# syntax=docker/dockerfile:1.7

# ---------- build ----------
# Pinned to 1.26 because this module depends on
# github.com/open-policy-agent/opa v1.21.4 which requires Go >= 1.26.0.
FROM golang:1.26-alpine3.23 AS build

ENV CGO_ENABLED=0 \
    GOOS=linux \
    GOFLAGS="-trimpath"

WORKDIR /src

# The image reproduces the repo layout under /src so Go module paths and
# the OPA policy's relative location (`../../../../policies/sinks/...`
# in tests) line up both in CI and inside the image.
COPY services/signing-service/go.mod services/signing-service/go.sum ./services/signing-service/
RUN --mount=type=cache,target=/root/.cache/go-build \
    --mount=type=cache,target=/go/pkg/mod \
    cd services/signing-service && go mod download

COPY services/signing-service/ ./services/signing-service/
# The OPA Rego policy ships with the image for dev / smoke runs. GitOps
# mounts it from a ConfigMap at /etc/signing-service/policies at runtime
# and wins over the baked-in copy.
COPY policies/sinks/signing_service.rego ./policies/sinks/signing_service.rego

WORKDIR /src/services/signing-service
RUN --mount=type=cache,target=/root/.cache/go-build \
    --mount=type=cache,target=/go/pkg/mod \
    go vet ./... && \
    go test ./... && \
    go build -ldflags="-s -w" -o /out/signing-service ./cmd/signing-service

# ---------- runtime ----------
# Distroless static+nonroot: no shell, no package manager, UID/GID 65532.
# gcr.io/distroless/static-debian12:nonroot pins to the latest nonroot
# variant; CI tags images by git sha so this is reproducible at the point
# of build.
FROM gcr.io/distroless/static-debian12:nonroot

COPY --from=build /out/signing-service /signing-service

USER 65532:65532
EXPOSE 8081
ENTRYPOINT ["/signing-service"]
CMD ["-listen=:8081", "-backend=memory"]