# syntax=docker/dockerfile:1

# ---- build stage ----
FROM golang:1.26-alpine AS builder
WORKDIR /src

# Cache deps first.
COPY go.mod go.sum ./
RUN go mod download

COPY . .

# Build both binaries statically (pgx speaks the wire protocol, no cgo needed).
RUN CGO_ENABLED=0 GOOS=linux go build \
    -ldflags="-s -w" -trimpath \
    -o /out/server ./cmd/server && \
    CGO_ENABLED=0 GOOS=linux go build \
    -ldflags="-s -w" -trimpath \
    -o /out/migrate ./cmd/migrate

# ---- runtime stage ----
# distroless/static ships CA certificates (needed for OIDC JWKS over HTTPS)
# and a nonroot user.
FROM gcr.io/distroless/static-debian12:nonroot
WORKDIR /app
COPY --from=builder /out/server /app/server
COPY --from=builder /out/migrate /app/migrate

# The API server runs by default. The one-shot migrate job overrides the
# command in docker-compose to "/app/migrate up".
USER nonroot:nonroot
EXPOSE 8080
ENTRYPOINT ["/app/server"]