# Files to exclude from Docker context
ignore:
  - node_modules
  - /apps/docs
  - /apps/screenshot-service
  - /apps/web
  - /apps/dashboard
  - /apps/status-page
  - /apps/workflows
  - /packages/api
  - /packages/integrations/vercel

builders:
  # Stage 1: Install production dependencies
  install:
    fromImage: node:24-slim
    workdir: /app/
    labels:
      org.opencontainers.image.stage: install
    bind:
      - pnpm-workspace.yaml
      - pnpm-lock.yaml
      - package.json
      - apps/server/package.json
      - packages/analytics/package.json
      - packages/db/package.json
      - packages/proto/package.json
      - packages/emails/package.json
      - packages/notifications/base/package.json
      - packages/notifications/discord/package.json
      - packages/notifications/email/package.json
      - packages/notifications/grafana-oncall/package.json
      - packages/notifications/google-chat/package.json
      - packages/notifications/ms-teams/package.json
      - packages/notifications/ntfy/package.json
      - packages/notifications/opsgenie/package.json
      - packages/notifications/pagerduty/package.json
      - packages/notifications/slack/package.json
      - packages/notifications/telegram/package.json
      - packages/notifications/bird-whatsapp/package.json
      - packages/notifications/twillio-sms/package.json
      - packages/notifications/webhook/package.json
      - packages/error/package.json
      - packages/regions/package.json
      - packages/tinybird/package.json
      - packages/tracker/package.json
      - packages/upstash/package.json
      - packages/utils/package.json
      - packages/tsconfig/package.json
      - packages/subscriptions/package.json
      - packages/assertions/package.json
      - packages/theme-store/package.json
      - packages/locales/package.json
      - packages/services/package.json
      - packages/importers/package.json
    run:
      - corepack enable pnpm
      - pnpm install --prod --frozen-lockfile --filter=@openstatus/server... --verbose
    cache:
      - /root/.local/share/pnpm/store

  # Stage 2: Build application (compile to binary with Deno)
  build:
    fromImage: denoland/deno:2.9.2
    workdir: /app/apps/server
    labels:
      org.opencontainers.image.stage: build
    env:
      NODE_ENV: production
    copy:
      - . /app/
      - fromBuilder: install
        source: /app/node_modules
        target: /app/node_modules
      - fromBuilder: install
        source: /app/apps/server/node_modules
        target: /app/apps/server/node_modules
      - fromBuilder: install
        source: /app/packages
        target: /app/packages
    # 1) bundle to a self-contained mjs; manual node_modules resolves pnpm catalog: + workspace deps, sloppy-imports the extensionless relative imports.
    # 2) compile the bundle with node-modules-dir=none so node_modules is NOT embedded — keeps the binary ~110MB instead of ~390MB.
    run:
      - deno bundle --platform=deno --minify --sloppy-imports --node-modules-dir=manual --output src/_serve.bundle.mjs src/serve.ts
      - deno compile --no-check -A --node-modules-dir=none --include static/openapi.yaml --include static/openapi-v1.json --output app src/_serve.bundle.mjs

# Runtime stage: distroless glibc base that already ships curl (for the healthcheck).
# Pinned to the multi-arch index digest of hi/curl:latest — dofigen mis-resolves this registry's tag to an unpullable digest.
fromImage: registry.access.redhat.com/hi/curl@sha256:848b81ab5d5e55371d7193fd4f1ea7b605d14dbb039344ffad34a4c1f0d880f4

# Metadata labels
labels:
  org.opencontainers.image.title: OpenStatus Server
  org.opencontainers.image.description: REST API server with Hono framework for OpenStatus
  org.opencontainers.image.source: https://github.com/openstatusHQ/openstatus
  org.opencontainers.image.vendor: OpenStatus
  org.opencontainers.image.authors: OpenStatus Team

# Copy compiled binary
copy:
  - fromBuilder: build
    source: /app/apps/server/app
    target: /bin/
    chmod: "555"

# Security: run as non-root user
user: "1000:1000"

# Expose port
expose: "3000"

# Health check — exec form (JSON array) because the base has no shell for CMD-SHELL
healthcheck:
  interval: 30s
  timeout: 10s
  start: 30s
  retries: 3
  cmd: '["curl", "-f", "http://localhost:3000/ping"]'

# Start application
entrypoint: /bin/app