# syntax=docker/dockerfile:1
# Multi-stage: Debian build (Node; Chromium deps for Mermaid land in M3) →
# pinned nginx-unprivileged runtime serving the static dist/.

# ---- build stage ----------------------------------------------------------
# Digest-pinned (was a floating tag → the docker.io re-resolve was the CI "build hang"). With the bastion
# runner pointed at the zot pull-through mirror, this exact layer is fetched once and cached. Bump the digest
# when intentionally moving Node. node:22-bookworm-slim index digest resolved 2026-06-23.
FROM node:22-bookworm-slim@sha256:d9f850096136edbc402debdd8729579a288aac64574ada0ff4db26b6ae58b0b2 AS build
WORKDIR /app

# Install deps from the lockfile only first (better layer caching).
COPY package.json package-lock.json ./
RUN npm ci

# Build the static site. The git sha arrives as a build-arg (.dockerignore excludes .git,
# so an in-container `git rev-parse` can never resolve — the footer receipt read "HEAD unknown").
ARG GIT_SHA
ENV GIT_SHA=${GIT_SHA}
COPY . .
RUN npm run build

# ---- runtime stage --------------------------------------------------------
# Same vetted digest used by the k8s Deployment. Renovate keeps it current.
FROM ghcr.io/nginx/nginx-unprivileged:1.28.0-alpine@sha256:c97ff0bf7cbae369953c6da1232ec14ad9f971d66360c5698db0856a4cd657a0

# Custom server config (security headers, caching, routing) + shared headers include.
COPY nginx/default.conf /etc/nginx/conf.d/default.conf
COPY nginx/security-headers.conf /etc/nginx/security-headers.conf

# The built site.
COPY --from=build /app/dist /usr/share/nginx/html

EXPOSE 8080