# Both bases are resolved and validated by the CLI before this build starts.
ARG BUILDER=scratch
ARG RUNTIME=scratch
FROM ${BUILDER} AS build
ARG RUNTIME=scratch
ARG ACTION_PLATFORM
ARG RUNTIME_IDENTITY
ENV ACTION_BASE=${RUNTIME_IDENTITY} ACTION_PLATFORM=${ACTION_PLATFORM}
COPY metadata/ /metadata/
# BEGIN dependencies
RUN --mount=type=cache,target=/root/.cache/pip \
    python -m apagea.actions.build_dependencies /metadata/pyproject.toml --build-only > /metadata/requirements.txt && \
    if [ -f /metadata/uv.lock ]; then \
      cd /metadata && UV_PYTHON_DOWNLOADS=never uv export --locked --no-dev --no-emit-project --no-emit-package apagea --no-editable --format requirements-txt --output-file /metadata/locked.txt >/dev/null && \
      pip install --constraint /opt/apagea/constraints.txt -r /metadata/locked.txt && \
      python -m apagea.actions.build_dependencies --constraints > /metadata/constraints.txt && \
      pip install --constraint /opt/apagea/constraints.txt --constraint /metadata/constraints.txt -r /metadata/requirements.txt; \
    else pip install --constraint /opt/apagea/constraints.txt -r /metadata/requirements.txt; fi
# END dependencies
COPY source/ /source/
ARG DEVELOPMENT=false
ARG DIAGNOSTICS=detailed
RUN --mount=type=cache,target=/root/.cache/pip pip install --constraint /opt/apagea/constraints.txt $(if [ -f /metadata/locked.txt ]; then printf "%s" "--constraint /metadata/constraints.txt"; fi) --no-build-isolation /source && if [ "$DEVELOPMENT" = "true" ]; then python -m apagea.actions.development --build /source --diagnostics "$DIAGNOSTICS"; else python -m apagea.actions build /source; fi && pip check
RUN pip uninstall -y pip setuptools wheel
FROM ${RUNTIME}
COPY --from=build /opt/venv /opt/venv
COPY --from=build /opt/apagea/action /opt/apagea/action
USER 65532:65532
WORKDIR /tmp
ENTRYPOINT ["python", "-m", "apagea.actions"]
