ARG AWS_ACCOUNT=086679231553

FROM ${AWS_ACCOUNT}.dkr.ecr.us-east-1.amazonaws.com/docker-parent-images:debian13-python314 AS base

USER root

# libnghttp2-14 is pinned to a security-patched version as a temporary fix for
# CVE-2026-27135. Remove the pin once the parent image (debian13-python314)
# ships libnghttp2-14 >= 1.64.0-1.1+deb13u1.
# https://security-tracker.debian.org/tracker/CVE-2026-27135
#
# libgnutls30 is pinned to a security-patched version as a temporary fix for
# CVE-2026-33845 and CVE-2026-42010 (CRITICAL), plus CVE-2026-33846,
# CVE-2026-3833, CVE-2026-42011, CVE-2026-42009 (HIGH). Remove the pin once
# the parent image (debian13-python314) ships libgnutls30 >= 3.8.9-3+deb13u4.
# https://security-tracker.debian.org/tracker/source-package/gnutls28 (aggregates all six)
#
# ffmpeg backs the loudness/true-peak checks (`ffmpeg loudnorm`). Debian's package
# pulls librist4 -> libmbedcrypto16, whose unfixed CVEs (CVE-2026-34876 /
# CVE-2026-25835 / CVE-2026-34874) are excepted in lambda-assets/Jenkinsfile
# (lambdaVulnerabilityMap['spatial_audio_validation']); librist is the RIST network
# protocol this worker never uses. https://security-tracker.debian.org/tracker/source-package/mbedtls
RUN apt-get update && apt-get install -y --no-install-recommends \
    mediainfo=25.04-1 \
    ffmpeg=7:7.1.5-0+deb13u1 \
    libnghttp2-14=1.64.0-1.1+deb13u1 \
    libgnutls30=3.8.9-3+deb13u4 \
    && rm -rf /var/lib/apt/lists/*

COPY --from=ghcr.io/astral-sh/uv:0.11.14 /uv /bin/

WORKDIR /app
ENV PATH="/app/.venv/bin:$PATH"
COPY pyproject.toml uv.lock ./


FROM hadolint/hadolint:v2.12.0-alpine AS hadolint
FROM koalaman/shellcheck:v0.10.0 AS shellcheck


FROM base AS unit-lint

RUN --mount=type=cache,target=/root/.cache/uv \
    uv sync --frozen --group dev

COPY --from=hadolint /bin/hadolint /usr/bin/hadolint
COPY --from=shellcheck /bin/shellcheck /usr/bin/shellcheck

COPY src/ ./src/
COPY tests/ ./tests/
COPY dev/ ./dev/
COPY .hadolint.yaml .yamllint.yaml docker-compose.yaml software-catalog.yaml Dockerfile lint-and-test.sh ./

ENTRYPOINT ["./lint-and-test.sh"]


FROM base AS dev

RUN --mount=type=cache,target=/root/.cache/uv \
    uv sync --frozen --group dev
COPY src/ ./src/
COPY tests/ ./tests/
COPY dev/ ./dev/

USER worker

ENTRYPOINT []


FROM base AS deploy

RUN --mount=type=cache,target=/root/.cache/uv \
    uv sync --frozen && rm -f /bin/uv /bin/uvx
COPY src/ ./src/

USER worker

# `ddtrace-run` execs into python, so Python ends up as PID 1 and
# receives Fargate's SIGTERM directly — no shell wrapper to swallow it.
CMD ["ddtrace-run", "python", "-m", "src.app"]