# Multi-binary image for the platform/ catalog wire harnesses.
#
# Build context is the platform/ directory. Modules used by the binaries all
# live under platform/, so a single-tree build is sufficient — no external
# replace directives needed.
#
# Pure Go: cmd/catalog-emit and cmd/event-emit-publisher use only stdlib +
# github.com/rabbitmq/amqp091-go + git.k6n.net/mats/platform/* internals.
# No CGO, so we ship a Debian-bookworm-slim runtime with ca-certificates
# and a timezone DB. The writer (slask-finder) is NOT built here — it lives
# in its own Dockerfile and has its own ONNX / libtokenizers deps (CGO).

# ─── 1. Build stage ────────────────────────────────────────────────────────
FROM golang:1.26-bookworm AS build-stage
WORKDIR /app
ENV CGO_ENABLED=0 GOFLAGS="-trimpath"

# Module files first so the dep download caches correctly on rebuild.
COPY go.mod go.sum ./
RUN go mod download

# Rest of the source.
COPY . .

ARG TARGETARCH
ARG BUILDTIME
RUN CGO_ENABLED=0 GOOS=linux GOARCH=${TARGETARCH} \
    go build -ldflags="-s -w" -o /out/catalog-emit ./cmd/catalog-emit && \
    CGO_ENABLED=0 GOOS=linux GOARCH=${TARGETARCH} \
    go build -ldflags="-s -w" -o /out/event-emit-publisher ./cmd/event-emit-publisher

# ─── 2. Runtime stage ────────────────────────────────────────────────────
FROM debian:bookworm-slim

# ca-certificates for TLS-validated RabbitMQ URLs (amqps://).
# tzdata so time.Now() resolves zones predictably in logs.
RUN apt-get update && \
    apt-get install -y --no-install-recommends \
        ca-certificates \
        tzdata && \
    rm -rf /var/lib/apt/lists/*

# Non-root user, matching the k8s securityContext pattern that
# 20-data-plane.yaml uses for cart/checkout/profile (runAsUser: 1000).
# Pick 1010 here to leave 1000 available for future platform pods.
RUN groupadd --gid 1010 platcat && \
    useradd  --uid 1010 --gid platcat \
             --home-dir /home/platcat --create-home \
             --shell /bin/bash platcat

# Binaries straight from the build stage.
COPY --from=build-stage /out/catalog-emit          /usr/local/bin/catalog-emit
COPY --from=build-stage /out/event-emit-publisher  /usr/local/bin/event-emit-publisher

# Make them owned by platcat so a non-root pod UID can run them.
RUN chown platcat:platcat /usr/local/bin/catalog-emit \
                       /usr/local/bin/event-emit-publisher

USER platcat:platcat
WORKDIR /home/platcat

# Healthcheck surfaces what's running; useful for `kubectl describe pod`
# when watching the projection consumer come up.
HEALTHCHECK --interval=30s --timeout=3s --retries=3 \
    CMD /usr/local/bin/catalog-emit -h >/dev/null 2>&1 || exit 1

# Production entrypoint is catalog-emit (the consumer harness); the
# publisher binary is intentionally a sibling so it's invokeable for
# smoke tests via `kubectl exec <pod> -- /usr/local/bin/event-emit-publisher ...`.
# The k8s Deployment (52-catalog-emit.yaml) overrides args with the
# watch-mode flags + -out-dir pointing at the projection PVC.
ENTRYPOINT ["/usr/local/bin/catalog-emit"]
CMD ["-h"]