# Stage 1: Build
FROM python:3.11-slim AS builder

WORKDIR /app

COPY pyproject.toml README.md LICENSE ./
COPY src/ src/

RUN pip install --no-cache-dir build && python -m build --wheel

# Stage 2: Runtime
FROM python:3.11-slim

WORKDIR /app

RUN groupadd -r aegis && useradd -r -g aegis aegis

COPY --from=builder /app/dist/*.whl /tmp/
RUN pip install --no-cache-dir /tmp/*.whl[api,scoring,db] && rm /tmp/*.whl

COPY benchmarks/ benchmarks/

USER aegis

EXPOSE 8000

HEALTHCHECK --interval=30s --timeout=5s --retries=3 \
  CMD python -c "import httpx; httpx.get('http://localhost:8000/health').raise_for_status()"

ENTRYPOINT ["uvicorn", "aegis.api.app:app", "--host", "0.0.0.0", "--port", "8000"]
