ARG VAULT_SOURCE_COMMIT

FROM mcr.microsoft.com/dotnet/sdk:10.0.302-noble@sha256:ed034a8bf0b24ded0cbbac07e17825d8e9ebfe21e308191d0f7421eaf5ad4664 AS build
WORKDIR /source

COPY .editorconfig global.json Directory.Build.props Directory.Packages.props ./
COPY src/Vault.Core/Vault.Core.csproj src/Vault.Core/
COPY src/Vault.Core/packages.lock.json src/Vault.Core/
COPY src/Vault.Infrastructure/Vault.Infrastructure.csproj src/Vault.Infrastructure/
COPY src/Vault.Infrastructure/packages.lock.json src/Vault.Infrastructure/
COPY src/Vault.Web/Vault.Web.csproj src/Vault.Web/
COPY src/Vault.Web/packages.lock.json src/Vault.Web/
RUN dotnet restore src/Vault.Web/Vault.Web.csproj --locked-mode

COPY src/ src/
RUN dotnet publish src/Vault.Web/Vault.Web.csproj \
    --configuration Release \
    --no-restore \
    --output /app \
    /p:UseAppHost=false

FROM mcr.microsoft.com/dotnet/sdk:10.0.302-noble@sha256:ed034a8bf0b24ded0cbbac07e17825d8e9ebfe21e308191d0f7421eaf5ad4664 AS source
ARG VAULT_SOURCE_COMMIT
WORKDIR /source

COPY . ./
RUN printf '%s' "$VAULT_SOURCE_COMMIT" | grep --extended-regexp --quiet '^[0-9a-f]{40}$' \
    && test -s .vault-source-manifest \
    && printf '%s\n' "$VAULT_SOURCE_COMMIT" > SOURCE_COMMIT \
    && cp .vault-source-manifest SOURCE_MANIFEST \
    && { \
        cat .vault-source-manifest; \
        printf '%s\n' SOURCE_COMMIT SOURCE_MANIFEST; \
    } > /tmp/source-files \
    && mkdir /source-archive \
    && tar \
        --sort=name \
        --mtime='UTC 1970-01-01' \
        --owner=0 \
        --group=0 \
        --numeric-owner \
        --verbatim-files-from \
        --files-from=/tmp/source-files \
        --create \
        --gzip \
        --file=/source-archive/vault-source.tar.gz

FROM mcr.microsoft.com/dotnet/aspnet:10.0.10-noble-chiseled-extra@sha256:f9bd6be9b5ab75b8196bff0f0972580edaea7fa8ca04e6ef530950e33caee5b0 AS final
ARG VAULT_SOURCE_COMMIT
WORKDIR /app

ENV ASPNETCORE_HTTP_PORTS=8080 \
    DOTNET_EnableDiagnostics=0 \
    SourceArchive__ArchivePath=/app/source/vault-source.tar.gz \
    SourceArchive__Commit=$VAULT_SOURCE_COMMIT

EXPOSE 8080
USER $APP_UID

COPY --from=build --chown=$APP_UID:$APP_UID /app ./
COPY --from=source --chown=$APP_UID:$APP_UID /source-archive/vault-source.tar.gz ./source/vault-source.tar.gz

ENTRYPOINT ["dotnet", "Vault.Web.dll"]
