# ---- Build stage ----
# Chainguard's -dev variant carries pip and a shell; the runtime variant below
# carries neither. Both are pinned by digest, and Renovate moves the pins.
FROM cgr.dev/chainguard/python:latest-dev@sha256:466bed9745baea18d220d1d048439d9daaa72ace864cfbaffe48ce4e096c0da9 AS builder

# Stays the image's nonroot user; the install goes to a directory it owns.
WORKDIR /home/nonroot
COPY requirements.txt .
# Installed into an isolated directory (not system site-packages) so only the
# app's actual dependencies get copied into the runtime stage below -- not
# pip itself or any installer tooling.
RUN pip install --no-cache-dir --no-compile --require-hashes --target=/home/nonroot/deps -r requirements.txt
ARG GIT_COMMIT=unknown
ARG GIT_BRANCH=unknown
LABEL org.opencontainers.image.source="https://github.com/FermiHDI/hd_flow_enrichment" \
      org.opencontainers.image.revision="${GIT_COMMIT}" \
      com.fermihdi.git.branch="${GIT_BRANCH}"

# ---- Runtime stage ----
# Chainguard Python: no shell, package manager, perl, pip, setuptools, wheel,
# git/ssh/curl stack or util-linux, which is where nearly every finding against
# the old python:slim (Debian) runtime came from. Runs as nonroot (65532).
FROM cgr.dev/chainguard/python:latest@sha256:e1a792bc1e72e6395fbf0504bd040945df8999e3e0b22728c279767f771a04ee

WORKDIR /app

# Only the resolved dependencies from the build stage, on the module search path.
COPY --from=builder /home/nonroot/deps /opt/deps
ENV PYTHONPATH=/opt/deps \
    PYTHONDONTWRITEBYTECODE=1

# Application code, root-owned and read-only to the runtime user.
COPY ./enrichment_networks.json /app/enrichment_networks.json
COPY ./enrichment.py /app/enrichment.py

USER 65532:65532

# The base image's entrypoint is python; clear it so the command stays the
# whole invocation, as it was on the previous base.
ENTRYPOINT []
CMD ["/usr/bin/python", "enrichment.py"]

# OCI provenance: links this image back to the repo, commit and branch it was built
# from. Declared last, after every RUN: a build arg whose value changes invalidates
# the cache of each RUN after it. GIT_COMMIT/GIT_BRANCH default to "unknown" -- nothing currently passes them --
# so a real build wanting them populated needs:
#   docker build --build-arg GIT_COMMIT="$(git rev-parse HEAD)" \
#                --build-arg GIT_BRANCH="$(git rev-parse --abbrev-ref HEAD)" .
ARG GIT_COMMIT=unknown
ARG GIT_BRANCH=unknown
LABEL org.opencontainers.image.source="https://github.com/FermiHDI/hd_flow_enrichment" \
      org.opencontainers.image.revision="${GIT_COMMIT}" \
      com.fermihdi.git.branch="${GIT_BRANCH}"
