# Self-contained image for offline / CI scanning.
# Python 3.13 (GuardDog's pygit2 has no 3.14 wheel). Installing the package pulls
# the core engines (Semgrep + GuardDog) as dependencies. malcontent (--with-malcontent)
# is an optional Go binary and is intentionally not bundled.
FROM python:3.13-slim

LABEL org.opencontainers.image.title="malware-detector" \
      org.opencontainers.image.description="Multi-language malware detector (JS/TS/Python/PHP)" \
      org.opencontainers.image.licenses="MIT"

# Install exactly the versions pinned (with hashes) in uv.lock into /opt/venv.
# --no-editable copies the package into the venv, so /app is only a build input.
COPY --from=ghcr.io/astral-sh/uv:0.12.21 /uv /bin/uv
ENV UV_PROJECT_ENVIRONMENT=/opt/venv \
    UV_PYTHON_DOWNLOADS=never \
    UV_COMPILE_BYTECODE=1 \
    UV_LINK_MODE=copy
WORKDIR /app
COPY . /app
RUN uv sync --locked --no-dev --no-editable && rm -rf /root/.cache
ENV PATH="/opt/venv/bin:$PATH"

# Run as non-root against a read-only mount of the target repo.
RUN useradd --create-home scanner
USER scanner
WORKDIR /scan

ENTRYPOINT ["malware-detector"]
CMD ["scan", "."]
