# python:3.12.13-slim-bookworm
FROM python@sha256:8a7e7cc04fd3e2bd787f7f24e22d5d119aa590d429b50c95dfe12b3abe52f48b AS python-base

ARG PIP_VERSION=26.1.2

RUN python3 -m pip install --no-cache-dir --upgrade "pip==${PIP_VERSION}"

# CVE-2026-8643: base image ships pip 25.0.1; pip is pinned via PIP_VERSION above.

ENV PYTHONUNBUFFERED=true \
    POETRY_VERSION=2.3.0 \
    POETRY_VIRTUALENVS_IN_PROJECT=true \
    POETRY_NO_INTERACTION=1 \
    PYSETUP_PATH="/opt/pysetup" \
    VENV_PATH="/opt/pysetup/.venv" \
    DBT_PACKAGES_INSTALL_PATH="/opt/pysetup/dbt_packages"

ENV PATH="$VENV_PATH/bin:$PATH"

FROM python-base AS builder-base

RUN apt-get update \
    && apt-get install --no-install-recommends -y build-essential \
    && apt-get clean \
    && rm -rf /var/lib/apt/lists/* \
    && python3 -m pip install --no-cache-dir "poetry==${POETRY_VERSION}"

WORKDIR $PYSETUP_PATH

COPY poetry.lock pyproject.toml dbt_project.yml ./

# Install project related packages
RUN poetry install --only main --no-root

# Install dbt related packages
RUN dbt deps

### Deploy layer ###
FROM python-base AS deploy

COPY --from=builder-base $PYSETUP_PATH $PYSETUP_PATH

ADD . /var/app
RUN chmod +x /var/app/scripts/dbt-run.sh
WORKDIR /var/app

# Install dbt related packages
RUN dbt deps

ENTRYPOINT  ["/var/app/scripts/dbt-run.sh"]