# review-bot — static Go binary in a FROM-scratch image.
#
# Nothing in the final image but the binary and the CA bundle it needs to reach the Mistral API
# (the binary has no shell and no package manager to patch or to exec).
FROM golang:1.27.2-bookworm@sha256:5cf287a799e6b94384bad13d16b14904c531f51ba65792237e122ce42b392f61 AS build

WORKDIR /build
COPY go.mod go.sum ./
RUN go mod download
COPY *.go prompt.md ./

RUN go vet ./... \
 && CGO_ENABLED=0 go build -trimpath -ldflags="-s -w" -o /review-bot .

FROM scratch
COPY --from=build /etc/ssl/certs/ca-certificates.crt /etc/ssl/certs/ca-certificates.crt
COPY --from=build /review-bot /review-bot

# Matches runAsUser in the Deployment. There is no /etc/passwd in a scratch image, so this is a
# bare uid by necessity.
USER 65534:65534
EXPOSE 8080
ENTRYPOINT ["/review-bot"]