TERRAFORM_TERRASCAN_VERSION
ARG TERRAFORM_TERRAGRUNT_VERSION
#ARG__END

####################
# Run APK installs #
####################

WORKDIR /
COPY --from=uv /uv /uvx /bin/

#############################################################################################
## @generated by .automation/build.py using descriptor files, please do not update manually ##
#############################################################################################
#APK__START
RUN apk -U --no-cache upgrade \
    && apk add --no-cache \
                bash \
                ca-certificates \
                curl \
                gcc \
                git \
                git-lfs \
                libffi-dev \
                make \
                musl-dev \
                openssh \
                docker \
                openrc \
                go \
                openjdk21 \
                gnupg \
                php84 \
                php84-phar \
                php84-mbstring \
                php84-xmlwriter \
                php84-tokenizer \
                php84-ctype \
                php84-curl \
                php84-dom \
                php84-opcache \
                php84-openssl \
                php84-common \
                php84-simplexml \
                php84-iconv \
                dpkg \
                py3-pyflakes \
                cppcheck \
                openjdk17 \
                helm \
                gcompat \
                libstdc++ \
                libxml2-dev \
                libxml2-utils \
                libgcc \
                npm \
                nodejs-current \
                yarn \
                ruby \
                ruby-dev \
                ruby-bundler \
                ruby-rdoc \
    && git config --global core.autocrlf true
#APK__END

# PATH for golang & python
ENV GOROOT=/usr/lib/go \
    GOPATH=/go
    # PYTHONPYCACHEPREFIX="$HOME/.cache/cpython/" NV: not working for all packages :/
# hadolint ignore=DL3044
ENV PATH="$PATH":"$GOROOT"/bin:"$GOPATH"/bin
RUN mkdir -p ${GOPATH}/src ${GOPATH}/bin || true && \
    # Ignore npm package issues
    yarn config set ignore-engines true || true

##############################
# Installs rust dependencies #
#############################################################################################
## @generated by .automation/build.py using descriptor files, please do not update manually ##
#############################################################################################

#CARGO__START
RUN curl https://sh.rustup.rs -sSf | sh -s -- -y --profile minimal --default-toolchain ${RUST_RUST_VERSION} \
    && export PATH="/root/.cargo/bin:/root/.cargo/env:${PATH}" \
    && rustup default stable \
    && rustup component add clippy && cargo install --force --locked sarif-fmt@${CARGO_SARIF_FMT_VERSION} shellcheck-sarif@${CARGO_SHELLCHECK_SARIF_VERSION} \
    && rm -rf /root/.cargo/registry /root/.cargo/git /root/.cache/sccache
ENV PATH="/root/.cargo/bin:/root/.cargo/env:${PATH}"
#CARGO__END

################################
# Installs python dependencies #
#############################################################################################
## @generated by .automation/build.py using descriptor files, please do not update manually ##
#############################################################################################

