# The base by tag and digest (Redmine #5029): every build of one commit, staging's and production's,
# runs on the same OS layers. Dependabot's docker updater moves the digest in an ordinary pull
# request; .github/scripts/security_baseline.py fails a FROM without one.
FROM node:22-bookworm-slim@sha256:5ec23b7c622b00547753bc6ffd78085dd868a68aeb41c8e0a1418f033e13d96d

# Debian's security fixes reach the official Node image some days after they reach Debian. Until the
# base carries perl-base 5.36.0-7+deb12u4 (seven HIGH and CRITICAL findings of the image scan, Redmine
# #4520) and apt and libapt-pkg6.0 2.6.2 (CVE-2026-109518, HIGH, Redmine #5026) the image takes them
# from Debian itself. Once the base has them this changes nothing, and the step can be deleted.
RUN apt-get update \
    && apt-get install -y --no-install-recommends --only-upgrade perl-base apt libapt-pkg6.0 \
    && rm -rf /var/lib/apt/lists/*

WORKDIR /repo

COPY package.json package-lock.json ./
COPY apps/web/package.json apps/web/package.json
COPY packages/ui/package.json packages/ui/package.json

RUN npm ci

COPY LICENSE LICENSE-UI NOTICE /usr/share/licenses/openatos/
COPY apps/web/app/fonts/LICENSE-Inter.txt apps/web/app/fonts/LICENSE-IBMPlexSans.txt /usr/share/licenses/openatos/
COPY tools/licensing/node-inventory.mjs tools/licensing/node-inventory.mjs
RUN node tools/licensing/node-inventory.mjs --root /repo --output /usr/share/licenses/openatos/node-tree.json

COPY apps/web apps/web
COPY packages/ui packages/ui
COPY apps/api/accounts/capability_matrix.json apps/api/accounts/capability_matrix.json

RUN npm run build -w apps/web

ARG OPENATOS_BUILD_REVISION=""
LABEL org.opencontainers.image.revision=$OPENATOS_BUILD_REVISION
RUN node -e 'const fs=require("node:fs"); const value=process.env.OPENATOS_BUILD_REVISION ?? ""; if(value && !/^[a-f0-9]{40}$/.test(value)) process.exit(1); fs.mkdirSync("/usr/share/openatos"); fs.writeFileSync("/usr/share/openatos/build-revision", value+"\n")'

EXPOSE 3000
CMD ["npm", "run", "start", "-w", "apps/web"]
