# syntax=docker/dockerfile:1.7

# ---- builder ---------------------------------------------------------------
FROM python:3.12-slim AS builder

ARG TARGETARCH

COPY --from=ghcr.io/astral-sh/uv:0.8 /uv /uvx /usr/local/bin/

ENV UV_LINK_MODE=copy \
    UV_COMPILE_BYTECODE=1 \
    UV_PYTHON_DOWNLOADS=never

WORKDIR /app

# Install runtime dependencies only. This layer is cached unless uv.lock or
# pyproject.toml change. Metadata is bind-mounted so it does not get baked
# into the layer and invalidate it on unrelated edits.
RUN --mount=type=cache,target=/root/.cache/uv,id=uv-$TARGETARCH \
    --mount=type=bind,source=uv.lock,target=uv.lock \
    --mount=type=bind,source=pyproject.toml,target=pyproject.toml \
    --mount=type=bind,source=README.md,target=README.md \
    uv sync --locked --no-install-project --no-editable --no-dev

# Install the project itself into the venv. Invalidates on source edits.
COPY pyproject.toml uv.lock README.md ./
COPY bitbucket_jira_cli ./bitbucket_jira_cli
RUN --mount=type=cache,target=/root/.cache/uv,id=uv-$TARGETARCH \
    uv sync --locked --no-editable --no-dev

# ---- runtime ---------------------------------------------------------------
FROM python:3.12-slim AS runtime

ENV PYTHONDONTWRITEBYTECODE=1 \
    PYTHONUNBUFFERED=1 \
    PATH="/app/.venv/bin:$PATH" \
    HOME=/data/config \
    XDG_CONFIG_HOME=/data/config \
    BJ_CONFIG_PATH=/data/config/config.json

RUN groupadd --system --gid 1000 bj \
    && useradd  --system --uid 1000 --gid bj --home-dir /data/config --shell /usr/sbin/nologin bj \
    && mkdir -p /data/config \
    && chown -R bj:bj /data

# Copy only the venv, not the source. `--no-editable` made the install
# self-contained so the source tree is not needed at runtime.
COPY --from=builder /app/.venv /app/.venv

USER bj
WORKDIR /data

ENTRYPOINT ["bj"]
CMD ["--help"]