#PIPVENV__START
RUN uv pip install --system --no-cache pip==${PIP_PIP_VERSION} virtualenv==${PIP_VIRTUALENV_VERSION} \
    && uv venv --seed --no-project --no-managed-python --no-cache "/venvs/ansible-lint" && VIRTUAL_ENV="/venvs/ansible-lint" uv pip install --no-cache ansible-lint==${PIP_ANSIBLE_LINT_VERSION} \
    && uv venv --seed --no-project --no-managed-python --no-cache "/venvs/cpplint" && VIRTUAL_ENV="/venvs/cpplint" uv pip install --no-cache cpplint==${PIP_CPPLINT_VERSION} \
    && uv venv --seed --no-project --no-managed-python --no-cache "/venvs/cfn-lint" && VIRTUAL_ENV="/venvs/cfn-lint" uv pip install --no-cache cfn-lint[sarif]==${PIP_CFN_LINT_VERSION} \
    && uv venv --seed --no-project --no-managed-python --no-cache "/venvs/stylelint" && VIRTUAL_ENV="/venvs/stylelint" uv pip install --no-cache cpplint==${PIP_CPPLINT_VERSION} \
    && uv venv --seed --no-project --no-managed-python --no-cache "/venvs/djlint" && VIRTUAL_ENV="/venvs/djlint" uv pip install --no-cache djlint==${PIP_DJLINT_VERSION} \
    && uv venv --seed --no-project --no-managed-python --no-cache "/venvs/pylint" && VIRTUAL_ENV="/venvs/pylint" uv pip install --no-cache pylint==${PIP_PYLINT_VERSION} typing-extensions==${PIP_TYPING_EXTENSIONS_VERSION} \
    && uv venv --seed --no-project --no-managed-python --no-cache "/venvs/black" && VIRTUAL_ENV="/venvs/black" uv pip install --no-cache black==${PIP_BLACK_VERSION} \
    && uv venv --seed --no-project --no-managed-python --no-cache "/venvs/flake8" && VIRTUAL_ENV="/venvs/flake8" uv pip install --no-cache flake8==${PIP_FLAKE8_VERSION} \
    && uv venv --seed --no-project --no-managed-python --no-cache "/venvs/isort" && VIRTUAL_ENV="/venvs/isort" uv pip install --no-cache black==${PIP_BLACK_VERSION} isort==${PIP_ISORT_VERSION} \
    && uv venv --seed --no-project --no-managed-python --no-cache "/venvs/mypy" && VIRTUAL_ENV="/venvs/mypy" uv pip install --no-cache mypy==${PIP_MYPY_VERSION} \
    && uv venv --seed --no-project --no-managed-python --no-cache "/venvs/ruff" && VIRTUAL_ENV="/venvs/ruff" uv pip install --no-cache ruff==${PIP_RUFF_VERSION} \
    && uv venv --seed --no-project --no-managed-python --no-cache "/venvs/ruff-format" && VIRTUAL_ENV="/venvs/ruff-format" uv pip install --no-cache ruff==${PIP_RUFF_VERSION} \
    && uv venv --seed --no-project --no-managed-python --no-cache "/venvs/checkov" && VIRTUAL_ENV="/venvs/checkov" uv pip install --no-cache checkov==${PIP_CHECKOV_VERSION} \
    && uv venv --seed --no-project --no-managed-python --no-cache "/venvs/semgrep" && VIRTUAL_ENV="/venvs/semgrep" uv pip install --no-cache semgrep==${PIP_SEMGREP_VERSION} \
    && uv venv --seed --no-project --no-managed-python --no-cache "/venvs/rst-lint" && VIRTUAL_ENV="/venvs/rst-lint" uv pip install --no-cache Pygments==${PIP_PYGMENTS_VERSION} restructuredtext_lint==${PIP_RESTRUCTUREDTEXT_LINT_VERSION} \
    && uv venv --seed --no-project --no-managed-python --no-cache "/venvs/rstcheck" && VIRTUAL_ENV="/venvs/rstcheck" uv pip install --no-cache click==${PIP_RSTCHECK_CLICK_VERSION} rstcheck[toml,sphinx]==${PIP_RSTCHECK_VERSION} \
    && uv venv --seed --no-project --no-managed-python --no-cache "/venvs/rstfmt" && VIRTUAL_ENV="/venvs/rstfmt" uv pip install --no-cache rstfmt==${PIP_RSTFMT_VERSION} \
    && uv venv --seed --no-project --no-managed-python --no-cache "/venvs/proselint" && VIRTUAL_ENV="/venvs/proselint" uv pip install --no-cache proselint==${PIP_PROSELINT_VERSION} \
    && uv venv --seed --no-project --no-managed-python --no-cache "/venvs/sqlfluff" && VIRTUAL_ENV="/venvs/sqlfluff" uv pip install --no-cache sqlfluff==${PIP_SQLFLUFF_VERSION} \
    && uv venv --seed --no-project --no-managed-python --no-cache "/venvs/yamllint" && VIRTUAL_ENV="/venvs/yamllint" uv pip install --no-cache yamllint==${PIP_YAMLLINT_VERSION}  \
    && find /venvs \( -type f \( -iname \*.pyc -o -iname \*.pyo \) -o -type d -iname __pycache__ \) -delete \
    && rm -rf /root/.cache
ENV PATH="${PATH}":/venvs/ansible-lint/bin:/venvs/cpplint/bin:/venvs/cfn-lint/bin:/venvs/stylelint/bin:/venvs/djlint/bin:/venvs/pylint/bin:/venvs/black/bin:/venvs/flake8/bin:/venvs/isort/bin:/venvs/mypy/bin:/venvs/ruff/bin:/venvs/ruff-format/bin:/venvs/checkov/bin:/venvs/semgrep/bin:/venvs/rst-lint/bin:/venvs/rstcheck/bin:/venvs/rstfmt/bin:/venvs/proselint/bin:/venvs/sqlfluff/bin:/venvs/yamllint/bin
#PIPVENV__END

############################
# Install NPM dependencies #
#############################################################################################
## @generated by .automation/build.py using descriptor files, please do not update manually ##
#############################################################################################

