FROM docker.io/nginxinc/nginx-unprivileged@sha256:65e3e85dbaed8ba248841d9d58a899b6197106c23cb0ff1a132b7bfe0547e4c0 AS runtime-base

ARG VCS_REVISION=unknown
LABEL org.opencontainers.image.title="policy-nexus" \
      org.opencontainers.image.description="Canonical Coulomb policy publication surface" \
      org.opencontainers.image.source="https://forgejo.coulomb.social/coulomb/policy-nexus" \
      org.opencontainers.image.revision="$VCS_REVISION"

COPY --chown=101:101 deploy/nginx.conf /etc/nginx/conf.d/default.conf

USER 101:101
EXPOSE 8080

FROM runtime-base AS local-artifact
COPY --chown=101:101 build/ /usr/share/nginx/html/

FROM docker.io/library/python@sha256:d09d15e60962ca365d1cd544a48773bac9d33f2fb1b00f2aa0deec78ade7dc31 AS release-builder
ARG NETKINGDOM_REVISION
ENV POLICY_NEXUS_SOURCE_REVISION_NET_KINGDOM=$NETKINGDOM_REVISION
WORKDIR /workspace/policy-nexus
COPY . /workspace/policy-nexus
COPY _sources/net-kingdom /workspace/net-kingdom
RUN rm -rf build \
    && python3 -m unittest discover -s tests -p 'test_*.py' \
    && python3 tools/build_site.py publication.json --output build \
    && python3 tools/verify_release.py build \
    && python3 tools/check_currency.py publication.json

FROM runtime-base AS release-artifact
COPY --from=release-builder --chown=101:101 /workspace/policy-nexus/build/ /usr/share/nginx/html/