# The deployment helper resolves GO_IMAGE to its registry digest before building.
ARG GO_IMAGE=golang:1.27.1-bookworm
FROM ${GO_IMAGE} AS build
RUN mkdir -p /work /out /home/builder /tmp/go-cache && \
    chown -R 65532:65532 /work /out /home/builder /tmp/go-cache
WORKDIR /work
ENV GOTOOLCHAIN=local HOME=/home/builder GOPATH=/home/builder/go \
    GOCACHE=/tmp/go-cache GOMAXPROCS=2 GOMEMLIMIT=384MiB
ENV PATH="/home/builder/go/bin:${PATH}"
COPY --chown=65532:65532 . .
USER 65532:65532
ARG AUDIT_EPOCH
RUN test -n "$AUDIT_EPOCH" && mkdir -p /out/audit && \
    go version > /out/audit/toolchain.txt && \
    (go test -race -count=1 -coverprofile=/out/audit/coverage.out ./... > /out/audit/go-test.txt 2>&1 || (cat /out/audit/go-test.txt; exit 1)) && \
    go vet ./... > /out/audit/go-vet.txt 2>&1 && \
    go list -m all > /out/audit/modules.txt
# Fail closed: an unavailable scanner/database or a reachable vulnerability blocks deployment.
RUN go install golang.org/x/vuln/cmd/govulncheck@latest && \
    go version -m /home/builder/go/bin/govulncheck > /out/audit/scanner-build.txt && \
    (govulncheck ./... > /out/audit/govulncheck.txt 2>&1 || (cat /out/audit/govulncheck.txt; exit 1))
RUN CGO_ENABLED=0 go build -trimpath -ldflags='-s -w -buildid=' -o /out/skunkyart ./cmd/skunkyart && \
    go version -m /out/skunkyart > /out/audit/binary-build.txt && \
    sh scripts/export-source.sh /out/source.tar.gz && \
    sha256sum /out/skunkyart /out/source.tar.gz > /out/audit/SHA256SUMS && \
    chmod 755 /out/skunkyart && chmod 644 /out/source.tar.gz
FROM scratch
LABEL org.opencontainers.image.title="SkunkyArt Enhanced" \
      org.opencontainers.image.version="2026.09.13.2-scroll1" \
      org.opencontainers.image.description="Unofficial HTML frontend with explicit guest or official OAuth provider; not upstream feature parity" \
      securityops.app="skunkyart-enhanced"
COPY --from=build /etc/ssl/certs/ca-certificates.crt /etc/ssl/certs/ca-certificates.crt
COPY --from=build /out/skunkyart /app/skunkyart
COPY --from=build /out/source.tar.gz /app/source.tar.gz
COPY --from=build /out/audit /audit
COPY --from=build /usr/local/go/LICENSE /licenses/Go-LICENSE
COPY --from=build /usr/share/doc/ca-certificates/copyright /licenses/ca-certificates-copyright
COPY LICENSE THIRD_PARTY_NOTICES.md /licenses/
USER 65532:65532
ENV DA_PROVIDER=oauth LISTEN_ADDR=0.0.0.0:8080 SOURCE_ARCHIVE=/app/source.tar.gz \
    GOMEMLIMIT=384MiB GOMAXPROCS=2
EXPOSE 8080
HEALTHCHECK --interval=30s --timeout=4s --start-period=10s --retries=3 CMD ["/app/skunkyart","--healthcheck"]
ENTRYPOINT ["/app/skunkyart"]
