FROM golang:1.26-alpine AS build
WORKDIR /src

# Resolve dependencies before copying source. Do not run `go mod tidy` here.
COPY go.mod go.sum ./
RUN go mod download

COPY cmd ./cmd
COPY internal ./internal

# Fail early if repository ignore rules accidentally remove runtime sources.
RUN test -f /src/internal/data/store.go \
 && test -f /src/internal/data/schema.sql

RUN CGO_ENABLED=0 GOOS=linux go build \
    -trimpath -ldflags="-s -w" \
    -o /out/neuralhunt ./cmd/server

FROM alpine:3.24
RUN adduser -D -h /home/app app \
 && mkdir -p /app /data \
 && chown -R app:app /app /data
WORKDIR /app

COPY --from=build /out/neuralhunt /app/neuralhunt

USER app
ENV SQLITE_PATH=/data/neuralhunt.db \
    ARTIFACT_DIR=/data/artifacts
EXPOSE 8080 8081
ENTRYPOINT ["/app/neuralhunt"]