# syntax=docker/dockerfile:1.7

# ---------- build ----------
FROM golang:1.23-alpine3.21 AS build

ENV CGO_ENABLED=0 \
    GOOS=linux \
    GOFLAGS="-trimpath"

WORKDIR /src

# Only the signing-service module is needed. Copy the module files first so
# the dependency download layer is cacheable independently of source edits.
COPY services/signing-service/go.mod ./
# go.sum will be copied in when the module gains external deps; today the
# module is stdlib-only.
RUN --mount=type=cache,target=/root/.cache/go-build \
    --mount=type=cache,target=/go/pkg/mod \
    go mod download || true

COPY services/signing-service/ ./

RUN --mount=type=cache,target=/root/.cache/go-build \
    --mount=type=cache,target=/go/pkg/mod \
    go vet ./... && \
    go test ./... && \
    go build -ldflags="-s -w" -o /out/signing-service ./cmd/signing-service

# ---------- runtime ----------
# Distroless static+nonroot: no shell, no package manager, UID/GID 65532.
# gcr.io/distroless/static-debian12:nonroot pins to the latest nonroot
# variant; CI tags images by git sha so this is reproducible at the point
# of build.
FROM gcr.io/distroless/static-debian12:nonroot

COPY --from=build /out/signing-service /signing-service

USER 65532:65532
EXPOSE 8081
ENTRYPOINT ["/signing-service"]
CMD ["-listen=:8081", "-backend=memory"]