# Build stage: Vite -> static dist/. GIT_SHA is passed by the build-push action.
FROM node:22.23.4-alpine AS build
WORKDIR /app
COPY package.json package-lock.json ./
# Fail fast and retry on a stalled registry fetch (npm defaults can hang ~10 min).
RUN npm ci --fetch-timeout=60000 --fetch-retries=5 --fetch-retry-mintimeout=2000 --no-audit --no-fund
COPY . .
ARG GIT_SHA=dev
ENV VITE_GIT_SHA=${GIT_SHA}
RUN npx vite build

# Runtime stage: static files only, no Node. Runs as uid 101, listens on 8080.
FROM nginxinc/nginx-unprivileged:1.31.7-alpine
COPY nginx/default.conf /etc/nginx/conf.d/default.conf
COPY --chmod=0755 docker-entrypoint.d/10-config.sh /docker-entrypoint.d/10-config.sh
# html dir owned by nginx so 10-config.sh can write config.js at start.
COPY --from=build --chown=101:101 /app/dist /usr/share/nginx/html
# Logged as "version" in every access-log line.
ARG GIT_SHA=dev
ENV GIT_SHA=${GIT_SHA}
EXPOSE 8080