FROM golang:1.25-bookworm AS build

WORKDIR /src
COPY go.mod go.sum ./
RUN go mod download
COPY cmd ./cmd
COPY internal ./internal
COPY migrations ./migrations
RUN CGO_ENABLED=0 go build -trimpath -ldflags='-s -w' -o /out/gitea-codex ./cmd/gitea-codex

FROM debian:bookworm-slim
ENV LANG=C.UTF-8
RUN apt-get update \
    && apt-get install -y --no-install-recommends ca-certificates docker.io \
    && rm -rf /var/lib/apt/lists/*
WORKDIR /app
COPY --from=build /out/gitea-codex /app/gitea-codex
# The bot needs access to the mounted Docker API socket to launch runners.
# Prefer a Docker socket proxy or a separate runner service in production.
USER root
EXPOSE 8000
ENTRYPOINT ["/app/gitea-codex"]