# syntax=docker/dockerfile:1

# Keep the builder and runtime versions explicit so a test deployment does not
# silently move to an unrelated Go or Alpine release.
FROM golang:1.26.8-alpine3.24 AS build

WORKDIR /src

# Keep git in the builder because the default GOPROXY policy permits a
# checksum-verified direct VCS fallback. It is not copied into the runtime.
RUN apk add --no-cache ca-certificates git

ARG GOPROXY=https://proxy.golang.org,direct
ENV GOPROXY=${GOPROXY}

COPY go.mod go.sum ./
RUN go mod download

# Copy only Go sources into the build context. Documentation, SQL exports and
# local configuration are intentionally not part of the application image.
COPY cmd ./cmd
COPY internal ./internal
COPY pkg ./pkg

RUN go test ./... \
    && CGO_ENABLED=0 GOOS=linux go build \
        -buildvcs=false \
        -trimpath \
        -ldflags="-s -w" \
        -o /out/fire-safety-server \
        ./cmd/server

FROM alpine:3.24.1

RUN apk add --no-cache ca-certificates tzdata \
    && addgroup -S app \
    && adduser -S -D -H -G app app

COPY --from=build --chown=app:app /out/fire-safety-server /usr/local/bin/fire-safety-server

USER app
WORKDIR /app
EXPOSE 8080

ENTRYPOINT ["/usr/local/bin/fire-safety-server"]