# Build stage
#
# Context is the repository root, not vantagectl/, because vantagectl depends on
# the shared module through a replace directive.
FROM golang:1.26 AS builder

WORKDIR /src

# Manifests first so the dependency layer caches independently of source edits.
COPY shared/go.mod shared/go.sum ./shared/
COPY vantagectl/go.mod vantagectl/go.sum ./vantagectl/
RUN cd vantagectl && go mod download

COPY shared/ ./shared/
COPY vantagectl/ ./vantagectl/

ARG VERSION=dev
RUN cd vantagectl && CGO_ENABLED=0 GOOS=linux go build \
      -ldflags="-s -w -X main.Version=${VERSION}" -o /vantagectl .

# Staged so the scratch image below can have a /tmp. It cannot mkdir one
# itself — scratch has no shell.
RUN mkdir -p /staging/tmp && chmod 1777 /staging/tmp

# Runtime stage
FROM scratch

COPY --from=builder /etc/ssl/certs/ca-certificates.crt /etc/ssl/certs/

# restore extracts an archive here before verifying its checksums, and backup
# stages nothing but still inherits os.MkdirTemp's requirements. Without this
# every restore stops at "temp dir: stat /tmp: no such file or directory".
COPY --from=builder /staging/tmp /tmp
COPY --from=builder /vantagectl /vantagectl

ENTRYPOINT ["/vantagectl"]