FROM golang:1.26-alpine AS build
WORKDIR /src
# Fetch internal git-hosted Go modules (cad-atlas now depends on
# git.d-ma.be/mathias/cad — cad-atlas#11, reusing cad#14's cad-stuck query
# logic rather than duplicating the taxonomy) without going through
# proxy.golang.org. Gitea returns http:// in its go-import meta tag, so
# rewrite to https and bypass the module proxy + sumdb (mirrors mathias/cad's
# own Dockerfile — same trick, same reason).
#
# UNLIKE mcp-chassis (public, what cad's own Dockerfile fetches this way),
# mathias/cad is a PRIVATE repo, so the plain insteadOf rewrite above is not
# enough — `go mod download` needs to authenticate. Use a GIT_ASKPASS helper
# reading a BuildKit secret mount (mirrors the GIT_ASKPASS pattern this
# repo's own cd.yml already uses for the oathcandidate module's private
# swedsl dependency): the token is never written to a persisted layer — the
# askpass script and its reference to /run/secrets/gitea_token are created
# and removed within the same RUN instruction, and the secret mount itself
# is never part of any layer diff. Caller passes it via
# `BUILD_SECRETS="id=gitea_token,src=<path>"` (build-image.sh's existing
# mechanism) — see cd.yml.
RUN apk add --no-cache git && \
    git config --global url."https://git.d-ma.be/".insteadOf "http://git.d-ma.be/"
ENV GOPRIVATE=git.d-ma.be
ENV GOPROXY=direct
ENV GOSUMDB=off
RUN go install github.com/a-h/templ/cmd/templ@latest
COPY go.mod go.sum ./
RUN --mount=type=secret,id=gitea_token \
    printf '#!/bin/sh\ncase "$1" in *sername*) echo oauth2 ;; *) cat /run/secrets/gitea_token ;; esac\n' > /tmp/askpass.sh && \
    chmod 700 /tmp/askpass.sh && \
    GIT_ASKPASS=/tmp/askpass.sh GIT_TERMINAL_PROMPT=0 go mod download && \
    rm -f /tmp/askpass.sh
COPY . .
ARG VERSION=dev
RUN templ generate && CGO_ENABLED=0 go build -trimpath \
    -ldflags="-s -w -X git.d-ma.be/mathias/cad-atlas/internal/version.Value=${VERSION}" \
    -o /out/app ./cmd/cad-atlas

FROM gcr.io/distroless/static-debian12:nonroot
COPY --from=build /out/app /app
USER nonroot:nonroot
EXPOSE 8080
ENTRYPOINT ["/app"]