# syntax=docker/dockerfile:1
# Supply a reviewed immutable digest through NODE_IMAGE for release builds.
ARG NODE_IMAGE=node:24-bookworm-slim
FROM ${NODE_IMAGE} AS build
WORKDIR /app
COPY package.json package-lock.json ./
RUN npm ci --include=optional
COPY . .
RUN npm run build

FROM build AS acceptance
CMD ["npm", "run", "test:live"]

FROM build AS production-dependencies
RUN npm prune --omit=dev --include=optional

FROM ${NODE_IMAGE} AS runtime
ENV NODE_ENV=production APP_HOST=0.0.0.0 PORT=3000
WORKDIR /app
COPY --from=production-dependencies --chown=node:node /app/node_modules ./node_modules
COPY --from=build --chown=node:node /app/package.json /app/package-lock.json ./
COPY --from=build --chown=node:node /app/server.js /app/worker.js /app/scheduler.js ./
COPY --from=build --chown=node:node /app/src ./src
COPY --from=build --chown=node:node /app/public ./public
COPY --from=build --chown=node:node /app/database ./database
COPY --from=build --chown=node:node /app/bin ./bin
COPY --from=build --chown=node:node /app/scripts/runtime-policy.js ./scripts/runtime-policy.js
RUN mkdir -p storage/public storage/private storage/quarantine storage/logs && chown -R node:node storage
USER node
EXPOSE 3000
STOPSIGNAL SIGTERM
HEALTHCHECK --interval=30s --timeout=7s --start-period=45s --retries=3 CMD ["node", "bin/health-check.js", "--url=http://127.0.0.1:3000/health/ready"]
CMD ["node", "server.js"]