FROM golang:1.26-alpine AS build
WORKDIR /src
COPY go.mod go.sum ./
RUN go mod download
COPY cmd ./cmd
COPY internal ./internal
# 构建期身份：由调用方 --build-arg 传入。依据是仓库根 CHANGELOG.md 顶部的已发布版本
# （`python3 scripts/version.py --identity`），**不要手填**。不传就落成 dev / unknown —— 那是故意的：
# 一个显眼的 dev 好过一个看起来正常的假版本号（正本 §6.1）。
# BUILD_KIND 只有**显式的发布上下文**才传 release；普通构建一律 development，
# 产物的 DisplayVersion() 会是 dev+g<短SHA>（开发构建不许只显示上一正式版本号）。
# ⚠️ TODO：compose.yaml 还没把这三个 args 透传进来（改动会与在审的 PR #2 冲突），
#    所以当前由 compose 构建出的镜像会报 dev；透传后即报真实版本。
ARG VERSION=dev
ARG RELEASE_VERSION=
ARG BUILD_KIND=development
ARG COMMITS_SINCE_RELEASE=
ARG COMMIT_SHA=unknown
ARG BUILD_TIME=unknown
RUN LDFLAGS="-X knowledge-governance/internal/version.Number=${VERSION} -X knowledge-governance/internal/version.ReleaseVersion=${RELEASE_VERSION} -X knowledge-governance/internal/version.BuildKind=${BUILD_KIND} -X knowledge-governance/internal/version.CommitsSinceRelease=${COMMITS_SINCE_RELEASE} -X knowledge-governance/internal/version.CommitSHA=${COMMIT_SHA} -X knowledge-governance/internal/version.BuildTime=${BUILD_TIME}" \
    && CGO_ENABLED=0 GOOS=linux go build -trimpath -ldflags "$LDFLAGS" -o /out/api ./cmd/api \
    && CGO_ENABLED=0 GOOS=linux go build -trimpath -ldflags "$LDFLAGS" -o /out/worker ./cmd/worker \
    && CGO_ENABLED=0 GOOS=linux go build -trimpath -ldflags "$LDFLAGS" -o /out/release-worker ./cmd/release-worker \
    && CGO_ENABLED=0 GOOS=linux go build -trimpath -ldflags "$LDFLAGS" -o /out/libraryctl ./cmd/libraryctl \
    && CGO_ENABLED=0 GOOS=linux go build -trimpath -ldflags "$LDFLAGS" -o /out/test-publication-seed ./cmd/test-publication-seed \
    && CGO_ENABLED=0 GOOS=linux go build -trimpath -ldflags "$LDFLAGS" -o /out/test-weknora-e2e-report ./cmd/test-weknora-e2e-report \
    && CGO_ENABLED=0 GOOS=linux go build -trimpath -ldflags "$LDFLAGS" -o /out/test-weknora-probe ./cmd/test-weknora-probe

FROM alpine:3.22
ENV PYTHONDONTWRITEBYTECODE=1
RUN apk add --no-cache ca-certificates python3 postgresql-client curl openssh-client gcompat libc6-compat \
    && addgroup -g 65532 governance \
    && adduser -D -H -u 65532 -G governance governance

# ssh 客户端需要"本机 uid 有 passwd 条目"（否则报 No user exists for uid 1000）；
# 备份计划的下发与读回都走 ssh，容器以 1000 运行，这里给该 uid 建一个名字。
RUN adduser -D -u 1000 -h /home/app appuser 2>/dev/null || true
# dws (DingTalk Workspace CLI) v1.0.63：版本+校验和固定（禁用 dws upgrade）。
# 官方产物是动态链接 glibc 的二进制，alpine(musl) 靠 gcompat/libc6-compat 运行，
# 已验证端到端取件并与 glibc 原生环境字节一致。构建期 `dws version` 即自检。
ARG DWS_VERSION=v1.0.63
ARG DWS_SHA256=78cab668bf671c17128ac55347627fb28f80c15b9c30c5f86e32e2b5ee6e34bc
RUN set -eux; \
    curl -fsSL -o /tmp/dws.tgz \
      "https://github.com/DingTalk-Real-AI/dingtalk-workspace-cli/releases/download/${DWS_VERSION}/dws-linux-amd64.tar.gz"; \
    echo "${DWS_SHA256}  /tmp/dws.tgz" | sha256sum -c -; \
    tar -xzf /tmp/dws.tgz -C /tmp ./dws; \
    install -m 0755 /tmp/dws /usr/local/bin/dws; \
    rm -rf /tmp/dws.tgz /tmp/dws; \
    dws version
WORKDIR /app
COPY --from=build /out/ /app/
COPY scripts/source_catalog_import.py scripts/live_catalog_refresh.py scripts/artifact_fetch.py \
     scripts/axls_to_xlsx.py scripts/dws_error_map.py /app/scripts/
USER 65532:65532
CMD ["/app/api"]