ENV NODE_OPTIONS="--max-old-space-size=8192" \
    NODE_ENV=production
#NPM__START
WORKDIR /node-deps
RUN npm --no-cache install --ignore-scripts --omit=dev \
                typescript@${NPM_TYPESCRIPT_VERSION} \
                jscpd@${NPM_JSCPD_VERSION} \
                stylelint@${NPM_STYLELINT_VERSION} \
                stylelint-config-standard@${NPM_STYLELINT_CONFIG_STANDARD_VERSION} \
                stylelint-config-sass-guidelines@${NPM_STYLELINT_CONFIG_SASS_GUIDELINES_VERSION} \
                stylelint-scss@${NPM_STYLELINT_SCSS_VERSION} \
                graphql@${NPM_GRAPHQL_VERSION} \
                graphql-schema-linter@${NPM_GRAPHQL_SCHEMA_LINTER_VERSION} \
                npm-groovy-lint@${NPM_GROOVY_LINT_VERSION} \
                htmlhint@${NPM_HTMLHINT_VERSION} \
                eslint@${NPM_ESLINT_VERSION} \
                eslint-config-airbnb@${NPM_ESLINT_CONFIG_AIRBNB_VERSION} \
                eslint-config-prettier@${NPM_ESLINT_CONFIG_PRETTIER_VERSION} \
                eslint-config-standard@${NPM_ESLINT_CONFIG_STANDARD_VERSION} \
                eslint-plugin-import@${NPM_ESLINT_PLUGIN_IMPORT_VERSION} \
                eslint-plugin-jest@${NPM_ESLINT_PLUGIN_JEST_VERSION} \
                eslint-plugin-n@${NPM_ESLINT_PLUGIN_N_VERSION} \
                eslint-plugin-prettier@${NPM_ESLINT_PLUGIN_PRETTIER_VERSION} \
                eslint-plugin-promise@${NPM_ESLINT_PLUGIN_PROMISE_VERSION} \
                eslint-plugin-vue@${NPM_ESLINT_PLUGIN_VUE_VERSION} \
                @babel/core@${NPM_BABEL_CORE_VERSION} \
                @babel/eslint-parser@${NPM_BABEL_ESLINT_PARSER_VERSION} \
                @microsoft/eslint-formatter-sarif@${NPM_MICROSOFT_ESLINT_FORMATTER_SARIF_VERSION} \
                standard@${NPM_STANDARD_VERSION} \
                prettier@${NPM_PRETTIER_VERSION} \
                @prantlf/jsonlint@${NPM_PRANTLF_JSONLINT_VERSION} \
                v8r@${NPM_V8R_VERSION} \
                npm-package-json-lint@${NPM_PACKAGE_JSON_LINT_VERSION} \
                npm-package-json-lint-config-default@${NPM_PACKAGE_JSON_LINT_CONFIG_DEFAULT_VERSION} \
                eslint-plugin-react@${NPM_ESLINT_PLUGIN_REACT_VERSION} \
                eslint-plugin-jsx-a11y@${NPM_ESLINT_PLUGIN_JSX_ALLY_VERSION} \
                markdownlint-cli@${NPM_MARKDOWNLINT_CLI_VERSION} \
                markdown-table-formatter@${NPM_MARKDOWN_TABLE_FORMATTER_VERSION} \
                pyright@${NPM_PYRIGHT_VERSION} \
                @ls-lint/ls-lint@${NPM_LS_LINT_LS_LINT_VERSION} \
                secretlint@${NPM_SECRETLINT_VERSION} \
                @secretlint/secretlint-rule-preset-recommend@${NPM_SECRETLINT_SECRETLINT_RULE_PRESET_RECOMMEND_VERSION} \
                @secretlint/secretlint-formatter-sarif@${NPM_SECRETLINT_SECRETLINT_FORMATTER_SARIF_VERSION} \
                cspell@${NPM_CSPELL_VERSION} \
                prettyjson@${NPM_PRETTYJSON_VERSION} \
                @typescript-eslint/eslint-plugin@${NPM_TYPESCRIPT_ESLINT_ESLINT_PLUGIN_VERSION} \
                @typescript-eslint/parser@${NPM_TYPESCRIPT_ESLINT_PARSER_VERSION} \
                ts-standard@${NPM_TS_STANDARD_VERSION} && \
    echo "Cleaning npm cache…" \
    && (npm cache clean --force || true) \
    && echo "Changing owner of node_modules files…" \
    && chown -R "$(id -u)":"$(id -g)" node_modules # fix for https://github.com/npm/cli/issues/5900 \
    && echo "Removing extra node_module files…" \
    && find . \( -not -path "/proc" \) -and \( -type f \( -iname "*.d.ts" -o -iname "*.map" -o -iname "*.npmignore" -o -iname "*.travis.yml" -o -iname "CHANGELOG.md" -o -iname "README.md" -o -iname ".package-lock.json" -o -iname "package-lock.json" \) -o -type d -name /root/.npm/_cacache \) -delete
WORKDIR /

