FROM python:3.12-slim-bookworm@sha256:54c85f3c47607a77f32adec749d3c81d1348bf25833671f512b26a9b6d778cb3 AS wheel
WORKDIR /build
COPY requirements.build.txt ./
RUN python -m pip install --no-cache-dir -r requirements.build.txt
# Allowlisted context: source/docs only, never local secrets or state.
COPY . .
ARG SOURCE_DATE_EPOCH=0
ENV SOURCE_DATE_EPOCH=$SOURCE_DATE_EPOCH
RUN python -m build --no-isolation --outdir /artifacts \
    && python -m twine check --strict /artifacts/* \
    && python scripts/release_artifacts.py /artifacts \
    && python -m pip wheel --no-cache-dir --wheel-dir /wheels '.[test]' \
    && cp /artifacts/*.whl /wheels/

FROM scratch AS artifact
COPY --from=wheel /artifacts/ /

FROM python:3.12-slim-bookworm@sha256:54c85f3c47607a77f32adec749d3c81d1348bf25833671f512b26a9b6d778cb3 AS test
ENV PYTHONDONTWRITEBYTECODE=1 PYTHONUNBUFFERED=1 COVERAGE_FILE=/tmp/.coverage
COPY --from=wheel /wheels /wheels
RUN python -m pip install --no-cache-dir --no-index --find-links=/wheels 'zenmoney-python[test]' \
    && python -m pip check && rm -r /wheels
WORKDIR /tests
COPY tests ./
COPY scripts/live_validation.py scripts/live_basic.py scripts/live_categories.py /tools/
USER 10001:10001
CMD ["sh", "-c", "python -m mypy --strict --cache-dir=/tmp/mypy -p zenmoney_api && python -m mypy --strict --cache-dir=/tmp/mypy /tests/typing_contract.py && python -m pytest -q -p no:cacheprovider --cov=zenmoney_api --cov-report=term-missing /tests"]
