ARG     AWS_ACCOUNT=086679231553

##### prod-deps #####
# Install production dependencies only
####################
FROM    ${AWS_ACCOUNT}.dkr.ecr.us-east-1.amazonaws.com/docker-parent-images:node22 AS prod-deps

WORKDIR /var/app
COPY    .npmrc package.json yarn.lock ./

USER    root
RUN     --mount=type=secret,id=GITHUB_NPM_TOKEN,required=true,uid=1000 \
        GITHUB_NPM_TOKEN=$(cat /run/secrets/GITHUB_NPM_TOKEN) \
        yarn install --frozen-lockfile --production

##### dev-deps #####
# Install all dependencies (incl. devDependencies) and copy in source
####################
FROM    prod-deps AS dev-deps

RUN     --mount=type=secret,id=GITHUB_NPM_TOKEN,required=true,uid=1000 \
        GITHUB_NPM_TOKEN=$(cat /run/secrets/GITHUB_NPM_TOKEN) \
        yarn install --frozen-lockfile
COPY    src ./src

##### builder #####
# Compile TypeScript to build/
####################
FROM    dev-deps AS builder

COPY    tsconfig.json tsconfig.build.json ./
RUN     --mount=type=secret,id=GITHUB_NPM_TOKEN,required=true,uid=1000 \
        GITHUB_NPM_TOKEN=$(cat /run/secrets/GITHUB_NPM_TOKEN) \
        yarn build

##### lint-and-test #####
# Run unit tests and style checks
####################
FROM    dev-deps AS lint-and-test

COPY    lib ./lib
COPY    tests ./tests
COPY    tsconfig.json jest.config.json jest.setup.ts .eslintrc.graphql.js graphql.config.js ./
ENTRYPOINT ["sh", "-c", "yarn test:unit && yarn lint"]

##### deploy #####
# Runtime-only image with minimal surface area
####################
FROM    ${AWS_ACCOUNT}.dkr.ecr.us-east-1.amazonaws.com/docker-parent-images:debian13-node22-hardened AS deploy

WORKDIR /var/app
COPY    --from=prod-deps --chown=node:node /var/app/node_modules ./node_modules
COPY    --from=builder --chown=node:node /var/app/build ./

ENV     PORT=8080
EXPOSE  8080
CMD     ["node", "index.js"]