#NPM__END

# Add node packages to path #
ENV PATH="/node-deps/node_modules/.bin:${PATH}" \
    NODE_PATH="/node-deps/node_modules"

##############################
# Installs ruby dependencies #
#############################################################################################
## @generated by .automation/build.py using descriptor files, please do not update manually ##
#############################################################################################

#GEM__START
RUN echo 'gem: --no-document' >> ~/.gemrc && \
    gem install \
          rubocop:${GEM_RUBOCOP_VERSION} \
          rubocop-github:${GEM_RUBOCOP_GITHUB_VERSION} \
          rubocop-performance:${GEM_RUBOCOP_PERFORMANCE_VERSION} \
          rubocop-rails:${GEM_RUBOCOP_RAILS_VERSION} \
          rubocop-rake:${GEM_RUBOCOP_RAKE_VERSION} \
          rubocop-rspec:${GEM_RUBOCOP_RSPEC_VERSION}
#GEM__END

##############################
# COPY instructions #
#############################################################################################
## @generated by .automation/build.py using descriptor files, please do not update manually ##
#############################################################################################

#COPY__START
COPY --from=composer/composer:2-bin /composer /usr/bin/composer
COPY --link --from=actionlint /usr/local/bin/actionlint /usr/bin/actionlint
# shellcheck is a dependency for actionlint
COPY --link --from=shellcheck /bin/shellcheck /usr/bin/shellcheck
# Next COPY line commented because already managed by another linter
# COPY --link --from=shellcheck /bin/shellcheck /usr/bin/shellcheck
COPY --link --from=shfmt /bin/shfmt /usr/bin/
COPY --link --from=hadolint /bin/hadolint /usr/bin/hadolint
COPY --link --from=editorconfig-checker /usr/bin/ec /usr/bin/editorconfig-checker
COPY --link --from=revive /usr/bin/revive /usr/bin/revive
COPY --link --from=kubeconform /kubeconform /usr/bin/
COPY --link --from=gitleaks /usr/bin/gitleaks /usr/bin/
COPY --link --from=kics /app/bin/kics /usr/bin/kics
COPY --from=kics /app/bin/assets /usr/bin/assets
COPY --link --from=trufflehog /usr/bin/trufflehog /usr/bin/
COPY --link --from=lychee /usr/local/bin/lychee /usr/bin/
COPY --link --from=tflint /usr/local/bin/tflint /usr/bin/
COPY --link --from=terrascan /go/bin/terrascan /usr/bin/
COPY --link --from=terragrunt /usr/local/bin/terragrunt /usr/bin/
COPY --link --from=terragrunt /bin/terraform /usr/bin/
#COPY__END

