# Helm pilot — argo/argo-cd 10.10.1 pins quay.io/argoproj/argocd:v3.5.4.
# Ladder (b): Argo CD v3.5.4 rebuilt from public source following upstream's v3.5.4 Dockerfile, with:
#   - Go 1.26.9 toolchain (upstream: 1.26.4; prebuilt kustomize go1.24.0, git-lfs go1.25.3, helm go1.26.4)
#   - helm v4.2.1 / kustomize v5.8.1 / git-lfs v3.7.1 (= hack/tool-versions.sh @ v3.5.4) rebuilt from source
#   - minimal "at least" module bumps (scripts/go-bumps.py from both scanners; never downgrade, never cross a major)
#   - same ubuntu:26.04 base; /usr/bin/pebble (shipped in the ubuntu:26.04 rootfs, not a dpkg package,
#     unused by Argo CD) removed
# No Argo CD source changes.
ARG GO_IMAGE=docker.io/library/golang:1.26.9@sha256:f1f0bcc2c524a3ced375fcb4d1ecb7aa371aa7070e112599aaca45cc02d0101b
ARG NODE_IMAGE=docker.io/library/node:24.14.1@sha256:80fc934952c8f1b2b4d39907af7211f8a9fff1a4c2cf673fb49099292c251cec
ARG BASE_IMAGE=docker.io/library/ubuntu:26.04@sha256:f144425ff09be612d6d9ad965196e9cdc23dae1f42110a8a11a3e9a8198759f7
ARG ARGOCD_REF=v3.5.4

FROM ${GO_IMAGE} AS src
ARG ARGOCD_REF
RUN git clone --depth 1 --branch ${ARGOCD_REF} https://github.com/argoproj/argo-cd.git /src && git -C /src rev-parse HEAD > /src/.upstream-commit

FROM ${GO_IMAGE} AS tools
ENV GOTOOLCHAIN=local CGO_ENABLED=0 GOWORK=off
COPY go-min-bump.sh /usr/local/bin/
ARG HELM_REF=v4.2.1
ARG HELM_BUMPS="golang.org/x/crypto@v0.56.0 golang.org/x/net@v0.56.0 golang.org/x/text@v0.39.0 oras.land/oras-go/v2@v2.6.2"
RUN git clone --depth 1 --branch ${HELM_REF} https://github.com/helm/helm.git /helm && cd /helm \
 && go-min-bump.sh ${HELM_BUMPS} > /helm.bumps \
 && make build && ./bin/helm version && install -m0755 bin/helm /usr/local/bin/helm
ARG KUSTOMIZE_REF=kustomize/v5.8.1
ARG KUSTOMIZE_BUMPS="golang.org/x/text@v0.39.0"
RUN git clone --depth 1 --branch ${KUSTOMIZE_REF} https://github.com/kubernetes-sigs/kustomize.git /kz && cd /kz/kustomize \
 && go-min-bump.sh ${KUSTOMIZE_BUMPS} > /kustomize.bumps \
 && go build -trimpath -ldflags "-s -w -X sigs.k8s.io/kustomize/api/provenance.version=${KUSTOMIZE_REF} -X sigs.k8s.io/kustomize/api/provenance.gitCommit=$(git rev-parse HEAD)" -o /usr/local/bin/kustomize . \
 && /usr/local/bin/kustomize version
ARG GITLFS_REF=v3.7.1
ARG GITLFS_BUMPS="golang.org/x/crypto@v0.56.0 golang.org/x/net@v0.56.0 golang.org/x/text@v0.39.0"
RUN git clone --depth 1 --branch ${GITLFS_REF} https://github.com/git-lfs/git-lfs.git /lfs && cd /lfs \
 && go-min-bump.sh ${GITLFS_BUMPS} > /gitlfs.bumps \
 && go build -trimpath -ldflags "-s -w -X github.com/git-lfs/git-lfs/v3/config.GitCommit=$(git rev-parse --short HEAD)" -o /usr/local/bin/git-lfs . \
 && /usr/local/bin/git-lfs version

FROM ${NODE_IMAGE} AS argocd-ui
WORKDIR /src
COPY --from=src /src/ui/package.json /src/ui/pnpm-lock.yaml ./
RUN npm install -g corepack@0.34.6 && corepack enable && pnpm install --frozen-lockfile
COPY --from=src /src/ui/ .
ARG ARGOCD_REF
ENV ARGO_VERSION=${ARGOCD_REF}
RUN NODE_ENV='production' NODE_ONLINE_ENV='online' NODE_OPTIONS=--max_old_space_size=8192 pnpm build

