From 56daf61290f56226ec397d3d1b218a95eccb75c4 Mon Sep 17 00:00:00 2001
From: Djeex <djeex@djeex.fr>
Date: Sat, 22 Aug 2026 23:50:40 +0200
Subject: [PATCH] Multi-stage Dockerfile: pin base image, add test/lint stages

Pin alpine:latest to the full patch-level tag alpine:3.22.1 so Renovate
can classify patch/minor/major bumps on it. Add a `test` stage (bats)
and a `lint` stage (shellcheck, severity=error) that build from `base`
before ENTRYPOINT is set, so CI can run them without an --entrypoint
override. A trailing `FROM base` keeps the lean prod image as the
default `docker build .` target despite the extra stages.
---
 Dockerfile | 20 ++++++++++++++++++--
 1 file changed, 18 insertions(+), 2 deletions(-)

diff --git a/Dockerfile b/Dockerfile
index 21ceff2..4620787 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,4 +1,4 @@
-FROM alpine:latest
+FROM alpine:3.22.1 AS base
 
 RUN apk add --no-cache socat netcat-openbsd \
     && rm -rf /var/cache/apk/* /tmp/*
@@ -7,4 +7,20 @@ COPY entrypoint.sh VERSION /
 RUN mkdir -p /socket \
     && chmod +x /entrypoint.sh
 
-ENTRYPOINT ["/entrypoint.sh"]
\ No newline at end of file
+FROM base AS test
+
+RUN apk add --no-cache bats bash procps
+
+WORKDIR /app
+COPY entrypoint.sh VERSION /app/
+COPY tests/ /app/tests/
+
+FROM base AS lint
+
+RUN apk add --no-cache shellcheck
+RUN shellcheck --severity=error -s sh /entrypoint.sh
+
+# Kept as the last stage so `docker build .` (no --target) still produces
+# the lean prod image, not the `test`/`lint` stages above.
+FROM base
+ENTRYPOINT ["/entrypoint.sh"]