# Lint phase. The linter is invoked directly rather than through `make
# lint` or `script/lint`, which are themselves a docker build and would
# recurse into a daemon that does not exist in a build step.
#
# golangci/golangci-lint:v2.12.2, 2026-11-02
FROM golangci/golangci-lint@sha256:5cceeef04e53efe1470638d4b4b4f5ceefd574955ab3941b2d9a68a8c9ad5240 AS lint

WORKDIR /src

COPY go.mod go.sum ./
RUN go mod download

COPY . .

RUN golangci-lint run --config .golangci.yml ./...

# Test phase, invoked directly for the same reason. The Debian image has
# the C compiler the race detector needs.
#
# golang:1.27.3-trixie, 2026-11-02. It carries the Go that
# script/bootstrap installs on the host; change both together, and the
# same image in the last stage.
FROM golang@sha256:c65ecfe613b539ac74c62a4c3b2c27e8f8a6076384c8f27e8a3c0f3be17cc385 AS test

WORKDIR /src

COPY go.mod go.sum ./
RUN go mod download

COPY . .

RUN go test -count=1 -timeout 90s -race -cover ./... || \
    { echo "--- Rerunning with -v for details ---"; \
      go test -count=1 -timeout 90s -race -v ./...; exit 1; }

# Development environment, and the last stage: a plain `docker build .`
# names no target and so builds this one. Nothing is wanted from the two
# phases above; the copies are what make BuildKit build them first, so
# this image cannot be produced unless lint and test passed. A stage
# appended after this one would drop all three out of a plain build.
#
# golang:1.27.3-trixie, 2026-11-02
FROM golang@sha256:c65ecfe613b539ac74c62a4c3b2c27e8f8a6076384c8f27e8a3c0f3be17cc385

COPY --from=lint /src/go.sum /dev/null
COPY --from=test /src/go.sum /dev/null

WORKDIR /src

# script/bootstrap finds its pinned Go already in this image. It installs
# the Go modules and the tools for formatting Markdown. Debian is used
# here because the node it installs needs glibc.
COPY script/ script/
COPY package.json yarn.lock go.mod go.sum ./
RUN script/bootstrap

COPY . .

RUN script/build

# The version is computed on the host and passed in, because
# .dockerignore excludes .git.
ARG VERSION=dev
LABEL org.opencontainers.image.version="${VERSION}"