# github action doesn't have access to our private ECR registry, so I'm using
# the public uv image instead of our docker-parent-images base.
#
# The GitHub Action (action.yml: image: Dockerfile) always builds the FINAL
# stage, so `runtime` must stay last. CI builds the earlier `unit-lint` stage
# explicitly via docker-compose (--target unit-lint).
#
# Targets:
#   base       – uv + managed Python 3.14 (internal, shared)
#   builder    – installs runtime deps (internal)
#   base-dev   – base + dev deps (internal, shared by CI targets)
#   unit-lint  – runs ruff/ty/vulture/pytest in CI (used by docker-compose)
#   runtime    – distroless image the GitHub Action runs (final / default)

###############################################################################
### Base image: uv + managed Python 3.14, shared by every downstream stage  ###
###############################################################################
FROM ghcr.io/astral-sh/uv:trixie-slim AS base

RUN         apt-get update \
              && apt-get install -y --no-install-recommends build-essential libffi-dev \
              && apt-get clean \
              && rm -rf /var/lib/apt/lists/*

ENV         UV_COMPILE_BYTECODE=1 \
            UV_LINK_MODE=copy \
            UV_PYTHON_INSTALL_DIR=/python \
            UV_PYTHON_PREFERENCE=only-managed

RUN         uv python install 3.14

WORKDIR     /app

#################################
### Builder image for runtime ###
#################################
FROM        base AS builder

RUN         --mount=type=cache,target=/root/.cache/uv \
            --mount=type=bind,source=uv.lock,target=uv.lock \
            --mount=type=bind,source=pyproject.toml,target=pyproject.toml \
            uv sync --frozen --no-install-project --no-dev --no-editable

COPY        ./stale_pr_review /app/stale_pr_review

#####################################################
### Base dev image: base + dev tooling for CI     ###
#####################################################
FROM        base AS base-dev

RUN         --mount=type=cache,target=/root/.cache/uv \
            --mount=type=bind,source=uv.lock,target=uv.lock \
            --mount=type=bind,source=pyproject.toml,target=pyproject.toml \
            uv sync --frozen --no-install-project

COPY        ./pyproject.toml ./uv.lock ./
COPY        ./stale_pr_review /app/stale_pr_review
COPY        ./tests /app/tests

##############################################################
### CI unit-lint image: ruff, ty, vulture, and the tests   ###
##############################################################
FROM        base-dev AS unit-lint

COPY        ./scripts/unit-lint.sh /app/scripts/unit-lint.sh

ENTRYPOINT  ["scripts/unit-lint.sh"]

###################################################################
### Runtime image the GitHub Action runs (MUST stay last/final) ###
###################################################################
FROM        gcr.io/distroless/base-debian12:nonroot AS runtime

COPY        --from=builder --chown=nonroot:nonroot /python /python

WORKDIR     /app

COPY        --from=builder --chown=nonroot:nonroot /app/ /app/

ENV         PYTHONPATH=/app \
            PATH="/app/.venv/bin:$PATH"

ENTRYPOINT  ["python"]