#syntax=docker/dockerfile:1.19.0-labs

ARG REGISTRY=dhi.io/
ARG DHI_PYTHON_VERSION=3.13
ARG UV_VERSION=0.12.3

FROM ghcr.io/astral-sh/uv:${UV_VERSION} AS uv

FROM ${REGISTRY}python:${DHI_PYTHON_VERSION}-dev AS python
ARG UV_PROJECT_ENVIRONMENT=/opt/python
ENV PATH="${UV_PROJECT_ENVIRONMENT}/bin:$PATH"

FROM python AS builder
RUN --mount=type=cache,target=/var/lib/apt/lists,sharing=locked \
    --mount=type=cache,target=/var/cache/apt,sharing=locked \
    apt-get update \
 && apt-get install -y --no-install-recommends git

COPY --from=uv /uv /uvx /usr/local/bin/
ENV UV_COMPILE_BYTECODE=1
ENV UV_LINK_MODE=copy

# Third-party deps only: hawk and the module are installed by the prod stage
# from the real sources, so their edits do not invalidate this layer. hawk's
# pyproject.toml is all uv needs to validate the lock.
WORKDIR /source
COPY --parents \
    pyproject.toml \
    services/modules/sample_editor/pyproject.toml \
    services/modules/sample_editor/uv.lock \
    ./

WORKDIR /source/services/modules/sample_editor
RUN --mount=type=cache,target=/root/.cache/uv \
    uv sync \
        --locked \
        --no-dev \
        --no-editable \
        --no-install-project \
        --no-install-package hawk

FROM builder AS builder-test
RUN --mount=type=cache,target=/root/.cache/uv \
    uv sync \
        --all-extras \
        --locked \
        --no-editable \
        --no-install-project \
        --no-install-package hawk

FROM python AS prod
WORKDIR /home/nonroot/app
RUN chown nonroot:nonroot /home/nonroot/app

COPY --from=builder ${UV_PROJECT_ENVIRONMENT} ${UV_PROJECT_ENVIRONMENT}
COPY --chown=nonroot:nonroot services/modules/sample_editor services/modules/sample_editor
# The git-sourced deps keep their installer metadata, so this sync sees them as
# installed and only adds hawk and the module. --reinstall-package guards
# against a stale hawk wheel in a persistent uv cache mount.
RUN --mount=type=cache,target=/root/.cache/uv \
    --mount=type=bind,from=uv,source=/uv,target=/usr/local/bin/uv \
    --mount=type=bind,source=hawk,target=/home/nonroot/app/hawk \
    --mount=type=bind,source=pyproject.toml,target=/home/nonroot/app/pyproject.toml \
    --mount=type=bind,source=README.md,target=/home/nonroot/app/README.md \
    UV_COMPILE_BYTECODE=1 UV_LINK_MODE=copy \
    uv sync \
        --locked \
        --no-dev \
        --no-editable \
        --project services/modules/sample_editor \
        --reinstall-package hawk \
        --reinstall-package sample-editor

USER nonroot
ENTRYPOINT ["python", "-m", "sample_editor"]

FROM prod AS test
COPY --from=builder-test --chown=nonroot:nonroot ${UV_PROJECT_ENVIRONMENT} ${UV_PROJECT_ENVIRONMENT}
COPY --chown=nonroot:nonroot services/modules/sample_editor/sample_editor ./sample_editor
COPY --chown=nonroot:nonroot services/modules/sample_editor/tests ./tests

ENTRYPOINT ["python", "-m"]
CMD ["pytest", "tests"]
