#syntax=docker/dockerfile:1.19.0-labs@sha256:dce1c693ef318bca08c964ba3122ae6248e45a1b96d65c4563c8dc6fe80349a2

ARG PYTHON_BASE_IMAGE=dhi.io/python:3.13-dev@sha256:d13087cbaf5f8c68c4baac88ea22e4a5f87ac179a9e7004f3484558154b2e344

FROM ghcr.io/astral-sh/uv:0.12.23@sha256:61d393e44e249f2e4b526b6c7ddcecce245946826e608e11c93ad4f5bba55b21 AS uv

FROM ${PYTHON_BASE_IMAGE} AS python
ARG UV_PROJECT_ENVIRONMENT=/opt/python
ENV PATH="${UV_PROJECT_ENVIRONMENT}/bin:$PATH"

FROM python AS builder
RUN --mount=type=cache,target=/var/lib/apt/lists,sharing=locked \
    --mount=type=cache,target=/var/cache/apt,sharing=locked \
    apt-get update \
 && apt-get install -y --no-install-recommends git

COPY --from=uv /uv /uvx /usr/local/bin/
ENV UV_COMPILE_BYTECODE=1
ENV UV_LINK_MODE=copy

# Third-party deps only: hawk and the module are installed by the prod stage
# from the real sources, so their edits do not invalidate this layer. hawk's
# pyproject.toml is all uv needs to validate the lock.
WORKDIR /source
COPY --parents \
    pyproject.toml \
    services/modules/sample_editor/pyproject.toml \
    services/modules/sample_editor/uv.lock \
    ./

WORKDIR /source/services/modules/sample_editor
RUN --mount=type=cache,target=/root/.cache/uv \
    uv sync \
        --locked \
        --no-dev \
        --no-editable \
        --no-install-project \
        --no-install-package hawk

FROM builder AS builder-test
RUN --mount=type=cache,target=/root/.cache/uv \
    uv sync \
        --all-extras \
        --locked \
        --no-editable \
        --no-install-project \
        --no-install-package hawk

FROM python AS prod
WORKDIR /home/nonroot/app
# DHI provides this account; public Python bases used by CI do not.
RUN if ! id nonroot >/dev/null 2>&1; then \
        apt-get update \
        && apt-get install -y --no-install-recommends passwd \
        && groupadd --gid 65532 nonroot \
        && useradd --uid 65532 --gid nonroot --create-home nonroot \
        && chown nonroot:nonroot /home/nonroot \
        && rm -rf /var/lib/apt/lists/*; \
    fi \
 && chown nonroot:nonroot /home/nonroot/app

COPY --from=builder ${UV_PROJECT_ENVIRONMENT} ${UV_PROJECT_ENVIRONMENT}
COPY --chown=nonroot:nonroot services/modules/sample_editor services/modules/sample_editor
# The git-sourced deps keep their installer metadata, so this sync sees them as
# installed and only adds hawk and the module. --reinstall-package guards
# against a stale hawk wheel in a persistent uv cache mount.
RUN --mount=type=cache,target=/root/.cache/uv \
    --mount=type=bind,from=uv,source=/uv,target=/usr/local/bin/uv \
    --mount=type=bind,source=hawk,target=/home/nonroot/app/hawk \
    --mount=type=bind,source=hawk_flags,target=/home/nonroot/app/hawk_flags \
    --mount=type=bind,source=pyproject.toml,target=/home/nonroot/app/pyproject.toml \
    --mount=type=bind,source=README.md,target=/home/nonroot/app/README.md \
    UV_COMPILE_BYTECODE=1 UV_LINK_MODE=copy \
    uv sync \
        --locked \
        --no-dev \
        --no-editable \
        --project services/modules/sample_editor \
        --reinstall-package hawk \
        --reinstall-package sample-editor

USER nonroot
ENTRYPOINT ["python", "-m", "sample_editor"]

FROM prod AS test
COPY --from=builder-test --chown=nonroot:nonroot ${UV_PROJECT_ENVIRONMENT} ${UV_PROJECT_ENVIRONMENT}
COPY --chown=nonroot:nonroot services/modules/sample_editor/sample_editor ./sample_editor
COPY --chown=nonroot:nonroot services/modules/sample_editor/tests ./tests

ENTRYPOINT ["python", "-m"]
CMD ["pytest", "tests"]
