Dockerfile.git_integration

# Base image for both stages
FROM python:3.13.5-slim-bullseye AS base

# Go builder stage: build the software-value binary and install scc
FROM golang:1.25-alpine AS go-builder

WORKDIR /go/src/software-value

# Install scc using the official Go toolchain (specific version as per project README)
RUN go install github.com/boyter/scc/v3@v3.5.0

# Copy Go module files
COPY ./services/apps/git_integration/src/crowdgit/services/software_value/go.mod ./
COPY ./services/apps/git_integration/src/crowdgit/services/software_value/go.sum ./

# Download dependencies
RUN go mod download

# Copy source code
COPY ./services/apps/git_integration/src/crowdgit/services/software_value/ ./

# Build the binary
RUN CGO_ENABLED=0 GOOS=linux go build -ldflags "-w -s" -o software-value ./

# Go builder stage 2: build the vulnerability-scanner binary
FROM golang:1.25-alpine AS go-vuln-builder

WORKDIR /go/src/vulnerability-scanner

# Copy module files first for dependency caching
COPY ./services/apps/git_integration/src/crowdgit/services/vulnerability_scanner/go.mod ./
COPY ./services/apps/git_integration/src/crowdgit/services/vulnerability_scanner/go.sum ./

# Copy source code
COPY ./services/apps/git_integration/src/crowdgit/services/vulnerability_scanner/ ./

# Download dependencies and build, using cache mounts to avoid re-downloading on every build
RUN --mount=type=cache,target=/go/pkg/mod \
    --mount=type=cache,target=/root/.cache/go-build \
    go mod download && CGO_ENABLED=0 GOOS=linux go build -ldflags "-w -s" -o vulnerability-scanner ./

# Builder stage: install build dependencies, uv, and dependencies
FROM base AS builder

# Install build dependencies
RUN apt-get update && apt-get install -y \
    build-essential \
    --no-install-recommends \
    && rm -rf /var/lib/apt/lists/*

# Copy uv binary from official image
COPY --from=ghcr.io/astral-sh/uv:0.7.17 /uv /usr/local/bin/uv

WORKDIR /usr/crowd/app

ENV UV_LINK_MODE=copy \
    UV_COMPILE_BYTECODE=1 \
    UV_PYTHON_DOWNLOADS=never \
    UV_PYTHON=python3.13 \
    UV_PROJECT_ENVIRONMENT=/usr/crowd/app/.venv \
    UV_VENV_PATH=/usr/crowd/app/.venv

# Copy only lock, pyproject.toml and License for dependency install caching
COPY ./services/apps/git_integration/pyproject.toml ./services/apps/git_integration/uv.lock ./LICENSE ./

# Install dependencies excluding the project itself for better caching
RUN --mount=type=cache,target=/root/.cache/uv \
    uv sync --frozen --no-install-project --no-dev

# Copy full source code
COPY ./services/apps/git_integration ./LICENSE ./

# Sync full project including the project itself
RUN --mount=type=cache,target=/root/.cache/uv \
    uv sync --frozen --no-dev


# Runner: minimal image with runtime deps and virtualenv only
FROM base AS runner

# Install runtime dependencies only
RUN apt-get update && apt-get install -y \
    ca-certificates \
    git \
    ripgrep \
    ruby \
    libgit2-1.1 \
    ruby-dev \
    build-essential \
    libgit2-dev \
    cmake \
    pkg-config \
    --no-install-recommends \
    && gem install licensee -v '9.15.3' --no-document \
    && apt-get remove --autoremove -y ruby-dev build-essential libgit2-dev cmake pkg-config \
    && rm -rf /var/lib/apt/lists/*

ENV PYTHONUNBUFFERED=1 \
    PYTHONDONTWRITEBYTECODE=1 \
    PIP_NO_CACHE_DIR=off

WORKDIR /usr/crowd/app

# Copy virtual environment and app source from builder
COPY --from=builder /usr/crowd/app/.venv /usr/crowd/app/.venv
COPY --from=builder /usr/crowd/app /usr/crowd/app

# Copy both software-value and scc binaries from go-builder stage
COPY --from=go-builder /go/src/software-value/software-value /usr/local/bin/software-value
COPY --from=go-builder /go/bin/scc /usr/local/bin/scc

# Copy vulnerability-scanner binary from go-vuln-builder stage
COPY --from=go-vuln-builder /go/src/vulnerability-scanner/vulnerability-scanner /usr/local/bin/vulnerability-scanner

# Add virtual environment bin to PATH
ENV PATH="/usr/crowd/app/.venv/bin:$PATH"

# Make runner script and binaries executable
RUN chmod +x ./src/runner.sh \
    && chmod +x /usr/local/bin/software-value \
    && chmod +x /usr/local/bin/scc \
    && chmod +x /usr/local/bin/vulnerability-scanner

EXPOSE 8085

CMD ["./src/runner.sh"]