### Use an appropriate version of Python
FROM python:3.15.1-bookworm@sha256:2734c1683bd937b316f31b18972026302f155f0ffd932b329811d2e3a8450775 AS python
ARG UV_VERSION=0.8.13
ARG UV_LIBC=musl

### Configure debian
ENV DEBIAN_FRONTEND=noninteractive

RUN apt-get -qq update -y && \
    apt-get -qq install -y git >/dev/null

### Install and configure uv
RUN UV_ARCHITECTURE=$(uname -m) && \
    wget --quiet https://github.com/astral-sh/uv/releases/download/${UV_VERSION}/uv-${UV_ARCHITECTURE}-unknown-linux-${UV_LIBC}.tar.gz && \
    tar -xf uv-${UV_ARCHITECTURE}-unknown-linux-${UV_LIBC}.tar.gz && \
    rm -f uv-${UV_ARCHITECTURE}-unknown-linux-${UV_LIBC}.tar.gz && \
    mv uv-${UV_ARCHITECTURE}-unknown-linux-${UV_LIBC}/* /usr/bin/ && \
    rmdir uv-${UV_ARCHITECTURE}-unknown-linux-${UV_LIBC}

### Install requirements
FROM python AS requirements

WORKDIR /opt/project
COPY pyproject.toml uv.lock /opt/project/

# Install the locked dependencies but not the project, whose source is not copied yet,
# so this layer is reused until pyproject.toml or uv.lock change. `--locked` fails the
# build when uv.lock no longer matches pyproject.toml, rather than quietly re-locking.
RUN --mount=type=cache,target=/root/.cache \
    uv sync --quiet --link-mode=copy --locked --no-install-project

### Install source and its dependencies
FROM requirements AS source

COPY pyproject.toml /opt/project/
COPY src /opt/project/src

### Define verify command
FROM source AS verify

ENV CI=1

# The environment below is synced from uv.lock with `--locked`, so it is the one to
# verify. This keeps the `uv run` in bin/verify* from syncing or re-locking on its own.
ENV UV_NO_SYNC=1

RUN --mount=type=cache,target=/root/.cache \
    uv sync --quiet --link-mode=copy --locked --extra style --extra types --extra test
COPY bin/verify* /opt/project/bin/

CMD ["/opt/project/bin/verify"]