FROM ${GO_IMAGE} AS argocd-build
ENV GOTOOLCHAIN=local
COPY go-min-bump.sh /usr/local/bin/
COPY --from=src /src /go/src/github.com/argoproj/argo-cd
WORKDIR /go/src/github.com/argoproj/argo-cd
ARG ARGOCD_BUMPS="github.com/go-git/go-git/v5@v5.19.2 golang.org/x/crypto@v0.56.0 golang.org/x/net@v0.56.0 golang.org/x/text@v0.39.0 google.golang.org/grpc@v1.83.2 oras.land/oras-go/v2@v2.6.2"
RUN go-min-bump.sh ${ARGOCD_BUMPS} > /argocd.bumps && git diff --stat go.mod
COPY --from=argocd-ui /src/dist/app ui/dist/app
ARG ARGOCD_REF
RUN GIT_TAG=${ARGOCD_REF} GIT_TREE_STATE=dirty GIT_COMMIT=$(cat .upstream-commit) make argocd-all && ls -la dist/

FROM ${BASE_IMAGE}
ARG ARGOCD_REF
LABEL org.opencontainers.image.source="https://github.com/argoproj/argo-cd" \
      org.opencontainers.image.version="v3.5.4" \
      io.thepeoples.hardened.upstream="quay.io/argoproj/argocd:v3.5.4@sha256:49dff79439bb38b1b942b19a113fe1fec7e6b6c671ddf9fe6a4a7c46bde0b77b" \
      io.thepeoples.hardened.replaces="quay.io/argoproj/argocd:v3.5.4@sha256:49dff79439bb38b1b942b19a113fe1fec7e6b6c671ddf9fe6a4a7c46bde0b77b" \
      io.thepeoples.hardened.ladder="b" \
      io.thepeoples.hardened.claim="package-fixable CRITICAL/HIGH cleared vs upstream digest; not FIPS/FedRAMP"
USER root
ENV ARGOCD_USER_ID=999 DEBIAN_FRONTEND=noninteractive
RUN groupadd -g $ARGOCD_USER_ID argocd && useradd -r -u $ARGOCD_USER_ID -g argocd argocd \
 && mkdir -p /home/argocd && chown argocd:0 /home/argocd && chmod g=u /home/argocd \
 && apt-get update && apt-get dist-upgrade -y \
 && apt-get install --no-install-recommends -y git tini ca-certificates gpg gpg-agent tzdata connect-proxy openssh-client \
 && apt-get clean && rm -rf /var/lib/apt/lists/* /tmp/* /var/tmp/* /usr/share/doc/* \
 && rm -rf /usr/bin/pebble /var/lib/pebble
COPY --from=src /src/hack/gpg-wrapper.sh /src/hack/git-verify-wrapper.sh /src/entrypoint.sh /usr/local/bin/
COPY --from=tools /usr/local/bin/helm /usr/local/bin/kustomize /usr/local/bin/git-lfs /usr/local/bin/
RUN git lfs install --system
COPY --from=tools /helm.bumps /kustomize.bumps /gitlfs.bumps /usr/share/tp-hardened/
COPY --from=argocd-build /argocd.bumps /go/src/github.com/argoproj/argo-cd/.upstream-commit /usr/share/tp-hardened/
RUN ln -s /usr/local/bin/entrypoint.sh /usr/local/bin/uid_entrypoint.sh
WORKDIR /app/config/ssh
RUN touch ssh_known_hosts && ln -s /app/config/ssh/ssh_known_hosts /etc/ssh/ssh_known_hosts
WORKDIR /app/config
RUN mkdir -p tls gpg/source gpg/keys && chown argocd gpg/keys && chmod 0700 gpg/keys
ENV USER=argocd GRPC_ENABLE_TXT_SERVICE_CONFIG=false
COPY --from=argocd-build /go/src/github.com/argoproj/argo-cd/dist/argocd* /usr/local/bin/
RUN for c in server repo-server cmp-server application-controller dex notifications applicationset-controller k8s-auth commit-server; do \
      ln -s /usr/local/bin/argocd /usr/local/bin/argocd-$c; done
USER $ARGOCD_USER_ID
WORKDIR /home/argocd
ENTRYPOINT ["/usr/bin/tini", "--"]