# Tool-only development image. The workspace remains the source of truth and
# this image does not write a Python environment into the host mount.
FROM python:3.12-slim-bookworm@sha256:d193c6f51a7dbd10395d6328de3a7edb0516fb0608ca138036576f574c3e07d2 AS tools

ENV PYTHONDONTWRITEBYTECODE=1 \
    PYTHONUNBUFFERED=1 \
    UV_LINK_MODE=copy \
    TZ=UTC \
    UV_PROJECT_ENVIRONMENT=/opt/venv

RUN apt-get update \
    && apt-get install --yes --no-install-recommends \
        bash \
        ca-certificates \
        curl \
        docker.io \
        git \
        jq \
        libatomic1 \
        shellcheck \
    && rm -rf /var/lib/apt/lists/*

COPY --from=ghcr.io/astral-sh/uv:0.11.15@sha256:e590846f4776907b254ac0f44b5b380347af5d90d668138ca7938d1b0c2f98d3 /uv /usr/local/bin/uv

WORKDIR /work

FROM tools AS development

# pyright downloads Node.js on first use, and the newest release can break its
# installer. Install a pinned Node.js here so lint runs reuse it.
ENV PYRIGHT_PYTHON_CACHE_DIR=/opt/pyright-cache

COPY pyproject.toml uv.lock README.md ./
RUN --mount=type=cache,target=/root/.cache/uv \
    uv sync --frozen --group dev --no-install-project \
    && PYRIGHT_PYTHON_NODE_VERSION=22.20.0 /opt/venv/bin/python -m pyright --version \
    && chmod --recursive a+rX "$PYRIGHT_PYTHON_CACHE_DIR"