# This is a Dockerfile with multiple 'stages', you can target a specific stage
# using Docker's 'target' option. For example if you wanted to use the container
# to run run unit tests you'd want to target the 'development' stage. Whereas
# if you wanted to build a light-weight production image you'd leave target
# undefined or set to 'production'.

# Stage 1
FROM node:24.18.0-alpine AS development

ARG GIT_COMMIT=unknown

ENV GIT_COMMIT=$GIT_COMMIT
ENV POEDITOR_PROJECT_ID=523757

# install curl and ca-certificates to download the RDS global bundle and add it to the image's trusted certs. 
# This is required to connect to RDS databases with SSL enabled.
RUN apk update \
    && apk --no-cache upgrade \
    && apk --no-cache add curl bash ca-certificates \
    && curl https://truststore.pki.rds.amazonaws.com/global/global-bundle.pem \
          -o /etc/ssl/certs/rds-global-bundle.pem \
    && update-ca-certificates \
    && rm -rf /var/cache/apk/*

WORKDIR /home/node/app

# copy just what we need to install dependencies
COPY package.json .
COPY pnpm-lock.yaml .
COPY pnpm-workspace.yaml .
COPY .npmrc .

# install dependencies
RUN corepack enable
RUN --mount=type=secret,id=GITHUB_NPM_TOKEN,required=true,uid=1000 \
    GITHUB_NPM_TOKEN="$(cat /run/secrets/GITHUB_NPM_TOKEN)" pnpm install --frozen-lockfile

# copy in all project files
COPY . .

# Stage 2
FROM development AS production-build

# download translations from poeditor
RUN --mount=type=secret,id=POEDITOR_API_TOKEN \
    POEDITOR_API_TOKEN="$(cat /run/secrets/POEDITOR_API_TOKEN)" pnpm i18n:sync

# build a production app
RUN pnpm build

# remove dev dependencies after build
RUN pnpm prune --prod

# Stage 3
FROM node:24.18.0-alpine

# NOTE: in multistage docker build ARG/ENV only persist for the stage
# in which they are defined. We need `GIT_COMMIT` to be available in
# the final runtime so it must be defined in the last build stage.
ARG GIT_COMMIT=unknown
ARG DD_VERSION=1.0.0
ENV GIT_COMMIT=$GIT_COMMIT
ENV DD_VERSION=$DD_VERSION
ENV NODE_ENV=production

COPY --from=production-build /etc/ssl/certs/rds-global-bundle.pem /etc/ssl/certs/rds-global-bundle.pem

RUN apk update \
    && apk --no-cache upgrade \
    && apk --no-cache add ca-certificates \
    && apk --no-cache add curl \
    && update-ca-certificates \
    && rm -rf /usr/local/lib/node_modules/npm /usr/local/bin/npm /usr/local/bin/npx \
    && rm -rf /usr/local/lib/node_modules/corepack /usr/local/bin/corepack \
    && rm -rf /usr/local/bin/yarn /usr/local/bin/yarnpkg /usr/local/bin/pnpm /usr/local/bin/pnpx

WORKDIR /home/node/app

# Hand pick the final compiled .js leaving the .ts source files behind in the
# previous stage. This means that the final production image is as lean as possible.
COPY --from=production-build /home/node/app/.built .
COPY --from=production-build /home/node/app/node_modules ./node_modules
COPY --from=production-build /home/node/app/package.json .

# migrations are required in final production
# image so clients can run schema/data migrations
COPY --from=production-build /home/node/app/migrations ./migrations

# The compiled output is copied directly into WORKDIR (not into .built/),
# so we invoke index.js directly.
CMD ["node", "--max-http-header-size=1000000", "--require", "dd-trace/init", "index.js"]