FROM        086679231553.dkr.ecr.us-east-1.amazonaws.com/docker-parent-images:node24 AS prod-deps
# Copy app and install production dependencies
WORKDIR     /var/app
COPY        .npmrc package.json yarn.lock apollo.config.js tsconfig.json tsconfig.build.json codegen.yml ./
RUN         --mount=type=secret,id=GITHUB_NPM_TOKEN,required=true,uid=1000 GITHUB_NPM_TOKEN=$(cat /run/secrets/GITHUB_NPM_TOKEN) yarn --frozen-lockfile --production=true


##### dev-deps #####
# Install dev dependencies, and copy in source.
####################
FROM        prod-deps AS dev-deps
RUN         --mount=type=secret,id=GITHUB_NPM_TOKEN,required=true,uid=1000 GITHUB_NPM_TOKEN=$(cat /run/secrets/GITHUB_NPM_TOKEN) yarn --frozen-lockfile --production=false
COPY        src ./src


##### dev #######
# Run as a hot-reloading service.
#################
FROM        dev-deps AS dev
COPY        nodemon.json ./
ENV         PORT 8080
EXPOSE      8080
ENTRYPOINT  ["yarn", "start"]


##### lint-and-test #####
# Install unit testing and linting configs
# and configure to run tests
#########################
FROM        dev-deps AS lint-and-test

COPY        eslint.config.mjs jest.config.json jest-transform-sql.js graphql-schema-linter.config.js \
            graphql-schema-linter.config.js apollo.test.config.js ./

COPY        tests ./tests
COPY        lib ./lib

ENTRYPOINT  ["yarn", "check:lint:unit"]


##### integration-tests #####
# Install unit testing and linting configs
# and configure to run tests
#############################
FROM        lint-and-test AS integration-tests
COPY        codegen.test.yml ./

# this needs for `yarn generate:types:integration` to gave user permissions to write file
USER        root
RUN         chown -R node:node /var/app/tests/definitions/index.ts
USER        node

ENTRYPOINT  ["yarn", "test:integration"]


##### build-artifacts #####
# Build production-ready artifacts
###########################
FROM        dev-deps AS build-artifacts

# this needs for `yarn generate:types:integration` to gave user permissions to write file
USER        root
RUN         chown -R node:node /var/app/src/generated/index.ts
USER        node

RUN         --mount=type=secret,id=GITHUB_NPM_TOKEN,required=true,uid=1000 GITHUB_NPM_TOKEN=$(cat /run/secrets/GITHUB_NPM_TOKEN) yarn build


##### deploy #####
# Grab production node dependencies and
# production build artifacts
# and run as a service.
##################
FROM        086679231553.dkr.ecr.us-east-1.amazonaws.com/docker-parent-images:node24 AS deploy

# We need this to fix this vulnerability https://security-tracker.debian.org/tracker/CVE-2024-0567
# the discussion https://orcd.slack.com/archives/C01CKTXANBW/p1709561466855099
USER        root
RUN         apt-get -y update && apt-get -y upgrade && apt-get -y clean && rm -rf /var/lib/apt/lists/*
USER        node

WORKDIR     /var/app
# Copy production dependencies
COPY        --from=prod-deps --chown=node:node /var/app/package.json ./
COPY        --from=prod-deps --chown=node:node /var/app/node_modules ./node_modules
# Copy build
COPY        --from=build-artifacts --chown=node:node /var/app/build ./
COPY        --from=build-artifacts --chown=node:node /var/app/build/schema ./src/schema

ENV         PORT 8080
EXPOSE      8080
CMD         ["node", "index.js"]