#############################################################################################
## @generated by .automation/build.py using descriptor files, please do not update manually ##
#############################################################################################
#OTHER__START
RUN rc-update add docker boot && (rc-service docker start || true)
# CLOJURE installation
ENV LANG=C.UTF-8
RUN ALPINE_GLIBC_BASE_URL="https://github.com/sgerrand/alpine-pkg-glibc/releases/download" && \
    ALPINE_GLIBC_BASE_PACKAGE_FILENAME="glibc-$ALPINE_GLIBC_PACKAGE_VERSION.apk" && \
    ALPINE_GLIBC_BIN_PACKAGE_FILENAME="glibc-bin-$ALPINE_GLIBC_PACKAGE_VERSION.apk" && \
    ALPINE_GLIBC_I18N_PACKAGE_FILENAME="glibc-i18n-$ALPINE_GLIBC_PACKAGE_VERSION.apk" && \
    apk add --no-cache --virtual=.build-dependencies wget ca-certificates && \
    echo \
        "-----BEGIN PUBLIC KEY-----\
        MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEApZ2u1KJKUu/fW4A25y9m\
        y70AGEa/J3Wi5ibNVGNn1gT1r0VfgeWd0pUybS4UmcHdiNzxJPgoWQhV2SSW1JYu\
        tOqKZF5QSN6X937PTUpNBjUvLtTQ1ve1fp39uf/lEXPpFpOPL88LKnDBgbh7wkCp\
        m2KzLVGChf83MS0ShL6G9EQIAUxLm99VpgRjwqTQ/KfzGtpke1wqws4au0Ab4qPY\
        KXvMLSPLUp7cfulWvhmZSegr5AdhNw5KNizPqCJT8ZrGvgHypXyiFvvAH5YRtSsc\
        Zvo9GI2e2MaZyo9/lvb+LbLEJZKEQckqRj4P26gmASrZEPStwc+yqy1ShHLA0j6m\
        1QIDAQAB\
        -----END PUBLIC KEY-----" | sed 's/   */\n/g' > "/etc/apk/keys/sgerrand.rsa.pub" && \
    wget --quiet --tries=10 --waitretry=10 \
        "$ALPINE_GLIBC_BASE_URL/$ALPINE_GLIBC_PACKAGE_VERSION/$ALPINE_GLIBC_BASE_PACKAGE_FILENAME" \
        "$ALPINE_GLIBC_BASE_URL/$ALPINE_GLIBC_PACKAGE_VERSION/$ALPINE_GLIBC_BIN_PACKAGE_FILENAME" \
        "$ALPINE_GLIBC_BASE_URL/$ALPINE_GLIBC_PACKAGE_VERSION/$ALPINE_GLIBC_I18N_PACKAGE_FILENAME" && \
    mv /etc/nsswitch.conf /etc/nsswitch.conf.bak && \
    apk add --no-cache --force-overwrite \
        "$ALPINE_GLIBC_BASE_PACKAGE_FILENAME" \
        "$ALPINE_GLIBC_BIN_PACKAGE_FILENAME" \
        "$ALPINE_GLIBC_I18N_PACKAGE_FILENAME" && \
    \
    mv /etc/nsswitch.conf.bak /etc/nsswitch.conf && \
    rm "/etc/apk/keys/sgerrand.rsa.pub" && \
    (/usr/glibc-compat/bin/localedef --force --inputfile POSIX --charmap UTF-8 "$LANG" || true) && \
    echo "export LANG=$LANG" > /etc/profile.d/locale.sh && \
    \
    apk del glibc-i18n && \
    \
    rm "/root/.wget-hsts" && \
    apk del .build-dependencies && \
    rm \
        "$ALPINE_GLIBC_BASE_PACKAGE_FILENAME" \
        "$ALPINE_GLIBC_BIN_PACKAGE_FILENAME" \
        "$ALPINE_GLIBC_I18N_PACKAGE_FILENAME"

#
# JAVA installation
ENV JAVA_HOME=/usr/lib/jvm/java-21-openjdk
ENV PATH="$JAVA_HOME/bin:${PATH}"
#
# KOTLIN installation
# Next line commented because already managed by another linter
# ENV JAVA_HOME=/usr/lib/jvm/java-21-openjdk
# Next line commented because already managed by another linter
# ENV PATH="$JAVA_HOME/bin:${PATH}"
#
# PHP installation
RUN update-alternatives --install /usr/bin/php php /usr/bin/php84 110
# Managed with COPY --from=composer/composer:2-bin /composer /usr/bin/composer
ENV PATH="/root/.composer/vendor/bin:${PATH}"
ENV PHP_CS_FIXER_IGNORE_ENV=true
#
# TYPESCRIPT installation
#
# actionlint installation
# Managed with COPY --link --from=actionlint /usr/local/bin/actionlint /usr/bin/actionlint
#              # shellcheck is a dependency for actionlint
# Managed with COPY --link --from=shellcheck /bin/shellcheck /usr/bin/shellcheck
#
# ansible-lint installation
#
# bash-exec installation
RUN printf '#!/bin/bash \n\nif [[ -x "$1" ]]; then exit 0; else echo "Error: File:[$1] is not executable"; exit 1; fi' > /usr/bin/bash-exec \
    && chmod +x /usr/bin/bash-exec \
#
# shellcheck installation
# Managed with # Next COPY line commented because already managed by another linter
#              # COPY --link --from=shellcheck /bin/shellcheck /usr/bin/shellcheck
#
# shfmt installation
# Managed with COPY --link --from=shfmt /bin/shfmt /usr/bin/
#
# cpplint installation
#
# clj-kondo installation
    && curl --retry 5 --retry-delay 5 -sLO https://raw.githubusercontent.com/clj-kondo/clj-kondo/refs/tags/v${CLJ_KONDO_VERSION}/script/install-clj-kondo \
    && chmod +x install-clj-kondo \
    && ./install-clj-kondo \
#
# cljstyle installation
    && curl --retry 5 --retry-delay 5 -sLO https://raw.githubusercontent.com/greglook/cljstyle/main/util/install-cljstyle \
    && chmod +x install-cljstyle \
    && ./install-cljstyle --static --version "$CLJ_STYLE_VERSION" \
#
# cfn-lint installation
#
# jscpd installation
#
# cpplint installation
#
# stylelint installation
#
# hadolint installation
# Managed with COPY --link --from=hadolint /bin/hadolint /usr/bin/hadolint
#
# editorconfig-checker installation
# Managed with COPY --link --from=editorconfig-checker /usr/bin/ec /usr/bin/editorconfig-checker
#
# dotenv-linter installation
    && wget -q -O - https://raw.githubusercontent.com/dotenv-linter/dotenv-linter/master/install.sh | sh -s \
#
# golangci-lint installation
    && wget -O- -nv https://raw.githubusercontent.com/golangci/golangci-lint/master/install.sh | sh -s "v${GO_GOLANGCI_LINT_VERSION}" \
    && golangci-lint --version

