# Build context: repo root (docker build -f infra/sentry.Dockerfile .)
#
# Local test:  docker build -f infra/sentry.Dockerfile -t sentry:dev .
# AWS deploy:  docker build --platform linux/amd64 -f infra/sentry.Dockerfile -t sentry .
#
# Sentry is a headless ops monitoring worker — no HTTP listener, so no EXPOSE.
# All runtime configuration is injected via ECS task definition environment variables.

FROM --platform=$BUILDPLATFORM golang:1.24-alpine AS builder

ARG TARGETPLATFORM
ARG TARGETOS=linux
ARG TARGETARCH

RUN apk add --no-cache git ca-certificates

WORKDIR /src

# Copy dependency files first for layer caching.
# sentry/go.mod has `replace shared => ../shared`, so shared/ must sit next to sentry/.
COPY shared/go.mod shared/go.sum ./shared/
COPY sentry/go.mod sentry/go.sum ./sentry/

WORKDIR /src/sentry
RUN go mod download

# Copy source
WORKDIR /src
COPY shared/ ./shared/
COPY sentry/ ./sentry/

# Build static binaries for the target platform.
# Three binaries share the image, selected by container command in ECS:
#   sentry           — long-running cycle loop (10-min ticker, S3, alerts)
#   sentry-probe     — one-shot multi-target digest (daily 9 AM via EventBridge)
#   sentry-lark-send — stdin → signed Lark webhook helper
WORKDIR /src/sentry
RUN CGO_ENABLED=0 GOOS=${TARGETOS} GOARCH=${TARGETARCH} go build -ldflags="-s -w" -o /out/sentry           ./cmd/sentry/ \
 && CGO_ENABLED=0 GOOS=${TARGETOS} GOARCH=${TARGETARCH} go build -ldflags="-s -w" -o /out/sentry-probe     ./cmd/sentry-probe/ \
 && CGO_ENABLED=0 GOOS=${TARGETOS} GOARCH=${TARGETARCH} go build -ldflags="-s -w" -o /out/sentry-lark-send ./cmd/sentry-lark-send/

# -----------------------------------------------------------
FROM alpine:3.20

RUN apk add --no-cache ca-certificates tzdata \
    && addgroup -S app && adduser -S app -G app

COPY --from=builder /out/sentry           /usr/local/bin/sentry
COPY --from=builder /out/sentry-probe     /usr/local/bin/sentry-probe
COPY --from=builder /out/sentry-lark-send /usr/local/bin/sentry-lark-send

USER app

# No ENTRYPOINT — use CMD instead so ECS task definitions can swap binaries
# via `command:` without needing to override entryPoint. The default command
# runs the long-running cycle service; the daily-report task definition sets
# `command: ["/usr/local/bin/sentry-probe"]` (or equivalently overrides
# entryPoint, which the existing nexus-sentry-daily-report task does).
CMD ["/usr/local/bin/sentry"]