# syntax=docker/dockerfile:1
# Multi-stage build definition. INERT: this is a parsing fixture, not a build. Every base image
# is a fictional registry.example.invalid reference, nothing is fetched, and no credential,
# token, or private host appears anywhere in it.

ARG BASE_TAG=1.4.0
ARG NODE_MAJOR=20

FROM registry.example.invalid/ci/node:${NODE_MAJOR} AS deps
WORKDIR /src
COPY package.json package-lock.json ./
RUN npm ci --omit=dev

FROM registry.example.invalid/ci/node:${NODE_MAJOR} AS build
WORKDIR /src
COPY --from=deps /src/node_modules ./node_modules
COPY . .
RUN npm run build

FROM registry.example.invalid/base/distroless:${BASE_TAG} AS runtime
LABEL org.opencontainers.image.title="orders" \
      org.opencontainers.image.version="${BASE_TAG}" \
      org.opencontainers.image.source="https://git.example.invalid/example-org/orders"

ENV NODE_ENV=production \
    LOG_LEVEL=info

WORKDIR /app
COPY --from=build --chown=10001:10001 /src/build /app
COPY <<EOF /app/banner.txt
orders service
built from a fixture, not from real source
EOF

USER 10001:10001
EXPOSE 8080
HEALTHCHECK --interval=10s --timeout=2s --retries=3 CMD ["/app/healthcheck"]
STOPSIGNAL SIGTERM
ENTRYPOINT ["/app/server"]
CMD ["--port", "8080"]