FROM docker.io/pragent/pr-agent:0.47.0@sha256:7d98954c29289846a08faf00aaea0f1f1375b1676cd8a2ed303e0af07010af7a AS pr-agent

# npm stays in this stage; only the packages of the lockfile, checked by their integrity, reach the image.
FROM pr-agent AS pr-lens
RUN apt-get update && apt-get install -y --no-install-recommends npm && rm -rf /var/lib/apt/lists/*
COPY tools/pr-lens/package.json tools/pr-lens/package-lock.json /opt/pr-lens/
RUN cd /opt/pr-lens && npm ci --omit=dev --ignore-scripts --no-audit --no-fund \
    && npm audit --omit=dev --audit-level=high

# tools/build-rootfs --base exports this stage; tools/release_rootfs.py adds werkrevisor to it.
FROM pr-agent AS base
RUN apt-get update && apt-get install -y --no-install-recommends nodejs && rm -rf /var/lib/apt/lists/*
COPY --from=pr-lens /opt/pr-lens /opt/pr-lens

FROM base
COPY werkrevisor /werkrevisor/werkrevisor
COPY config /werkrevisor/config
ENV PYTHONPATH=/werkrevisor:/app \
    PYTHONDONTWRITEBYTECODE=1 \
    PYTHONNOUSERSITE=1
WORKDIR /work
ENTRYPOINT ["python", "-s", "-m", "werkrevisor"]