FROM 086679231553.dkr.ecr.us-east-1.amazonaws.com/docker-parent-images:debian13-php84 AS base

USER root

RUN apt-get update && apt-get --no-install-recommends install -y \
    curl \
    git \
    unzip \
    zip \
    && apt-get clean \
    && rm -rf /var/lib/apt/lists/*

ENV APP_HOME=/var/app
RUN mkdir -p "$APP_HOME" \
    && chown -R worker:worker "$APP_HOME" \
    && chmod 755 "$APP_HOME"

USER worker
WORKDIR $APP_HOME

FROM base AS deps-update
WORKDIR $APP_HOME
USER root

COPY composer.json $APP_HOME/
COPY build/update_composer_lock.sh $APP_HOME/build/

RUN chown -R worker:worker "$APP_HOME" \
    && chmod -R 555 "$APP_HOME"/composer.json "$APP_HOME"/build/update_composer_lock.sh \
    && chmod +x "$APP_HOME"/build/update_composer_lock.sh

USER worker
ENTRYPOINT ["/var/app/build/update_composer_lock.sh"]

FROM base AS dev-deps-install
WORKDIR $APP_HOME
USER root

COPY composer.json composer.lock ./
RUN chown -R worker:worker "$APP_HOME" \
    && chmod 444 composer.json composer.lock

USER worker
RUN --mount=type=secret,id=github_auth,required,target=$APP_HOME/auth.json,uid=1010,gid=1010,mode=0400 \
    composer install --no-interaction --prefer-dist --optimize-autoloader \
    && composer dump-autoload --optimize

USER root
COPY .php-cs-fixer.dist.php .phpcs.xml.dist phpstan.neon.dist phpunit.xml ./
RUN chmod 444 .php-cs-fixer.dist.php .phpcs.xml.dist phpstan.neon.dist phpunit.xml

FROM dev-deps-install AS code-format
WORKDIR $APP_HOME
USER root

COPY scripts/ ./scripts
COPY src/ ./src
COPY tests/ ./tests
RUN chmod -R 555 scripts src tests \
    && find scripts src tests -type f -exec chmod 444 {} \;

CMD ["composer", "format"]

FROM dev-deps-install AS unit-lint
USER root
RUN apt-get update \
    && apt-get --no-install-recommends install -y \
    php8.4-xdebug \
    && apt-get -y clean \
    && rm -rf /var/lib/apt/lists/*

RUN echo "xdebug.mode=coverage" >> /etc/php/8.4/cli/php.ini

WORKDIR $APP_HOME

COPY build/ ./build
COPY scripts/ ./scripts
COPY src/ ./src
COPY tests/ ./tests
RUN chmod -R 555 build scripts src tests \
    && find build scripts src tests -type f -exec chmod 444 {} \;

CMD ["composer", "check"]

FROM base AS deploy
WORKDIR $APP_HOME
USER root

COPY composer.json composer.lock ./
RUN chmod 444 composer.json composer.lock

USER worker
RUN --mount=type=secret,id=github_auth,required,target=$APP_HOME/auth.json,uid=1010,gid=1010,mode=0400 \
    composer install --no-dev --no-interaction --prefer-dist --optimize-autoloader \
    && composer dump-autoload --optimize

USER root
COPY scripts/ ./scripts
COPY src/ ./src
RUN chmod -R 555 scripts src \
    && find scripts src -type f -exec chmod 444 {} \;
    
COPY deploy/entry_point.sh /usr/local/bin/entry_point.sh
RUN chmod 555 /usr/local/bin/entry_point.sh

STOPSIGNAL SIGWINCH
EXPOSE 8080
USER worker
ENTRYPOINT ["/usr/local/bin/entry_point.sh"]

FROM base AS oauth-bootstrap

WORKDIR $APP_HOME
USER root

# Copy only what is needed for OAuth bootstrap
COPY composer.json composer.lock ./
RUN chmod 444 composer.json composer.lock

USER worker
RUN --mount=type=secret,id=github_auth,required,target=$APP_HOME/auth.json,uid=1010,gid=1010,mode=0400 \
    composer install --no-dev --no-interaction --prefer-dist --optimize-autoloader

USER root
COPY public/ ./public
COPY src/ ./src
RUN chmod -R 555 public src \
    && find public src -type f -exec chmod 444 {} \;

EXPOSE 8080

USER worker
CMD ["php", "-S", "0.0.0.0:8080", "-t", "public"]