FROM node:22-slim AS web-build
WORKDIR /web
COPY web/package.json web/package-lock.json ./
RUN npm ci
COPY web/ ./
RUN npm run build

FROM python:3.12-slim
WORKDIR /app

RUN pip install --no-cache-dir uv

# The lockfile is the workspace root's, so this mirrors the repository layout
# rather than copying api/ alone.
COPY pyproject.toml uv.lock ./
COPY api/pyproject.toml ./api/pyproject.toml
# --no-install-workspace: the member's source is not in this layer yet, and
# without it uv tries to build code-massager and fails. The second sync
# below installs it once the source is present, and is nearly free.
RUN uv sync --frozen --no-dev --no-install-workspace

COPY api/entrypoint.sh ./api/entrypoint.sh
COPY api/src ./api/src
# The member's version and readme are dynamic, resolved by api/hatch_build.py
# from these two root files, so the sync below cannot build it without all
# three present.
COPY api/hatch_build.py ./api/hatch_build.py
COPY RELEASE_VERSION README.md ./
# A license-files glob matching nothing does not fail the build, so without this
# the image would silently install a distribution carrying no licence.
COPY api/LICENSE ./api/LICENSE
COPY --from=web-build /api/src/web_dist ./api/static
RUN uv sync --frozen --no-dev

# BASE_DIR resolves to the directory holding static/, and `python -m src.manage`
# resolves `src` from the working directory, so both follow the source here.
WORKDIR /app/api

# Bake static assets into the image at build time so every pod serves them via
# WhiteNoise without running collectstatic at startup. The three values below
# are throwaways, safe because collectstatic opens no database connection, so
# none of them is ever dereferenced; and they are set on the command rather than
# via ENV so they exist for this layer only and no running container can inherit
# them. CACHE_URL is the one that is genuinely used: settings constructs the
# store at import, so a build-scoped cache directory is created and left in the
# layer rather than the default one a running container would want.
RUN DJANGO_SECRET_KEY=build \
    DATABASE_URL=postgresql://build:build@localhost:5432/build \
    CACHE_URL=file:/tmp/code-massager-build \
    uv run python -m src.manage collectstatic --no-input

ARG GIT_COMMIT=""
ENV GIT_COMMIT=${GIT_COMMIT}
EXPOSE 8000
CMD ["sh", "entrypoint.sh"]
