FROM python:3.12-alpine3.23@sha256:31a768b01976652c222e318fe5bd6e7c252f056cbf489c88fa256f1bf0af58e3 AS build

WORKDIR /build
RUN apk add --no-cache \
      "libcrypto3=3.5.8-r0" \
      "libssl3=3.5.8-r0" \
      "sqlite-libs=3.53.4-r0" \
    && pip install --no-cache-dir "build==1.3.0" "uv==0.11.24"
COPY pyproject.toml uv.lock README.md LICENSE ./
COPY src ./src
RUN uv lock --check \
    && uv export --quiet --locked --no-sources --no-dev --no-editable --no-emit-project \
      --format requirements-txt --output-file /build/runtime-requirements.txt \
    && python -m build --wheel

FROM python:3.12-alpine3.23@sha256:31a768b01976652c222e318fe5bd6e7c252f056cbf489c88fa256f1bf0af58e3 AS runtime

ENV HOME=/tmp \
    PIP_DISABLE_PIP_VERSION_CHECK=1 \
    PIP_NO_CACHE_DIR=1 \
    PYTHONDONTWRITEBYTECODE=1 \
    PYTHONUNBUFFERED=1 \
    XDG_CACHE_HOME=/tmp/.cache

RUN apk add --no-cache \
      "libcrypto3=3.5.8-r0" \
      "libssl3=3.5.8-r0" \
      "sqlite-libs=3.53.4-r0" \
    && addgroup -S -g 65532 app \
    && adduser -S -D -H -u 65532 -G app app
WORKDIR /app
COPY --from=build /build/runtime-requirements.txt /tmp/runtime-requirements.txt
COPY --from=build /build/dist/*.whl /tmp/
RUN pip install --no-cache-dir --no-compile --only-binary=:all: --require-hashes \
      --requirement /tmp/runtime-requirements.txt \
    && pip install --no-cache-dir --no-compile --no-deps \
      /tmp/paper_scoring_pipeline-*.whl \
    && rm /tmp/paper_scoring_pipeline-*.whl /tmp/runtime-requirements.txt
USER 65532:65532
ENTRYPOINT ["paper-scoring-pipeline"]
