compose.yml

volumes:
  cache:

services:
  volume-init:
    image: busybox:1.37.0-musl
    user: root
    volumes:
      - cache:/cache
    command:
      - sh
      - -c
      - |
        mkdir -p /cache/go-build
        mkdir -p /cache/go-mod
        mkdir -p /cache/golangci-lint
        mkdir -p /cache/npm
        chown -R ${FIXUID:-1000}:${FIXGID:-1000} /cache

  go-builder:
    profiles: ["build"]
    user: ${FIXUID:-1000}:${FIXGID:-1000}
    build:
      context: .
      dockerfile: Dockerfile
      target: builder-download
    environment:
      GOCACHE: /cache/go-build
      GOMODCACHE: /cache/go-mod
    depends_on:
      volume-init:
        condition: service_completed_successfully
    volumes:
      - .:/src
      - cache:/cache

  go-binary:
    profiles: ["build"]
    user: ${FIXUID:-1000}:${FIXGID:-1000}
    build:
      context: .
      dockerfile: Dockerfile
      target: export
    environment:
      GOCACHE: /cache/go-build
      GOMODCACHE: /cache/go-mod
    depends_on:
      volume-init:
        condition: service_completed_successfully
    volumes:
      - cache:/cache

  goreleaser:
    profiles: ["build"]
    user: ${FIXUID:-1000}:${FIXGID:-1000}
    # Latest version: https://hub.docker.com/r/goreleaser/goreleaser/tags
    image: goreleaser/goreleaser:v2.18.1
    working_dir: /src
    environment:
      GOCACHE: /cache/go-build
      GOMODCACHE: /cache/go-mod
      # The image pins GOTOOLCHAIN=local, so its bundled Go has to satisfy the
      # `go` directive in go.mod or the release fails before it builds anything.
      # `auto` lets go.mod stay the single pin — matching the release workflow,
      # which resolves its toolchain from go-version-file — so bumping go.mod
      # does not also mean hunting for a goreleaser image that happens to agree.
      GOTOOLCHAIN: auto
    depends_on:
      volume-init:
        condition: service_completed_successfully
    volumes:
      - .:/src
      - cache:/cache

  hugo:
    profiles: ["docs"]
    user: ${FIXUID:-1000}:${FIXGID:-1000}
    # Latest version: https://hub.docker.com/r/hugomods/hugo/tags
    image: hugomods/hugo:debian-go-git-non-root-0.161.1
    working_dir: /src/docs
    environment:
      GOCACHE: /cache/go-build
      GOMODCACHE: /cache/go-mod
    depends_on:
      volume-init:
        condition: service_completed_successfully
    volumes:
      - .:/src
      - cache:/cache
    ports:
      - "1313:1313"

  docs-preview:
    profiles: ["docs"]
    # nginx drops to its own unprivileged worker after binding port 80 and
    # writing its pid, so this one service stays on the image's default user.
    # Latest version: https://hub.docker.com/_/nginx/tags
    image: nginx:1.31.3-alpine
    volumes:
      - ./docs/public:/usr/share/nginx/html:ro
      - ./docs/nginx.conf:/etc/nginx/conf.d/default.conf:ro
    ports:
      - "8080:80"

  vhs:
    profiles: ["demo"]
    user: ${FIXUID:-1000}:${FIXGID:-1000}
    # Latest version: https://github.com/charmbracelet/vhs/pkgs/container/vhs
    image: ghcr.io/charmbracelet/vhs:v0.11.0
    working_dir: /src/docs/demo
    environment:
      # The image expects root; ttyd needs a writable HOME under the host user.
      HOME: /tmp
      # Required even though the recording only reads: labelsync has no
      # anonymous path, and `gh` is not installed here to resolve one.
      GH_TOKEN: ${GH_TOKEN:-}
    volumes:
      - .:/src
      - ./dev:/usr/local/bin:ro

  bats:
    profiles: ["image"]
    user: ${FIXUID:-1000}:${FIXGID:-1000}
    build:
      context: .
      dockerfile: Dockerfile
      target: bats
    working_dir: ${PWD}
    environment:
      HOME: /tmp
      DOCKER_HOST: tcp://docker-socket-proxy:2375
      TMPDIR: /tmp/labelsync-image-smoke
    depends_on:
      - docker-socket-proxy
    volumes:
      - ${PWD}:${PWD}
      - /tmp/labelsync-image-smoke:/tmp/labelsync-image-smoke

  docker-socket-proxy:
    profiles: ["image"]
    # Latest version: https://hub.docker.com/r/tecnativa/docker-socket-proxy/tags
    image: tecnativa/docker-socket-proxy:v0.5.0
    environment:
      ALLOW_START: 1
      ALLOW_STOP: 1
      CONTAINERS: 1
      DISTRIBUTION: 1
      IMAGES: 1
      INFO: 1
      NETWORKS: 1
      POST: 1
      VOLUMES: 1
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock

  node:
    profiles: ["markdown"]
    user: ${FIXUID:-1000}:${FIXGID:-1000}
    # Latest version: https://hub.docker.com/_/node/tags
    image: node:24.15.0-bookworm
    working_dir: /src
    environment:
      NPM_CONFIG_CACHE: /cache/npm
    depends_on:
      volume-init:
        condition: service_completed_successfully
    volumes:
      - .:/src
      - cache:/cache

  hadolint:
    profiles: ["lint"]
    user: ${FIXUID:-1000}:${FIXGID:-1000}
    # Latest version: https://hub.docker.com/r/hadolint/hadolint/tags
    image: hadolint/hadolint:v2.14.0
    working_dir: /src
    volumes:
      - .:/src

  golangci-lint:
    profiles: ["lint"]
    user: ${FIXUID:-1000}:${FIXGID:-1000}
    # Latest version: https://hub.docker.com/r/golangci/golangci-lint/tags
    image: golangci/golangci-lint:v2.12.2-alpine
    working_dir: /src
    environment:
      GOCACHE: /cache/go-build
      GOMODCACHE: /cache/go-mod
      GOLANGCI_LINT_CACHE: /cache/golangci-lint
    depends_on:
      volume-init:
        condition: service_completed_successfully
    volumes:
      - .:/src
      - cache:/cache