# Lint stage — fast feedback on formatting and lint issues
# golangci/golangci-lint:v2.10.1, 2026-03-01
FROM golangci/golangci-lint@sha256:ea84d14c2fef724411be7dc45e09e6ef721d748315252b02df19a7e3113ee763 AS lint

# Install CGO dependencies needed for static analysis of vips/libheif code
RUN apt-get update && apt-get install -y --no-install-recommends \
    libvips-dev \
    libheif-dev \
    pkg-config \
    && rm -rf /var/lib/apt/lists/*

WORKDIR /src
COPY go.mod go.sum ./
RUN go mod download

COPY . .

RUN make fmt-check
RUN make lint

# Build stage — tests and compilation
# golang:1.25.4-alpine, 2026-02-25
FROM golang:1.25.4-alpine@sha256:d3f0cf7723f3429e3f9ed846243970b20a2de7bae6a5b66fc5914e228d831bbb AS builder

ARG VERSION=dev

# Force BuildKit to run the lint stage by creating a stage dependency
COPY --from=lint /src/go.sum /dev/null

# Install build dependencies for CGO image libraries
RUN apk add --no-cache \
    build-base \
    vips-dev \
    libheif-dev \
    pkgconfig

WORKDIR /src

# Copy go mod files first for better layer caching
COPY go.mod go.sum ./
RUN GOTOOLCHAIN=auto go mod download

# Copy source code
COPY . .

# Run tests
RUN make test

# Build with CGO enabled
RUN CGO_ENABLED=1 GOTOOLCHAIN=auto go build -ldflags "-X main.Version=${VERSION}" -o /pixad ./cmd/pixad

# Runtime stage
# alpine:3.21, 2026-02-25
FROM alpine:3.21@sha256:c3f8e73fdb79deaebaa2037150150191b9dcbfba68b4a46d70103204c53f4709

# Install runtime dependencies only
RUN apk add --no-cache \
    vips \
    libheif \
    ca-certificates \
    tzdata

# Copy binary from builder
COPY --from=builder /pixad /usr/local/bin/pixad

# Create non-root user, config directory, and data directory
RUN adduser -D -H -s /sbin/nologin pixad && \
    mkdir -p /var/lib/pixa /etc/pixa && \
    chown pixad:pixad /var/lib/pixa

# Copy default config (edit signing_key before use)
COPY config.example.yml /etc/pixa/config.yml

USER pixad
WORKDIR /var/lib/pixa

EXPOSE 8080

ENTRYPOINT ["/usr/local/bin/pixad", "--config", "/etc/pixa/config.yml"]