# Pinned digest defaults so the base images are resolvable by hash even when
# the args are not passed (e.g. by supply-chain scanners or a plain `docker build`).
# docker/docker-bake.hcl overrides these at build time; keep the digests in sync.
ARG build_image=python:3.12-slim@sha256:090ba77e2958f6af52a5341f788b50b032dd4ca28377d2893dcf1ecbdfdfe203
ARG base_image=python:3.12-slim@sha256:090ba77e2958f6af52a5341f788b50b032dd4ca28377d2893dcf1ecbdfdfe203

FROM ${build_image} AS build-image

ARG DEBIAN_FRONTEND=noninteractive
ARG haystack_version

RUN apt-get update && \
    apt-get install -y --no-install-recommends git

COPY --from=ghcr.io/astral-sh/uv:0.11.17@sha256:03bdc89bb9798628846e60c3a9ad19006c8c3c724ccd2985a33145c039a0577b /uv /uvx /bin/

# Shallow clone Haystack repo, we'll install from the local sources
RUN git clone --depth=1 --branch=${haystack_version} https://github.com/deepset-ai/haystack.git /opt/haystack
WORKDIR /opt/haystack

# Use a virtualenv we can copy over the next build stage
# Note: we use venv and not uv to create the virtualenv to make sure that the created virtualenv is accessible by pip
# and prevent breaking changes in the image. uv can still be used to speed up installation.
RUN python3 -m venv /opt/venv
ENV PATH="/opt/venv/bin:$PATH"

# Upgrade setuptools due to https://nvd.nist.gov/vuln/detail/CVE-2022-40897
RUN uv pip install --no-cache-dir -U setuptools && \
    uv pip install --no-cache-dir .

FROM ${base_image} AS final

COPY --from=build-image /opt/venv /opt/venv

ENV PATH="/opt/venv/bin:$PATH"