FROM python:3.12-alpine3.22 AS builder

RUN pip install --no-cache-dir --upgrade pip \
    && pip install --no-cache-dir uv

WORKDIR /app

RUN --mount=type=cache,target=/root/.cache/uv \
    --mount=type=bind,source=requirements.txt,target=requirements.txt \
    --mount=type=bind,source=release-requirements.txt,target=release-requirements.txt \
    uv venv \
    && uv pip install -r release-requirements.txt

COPY . .

RUN --mount=type=cache,target=/root/.cache/uv \
    uv pip install .


FROM python:3.12-alpine3.22
ENV PYTHONUNBUFFERED=1

RUN apk add --no-cache \
    ca-certificates \
    git \
    git-lfs \
    && addgroup -g 1000 appuser \
    && adduser -D -u 1000 -G appuser appuser

COPY --from=builder --chown=appuser:appuser /app /app

WORKDIR /app

USER appuser

ENV PATH="/app/.venv/bin:$PATH"

ENTRYPOINT ["github-backup"]