# syntax=docker/dockerfile:1.25.0@sha256:0adf442eae370b6087e08edc7c50b552d80ddf261576f4ebd6421006b2461f12

# Branch JavaScript is deliberately executed only inside this BuildKit sandbox.
# Dependency download cannot run lifecycle hooks, and the actual branch build has
# no network or host/Docker socket mount.
FROM node:24-bookworm-slim@sha256:3638d9a6fe4030bd716be989438248074489337ba3275657f93595428be4fc03 AS dependencies

# The provisioner reads the exact materialized app-pack commit with Git. Install
# its toolchain dependency before branch sources enter the networkless stage.
RUN apt-get update \
    && apt-get install -y --no-install-recommends git \
    && rm -rf /var/lib/apt/lists/*

WORKDIR /workspace
COPY frontend/package.json frontend/package-lock.json ./
RUN npm ci --include=dev --ignore-scripts --no-audit --no-fund

FROM dependencies AS build

ARG APP_PACKS_REF
ENV CI=1 \
    NO_COLOR=1 \
    NODE_ENV=production \
    HTTP_PROXY= \
    HTTPS_PROXY= \
    FTP_PROXY= \
    ALL_PROXY= \
    NO_PROXY= \
    http_proxy= \
    https_proxy= \
    ftp_proxy= \
    all_proxy= \
    no_proxy= \
    NEXUSCRM_FRONTEND_APP_PACKS_ROOT=/input/frontend-app-packs-source \
    NEXUSCRM_FRONTEND_APP_PACKS_REF=${APP_PACKS_REF}

COPY frontend/ ./
COPY frontend-app-packs-source/ /input/frontend-app-packs-source/
RUN --network=none env \
    -u HTTP_PROXY -u HTTPS_PROXY -u FTP_PROXY -u ALL_PROXY -u NO_PROXY \
    -u http_proxy -u https_proxy -u ftp_proxy -u all_proxy -u no_proxy \
    npm run provision:frontend-app-packages --ignore-scripts
RUN --network=none env \
    -u HTTP_PROXY -u HTTPS_PROXY -u FTP_PROXY -u ALL_PROXY -u NO_PROXY \
    -u http_proxy -u https_proxy -u ftp_proxy -u all_proxy -u no_proxy \
    npm run build --ignore-scripts

FROM scratch AS frontend-dist
COPY --from=build /workspace/dist/ /