FROM node:22-bookworm-slim

# Debian's security fixes reach the official Node image some days after they reach Debian. Until the
# base carries perl-base 5.36.0-7+deb12u4 (seven HIGH and CRITICAL findings of the image scan, Redmine
# #4520) the image takes it from Debian itself. Once the base has it this changes nothing, and the
# step can be deleted.
RUN apt-get update \
    && apt-get install -y --no-install-recommends --only-upgrade perl-base \
    && rm -rf /var/lib/apt/lists/*

WORKDIR /repo

COPY package.json package-lock.json ./
COPY apps/web/package.json apps/web/package.json
COPY packages/ui/package.json packages/ui/package.json

RUN npm ci

COPY LICENSE LICENSE-UI NOTICE /usr/share/licenses/openatos/
COPY apps/web/app/fonts/LICENSE-Inter.txt apps/web/app/fonts/LICENSE-IBMPlexSans.txt /usr/share/licenses/openatos/
COPY tools/licensing/node-inventory.mjs tools/licensing/node-inventory.mjs
RUN node tools/licensing/node-inventory.mjs --root /repo --output /usr/share/licenses/openatos/node-tree.json

COPY apps/web apps/web
COPY packages/ui packages/ui
COPY apps/api/accounts/capability_matrix.json apps/api/accounts/capability_matrix.json

RUN npm run build -w apps/web

ARG OPENATOS_BUILD_REVISION=""
LABEL org.opencontainers.image.revision=$OPENATOS_BUILD_REVISION
RUN node -e 'const fs=require("node:fs"); const value=process.env.OPENATOS_BUILD_REVISION ?? ""; if(value && !/^[a-f0-9]{40}$/.test(value)) process.exit(1); fs.mkdirSync("/usr/share/openatos"); fs.writeFileSync("/usr/share/openatos/build-revision", value+"\n")'

EXPOSE 3000
CMD ["npm", "run", "start", "-w", "apps/web"]