#
# revive installation
# Managed with COPY --link --from=revive /usr/bin/revive /usr/bin/revive
#
# graphql-schema-linter installation
#
# npm-groovy-lint installation
ENV JAVA_HOME_17=/usr/lib/jvm/java-17-openjdk
#
# djlint installation
#
# htmlhint installation
#
# checkstyle installation
RUN --mount=type=secret,id=GITHUB_TOKEN CHECKSTYLE_LATEST=$(curl -s \
    -H "Accept: application/vnd.github+json" \
    -H "Authorization: Bearer $(cat /run/secrets/GITHUB_TOKEN)" \
    https://api.github.com/repos/checkstyle/checkstyle/releases/latest \
        | grep browser_download_url \
        | grep ".jar" \
        | cut -d '"' -f 4) \
    && curl --retry 5 --retry-delay 5 -sSL $CHECKSTYLE_LATEST \
        --output /usr/bin/checkstyle

#
# pmd installation
RUN wget --quiet https://github.com/pmd/pmd/releases/download/pmd_releases%2F${PMD_VERSION}/pmd-dist-${PMD_VERSION}-bin.zip && \
    unzip pmd-dist-${PMD_VERSION}-bin.zip || echo "Error unzipping" && \
    rm pmd-dist-${PMD_VERSION}-bin.zip || echo "Error rm" && \
    mv pmd-bin-${PMD_VERSION} /usr/bin/pmd || echo "Error mv" && \
    chmod +x /usr/bin/pmd/bin/pmd || echo "Error chmod" \
#
# eslint installation
#
# standard installation
#
# prettier installation
#
# jsonlint installation
#
# v8r installation
#
# prettier installation
#
# npm-package-json-lint installation
#
# eslint installation
#
# ktlint installation
    && curl --retry 5 --retry-delay 5 -sSLO https://github.com/pinterest/ktlint/releases/download/${KTLINT_VERSION}/ktlint && \
    chmod a+x ktlint && \
    mv "ktlint" /usr/bin/ \
#
# detekt installation
    && curl --retry 5 --retry-delay 5 -sSLO https://github.com/detekt/detekt/releases/download/v${DETEKT_VERSION}/detekt-cli-${DETEKT_VERSION}.zip && \
    unzip detekt-cli-${DETEKT_VERSION}.zip && \
    chmod a+x detekt-cli-${DETEKT_VERSION}/bin/* && \
    chmod a+x detekt-cli-${DETEKT_VERSION}/lib/* && \
    mv -n detekt-cli-${DETEKT_VERSION}/bin/* usr/bin && \
    mv -n detekt-cli-${DETEKT_VERSION}/lib/* usr/lib \
#
# kubeconform installation
# Managed with COPY --link --from=kubeconform /kubeconform /usr/bin/
#
# kubescape installation
    && ln -s /lib/libc.so.6 /usr/lib/libresolv.so.2 && \
    curl --retry 5 --retry-delay 5 -sLv https://raw.githubusercontent.com/kubescape/kubescape/master/install.sh | /bin/bash -s -- -v "v${KUBERNETES_KUBESCAPE_VERSION}"
#
# markdownlint installation
#
# markdown-table-formatter installation
#
# phpcs installation
RUN --mount=type=secret,id=GITHUB_TOKEN GITHUB_AUTH_TOKEN="$(cat /run/secrets/GITHUB_TOKEN)" && export GITHUB_AUTH_TOKEN && composer global require squizlabs/php_codesniffer:${PHP_SQUIZLABS_PHP_CODESNIFFER_VERSION} bartlett/sarif-php-converters:${PHP_BARTLETT_SARIF_PHP_CONVERTERS_VERSION}

