FROM python:3.12-slim AS builder

RUN apt-get update && apt-get install -y --no-install-recommends curl unzip \
    && rm -rf /var/lib/apt/lists/*

WORKDIR /build
COPY pyproject.toml uv.lock ./
SHELL ["/bin/bash", "-o", "pipefail", "-c"]
RUN curl -LsSf https://astral.sh/uv/0.5.25/install.sh | sh \
    && . "$HOME/.local/bin/env" \
    && uv sync --frozen

SHELL ["/bin/sh", "-c"]

FROM builder AS runtime

RUN apt-get update && apt-get install -y --no-install-recommends \
        ffmpeg \
        libglib2.0-0 \
        libnss3 \
        libnspr4 \
        libdbus-1-3 \
        libatk1.0-0 \
        libatk-bridge2.0-0 \
        libcups2 \
        libdrm2 \
        libxkbcommon0 \
        libatspi2.0-0 \
        libx11-6 \
        libxcomposite1 \
        libxdamage1 \
        libxext6 \
        libxfixes3 \
        libxrandr2 \
        libgbm1 \
        libpango-1.0-0 \
        libcairo2 \
        libasound2 \
    && rm -rf /var/lib/apt/lists/* \
    && groupadd -r appuser \
    && useradd -r -g appuser -d /app -s /bin/bash appuser

WORKDIR /app
COPY src/ ./src/

ENV PLAYWRIGHT_BROWSERS_PATH=/app/.cache/ms-playwright
RUN chown -R appuser:appuser /app

RUN chown -R appuser:appuser /build

USER appuser