# Two stages so the runtime image carries no build toolchain and no uv.
FROM python:3.12-slim AS build

COPY --from=ghcr.io/astral-sh/uv:0.9.7 /uv /bin/uv

ENV UV_COMPILE_BYTECODE=1 \
    UV_LINK_MODE=copy \
    UV_PYTHON_DOWNLOADS=never

WORKDIR /app

COPY pyproject.toml README.md ./
COPY src ./src

# One step, no lockfile: the version floors in pyproject.toml are what pins this,
# and they are deliberately recent (August 2026) to keep the vulnerability
# surface small. Add a uv.lock when the build needs to be byte-reproducible.
RUN --mount=type=cache,target=/root/.cache/uv \
    uv venv /app/.venv && uv pip install --python /app/.venv/bin/python .

FROM python:3.12-slim AS runtime

# Non-root, no shell login, no home to write to. The agent holds a Keycloak
# client secret in its environment; a container that cannot be written to is one
# less way to read it back out.
RUN useradd --system --uid 10001 --no-create-home --shell /usr/sbin/nologin agent

WORKDIR /app
COPY --from=build /app/.venv /app/.venv
ENV PATH="/app/.venv/bin:$PATH" \
    PYTHONUNBUFFERED=1 \
    PYTHONDONTWRITEBYTECODE=1

USER 10001
EXPOSE 8080

# The Agent Card is the natural health endpoint: it is served by the same app,
# needs no auth, and a 200 means the A2A routes are actually mounted.
HEALTHCHECK --interval=30s --timeout=5s --start-period=10s --retries=3 \
    CMD ["python", "-c", "import urllib.request,sys; sys.exit(0 if urllib.request.urlopen('http://127.0.0.1:8080/.well-known/agent-card.json', timeout=4).status==200 else 1)"]

ENTRYPOINT ["python", "-m", "a2a_n8n_adapter"]