#
# phpstan installation
RUN --mount=type=secret,id=GITHUB_TOKEN GITHUB_AUTH_TOKEN="$(cat /run/secrets/GITHUB_TOKEN)" && export GITHUB_AUTH_TOKEN && composer config --global allow-plugins.phpstan/extension-installer true && composer global require phpstan/phpstan:${PHP_PHPSTAN_PHPSTAN_VERSION} phpstan/extension-installer:${PHP_PHPSTAN_EXTENSION_INSTALLER_VERSION} bartlett/sarif-php-converters:${PHP_BARTLETT_SARIF_PHP_CONVERTERS_VERSION}
#
# psalm installation
RUN --mount=type=secret,id=GITHUB_TOKEN GITHUB_AUTH_TOKEN="$(cat /run/secrets/GITHUB_TOKEN)" && export GITHUB_AUTH_TOKEN && composer global require vimeo/psalm:${PHP_VIMEO_PSALM_VERSION}

#
# phplint installation
RUN --mount=type=secret,id=GITHUB_TOKEN GITHUB_AUTH_TOKEN="$(cat /run/secrets/GITHUB_TOKEN)" && export GITHUB_AUTH_TOKEN && composer global require overtrue/phplint:${PHP_OVERTRUE_PHPLINT_VERSION} bartlett/sarif-php-converters:${PHP_BARTLETT_SARIF_PHP_CONVERTERS_VERSION}

#
# php-cs-fixer installation
RUN --mount=type=secret,id=GITHUB_TOKEN GITHUB_AUTH_TOKEN="$(cat /run/secrets/GITHUB_TOKEN)" && export GITHUB_AUTH_TOKEN && composer global require friendsofphp/php-cs-fixer:${PHP_FRIENDSOFPHP_PHP_CS_FIXER_VERSION} --with-all-dependencies

#
# pylint installation
#
# black installation
#
# flake8 installation
#
# isort installation
#
# mypy installation
ENV MYPY_CACHE_DIR=/tmp
#
# pyright installation
#
# ruff installation
#
# ruff-format installation
#
# checkov installation
#
# gitleaks installation
# Managed with COPY --link --from=gitleaks /usr/bin/gitleaks /usr/bin/
#
# grype installation
RUN curl -sSfL https://raw.githubusercontent.com/anchore/grype/refs/tags/v${REPOSITORY_GRYPE_VERSION}/install.sh | sh -s -- -b /usr/local/bin
#
# kics installation
# Managed with COPY --link --from=kics /app/bin/kics /usr/bin/kics
ENV KICS_QUERIES_PATH=/usr/bin/assets/queries KICS_LIBRARIES_PATH=/usr/bin/assets/libraries
# Managed with COPY --from=kics /app/bin/assets /usr/bin/assets
#
# ls-lint installation
#
# secretlint installation
#
# semgrep installation
#
# syft installation
RUN curl -sSfL https://raw.githubusercontent.com/anchore/syft/refs/tags/v${REPOSITORY_SYFT_VERSION}/install.sh | sh -s -- -b /usr/local/bin \
#
# trivy installation
    && wget --tries=5 -q -O - https://raw.githubusercontent.com/aquasecurity/trivy/main/contrib/install.sh | sh -s -- -b /usr/local/bin "v${REPOSITORY_TRIVY_VERSION}" \
    && (trivy image --download-db-only --no-progress || trivy image --download-db-only --no-progress || trivy image --download-db-only --no-progress || trivy image --download-db-only --no-progress || trivy image --download-db-only --no-progress || trivy image --download-db-only --no-progress || trivy image --download-db-only --no-progress || trivy image --download-db-only --no-progress || trivy image --download-db-only --no-progress || trivy image --download-db-only --no-progress || trivy image --download-db-only --no-progress || trivy image --download-db-only --no-progress || trivy image --download-db-only --no-progress || trivy image --download-db-only --no-progress || trivy image --download-db-only --no-progress || trivy image --download-db-only --no-progress || trivy image --download-db-only --no-progress || trivy image --download-db-only --no-progress || trivy image --download-db-only --no-progress || trivy image --download-db-only --no-progress || trivy image --download-db-only --no-progress || trivy image --download-db-only --no-progress || trivy image --download-db-only --no-progress || trivy image --download-db-only --no-progress || trivy image --download-db-only --no-progress || trivy image --download-db-only --no-progress) \
#
# trivy-sbom installation
    && wget --tries=5 -q -O - https://raw.githubusercontent.com/aquasecurity/trivy/main/contrib/install.sh | sh -s -- -b /usr/local/bin "v${REPOSITORY_TRIVY_SBOM_VERSION}" \
    && (trivy image --download-db-only --no-progress || trivy image --download-db-only --no-progress || trivy image --download-db-only --no-progress || trivy image --download-db-only --no-progress || trivy image --download-db-only --no-progress || trivy image --download-db-only --no-progress || trivy image --download-db-only --no-progress || trivy image --download-db-only --no-progress || trivy image --download-db-only --no-progress || trivy image --download-db-only --no-progress || trivy image --download-db-only --no-progress || trivy image --download-db-only --no-progress || trivy image --download-db-only --no-progress || trivy image --download-db-only --no-progress || trivy image --download-db-only --no-progress || trivy image --download-db-only --no-progress || trivy image --download-db-only --no-progress || trivy image --download-db-only --no-progress)

