# syntax=docker/dockerfile:1

# Lint stage — fast feedback on formatting and lint issues.
# golangci/golangci-lint:v2.12.1 (Debian; bundles go, make, gcc), 2026-07-26
FROM golangci/golangci-lint@sha256:c9843d374ca80ecbac86081ec4dd7fe2bb6187b03224f59a0cc2f80759e1845b AS lint
WORKDIR /src
COPY go.mod go.sum ./
RUN go mod download
COPY . .
RUN make fmt-check
RUN make lint

# Build stage — compiles and tests. CGO is required by mattn/go-sqlite3, and
# the pinned (legacy) sqlite driver only builds against glibc, so this stage
# is Debian-based rather than alpine.
# golang:1.24-bookworm, 2026-07-26
FROM golang@sha256:1a6d4452c65dea36aac2e2d606b01b4a029ec90cc1ae53890540ce6173ea77ac AS builder
WORKDIR /src

# Force BuildKit to complete the lint stage before compiling/testing.
COPY --from=lint /src/go.sum /dev/null

COPY go.mod go.sum ./
RUN go mod download
COPY . .

RUN make test

ARG VERSION=dev
ARG TARGETARCH=unknown
RUN CGO_ENABLED=1 go build -trimpath \
    -ldflags="-s -w -X main.Version=${VERSION} -X main.Buildarch=${TARGETARCH}" \
    -o /server ./cmd/server

# Runtime stage — the (glibc-linked) binary plus the on-disk templates and
# vendored assets. ca-certificates is needed for the outbound TLS calls to
# the Hacker News API.
# debian:bookworm-slim, 2026-07-26
FROM debian@sha256:7b140f374b289a7c2befc338f42ebe6441b7ea838a042bbd5acbfca6ec875818

RUN apt-get update \
    && apt-get install -y --no-install-recommends ca-certificates \
    && rm -rf /var/lib/apt/lists/*

WORKDIR /app
COPY --from=builder /server /usr/local/bin/server
COPY view ./view
COPY static ./static

# sqlite database lives on a mounted volume
VOLUME /data
ENV DATABASE_PATH=/data/storage.sqlite

EXPOSE 8080
ENTRYPOINT ["server"]