FROM cgr.dev/chainguard/wolfi-base AS builder

ARG UV_VERSION="0.12.19"
ARG PY_VERSION=3.12
WORKDIR /app

RUN apk add --no-cache python-${PY_VERSION} py${PY_VERSION}-pip && chown -R nonroot:nonroot /app/

USER nonroot

# Install uv and mount wheel cache
RUN --mount=type=cache,target=/home/nonroot/.cache/uv 
COPY --from=ghcr.io/astral-sh/uv:${UV_VERSION} /uv /uvx /bin/
ENV UV_PROJECT_ENVIRONMENT=/home/nonroot/venv

# Copy enough of the c7n source that poetry can
# use it when installing c7n-left
WORKDIR /app/c7n
COPY pyproject.toml uv.lock README.md /app/c7n
COPY c7n /app/c7n/c7n

# Install c7n-left, which comes with a path-based dependency
# on c7n
WORKDIR /app/c7n/tools/c7n_left
COPY tools/c7n_left /app/c7n/tools/c7n_left
RUN uv sync --frozen


FROM chainguard/wolfi-base

LABEL name="c7n-left" \
      repository="http://github.com/cloud-custodian/cloud-custodian"
LABEL "org.opencontainers.image.title"="c7n-left"
LABEL "org.opencontainers.image.description"="IaC Policy Engine"
LABEL "org.opencontainers.image.documentation"="https://cloudcustodian.io/docs"

ARG PY_VERSION=3.12

WORKDIR /app
RUN apk add --no-cache git python-${PY_VERSION} && chown -R nonroot:nonroot /app/

COPY --from=builder /home/nonroot/venv/lib/python${PY_VERSION}/site-packages /home/nonroot/.local/lib/python${PY_VERSION}/site-packages
RUN rm -Rf /home/nonroot/.local/lib/python${PY_VERSION}/site-packages/pip*
COPY --from=builder /app/c7n/c7n /app/c7n
COPY --from=builder /app/c7n/tools/c7n_left /app/c7n/tools/c7n_left

USER nonroot

ENV LC_ALL="C.UTF-8" LANG="C.UTF-8"
ENV PYTHONPATH=/app:/app/c7n/tools/c7n_left:/home/nonroot/.local/lib/python${PY_VERSION}/site-packages


ENTRYPOINT [ "python", "-m", "c7n_left.cli"]