#
# trufflehog installation
# Managed with COPY --link --from=trufflehog /usr/bin/trufflehog /usr/bin/
#
# rst-lint installation
#
# rstcheck installation
#
# rstfmt installation
#
# rubocop installation
#
# cspell installation
#
# proselint installation
#
# lychee installation
# Managed with COPY --link --from=lychee /usr/local/bin/lychee /usr/bin/
#
# sqlfluff installation
#
# swiftlint installation
# renovate: datasource=docker depName=ghcr.io/realm/swiftlint
ENV SWIFT_SWIFTLINT_VERSION=0.59.1
#
# tflint installation
# Managed with COPY --link --from=tflint /usr/local/bin/tflint /usr/bin/
#
# terrascan installation
# Managed with COPY --link --from=terrascan /go/bin/terrascan /usr/bin/
#
# terragrunt installation
# Managed with COPY --link --from=terragrunt /usr/local/bin/terragrunt /usr/bin/
#
# terraform-fmt installation
# Managed with COPY --link --from=terragrunt /bin/terraform /usr/bin/
#
# eslint installation
#
# eslint installation
#
# ts-standard installation
#
# prettier installation
#
# prettier installation
#
# yamllint installation
#
# v8r installation
#
#OTHER__END

################################
# Installs python dependencies #
################################
COPY --from=build-ml-core pyproject.toml README.md ./
COPY --from=build-ml-core megalinter /megalinter/
RUN --mount=type=cache,target=/root/.cache/uv,from=build-ml-core \
    --mount=from=uv,source=/uv,target=/bin/uv \
    uv pip install --system -e .

#######################################
# Copy scripts and rules to container #
#######################################
COPY megalinter/descriptors /megalinter-descriptors
COPY TEMPLATES /action/lib/.automation

# Copy server scripts
COPY server /server

###########################
# Get the build arguments #
###########################
ARG BUILD_DATE
ARG BUILD_REVISION
ARG BUILD_VERSION

#################################################
# Set ENV values used for debugging the version #
#################################################
ENV BUILD_DATE=$BUILD_DATE \
    BUILD_REVISION=$BUILD_REVISION \
    BUILD_VERSION=$BUILD_VERSION

#FLAVOR__START
ENV MEGALINTER_FLAVOR=cupcake
#FLAVOR__END

#########################################
# Label the instance and set maintainer #
#########################################
LABEL com.github.actions.name="MegaLinter" \
      com.github.actions.description="The ultimate linters aggregator to make sure your projects are clean" \
      com.github.actions.icon="code" \
      com.github.actions.color="red" \
      maintainer="Nicolas Vuillamy <nicolas.vuillamy@gmail.com>" \
      org.opencontainers.image.created=$BUILD_DATE \
      org.opencontainers.image.revision=$BUILD_REVISION \
      org.opencontainers.image.version=$BUILD_VERSION \
      org.opencontainers.image.authors="Nicolas Vuillamy <nicolas.vuillamy@gmail.com>" \
      org.opencontainers.image.url="https://megalinter.io" \
      org.opencontainers.image.source="https://github.com/oxsecurity/megalinter" \
      org.opencontainers.image.documentation="https://megalinter.io" \
      org.opencontainers.image.vendor="Nicolas Vuillamy" \
      org.opencontainers.image.description="Lint your code base with GitHub Actions"

#EXTRA_DOCKERFILE_LINES__START
COPY entrypoint.sh /entrypoint.sh
RUN chmod +x entrypoint.sh
ENTRYPOINT ["/bin/bash", "/entrypoint.sh"]
#EXTRA_DOCKERFILE_LINES__END