# Keep both stages content-addressed. Updating either base is a reviewed source
# change; a mutable tag must never silently alter a production gateway build.
FROM golang:1.24-bookworm@sha256:1a6d4452c65dea36aac2e2d606b01b4a029ec90cc1ae53890540ce6173ea77ac AS build
WORKDIR /src

COPY go.mod go.sum ./
COPY vendor ./vendor
COPY cmd ./cmd
# Dependencies are vendored and reviewed in the source tree. Force the build
# offline so a registry/module-proxy change cannot enter the candidate.
RUN GOPROXY=off GOSUMDB=off CGO_ENABLED=0 \
    go build -mod=vendor -trimpath -ldflags="-s -w -buildid=" -o /max-gateway ./cmd/gateway
RUN install -d -m 0700 -o 65532 -g 65532 /runtime-data
# Preserve every reviewed vendored license, including transitive modules linked
# into the static binary.  Keep the module-relative path so the candidate
# verifier can compare each installed file byte-for-byte with vendor/.
RUN set -eu; \
    install -d -m 0755 /third-party-licenses; \
    find vendor -type f \
      \( -name LICENSE -o -name 'LICENSE.*' -o -name LICENCE -o \
         -name 'LICENCE.*' -o -name COPYING -o -name 'COPYING.*' -o \
         -name NOTICE -o -name 'NOTICE.*' \) \
      -exec cp --parents '{}' /third-party-licenses/ ';'; \
    test -n "$(find /third-party-licenses/vendor -type f -print -quit)"

FROM gcr.io/distroless/static-debian12:nonroot@sha256:b7bb25d9f7c31d2bdd1982feb4dafcaf137703c7075dbe2febb41c24212b946f
ARG MAX_RELEASE_ID
ARG MAX_SOURCE_REVISION
ARG MAX_TARGET_PLATFORM
ARG MAX_GATEWAY_CODE_SHA256
ARG MAX_GATEWAY_SECRET_SCAN_SHA256
ARG MAX_GATEWAY_SOURCE_ARCHIVE_SHA256
ARG MAX_GATEWAY_VERIFICATION_SHA256
LABEL org.opencontainers.image.revision="${MAX_SOURCE_REVISION}" \
      org.fc-impuls.max.release="${MAX_RELEASE_ID}" \
      org.fc-impuls.max.target-platform="${MAX_TARGET_PLATFORM}" \
      org.fc-impuls.max.gateway-code-sha256="${MAX_GATEWAY_CODE_SHA256}" \
      org.fc-impuls.max.secret-scan-sha256="${MAX_GATEWAY_SECRET_SCAN_SHA256}" \
      org.fc-impuls.max.source-archive-sha256="${MAX_GATEWAY_SOURCE_ARCHIVE_SHA256}" \
      org.fc-impuls.max.verification-sha256="${MAX_GATEWAY_VERIFICATION_SHA256}"
COPY --from=build /max-gateway /max-gateway
COPY --from=build --chown=65532:65532 /runtime-data /data
COPY --from=build /third-party-licenses/vendor/ /usr/share/doc/max-gateway/licenses/vendor/
COPY LICENSE NOTICE THIRD_PARTY_NOTICES.md SOURCE_COMPLIANCE.md /usr/share/doc/max-gateway/

USER 65532:65532
VOLUME ["/data"]
EXPOSE 8080
HEALTHCHECK --interval=30s --timeout=3s --start-period=10s --retries=3 CMD ["/max-gateway", "healthcheck"]
ENTRYPOINT ["/max-gateway"]
