# syntax=docker/dockerfile:1.2
#################################################
#
# Initial ehrQL layer with just system dependencies installed.
#
# hadolint ignore=DL3007
FROM ghcr.io/opensafely-core/base-action:latest as ehrql-dependencies


# setup default env vars for all images
# ACTION_EXEC sets the default executable for the entrypoint in the base-action image
ENV VIRTUAL_ENV=/opt/venv/ \
    PYTHONPATH=/app \
    PATH="/opt/venv/bin:/opt/mssql-tools/bin:$PATH" \
    ACTION_EXEC=ehrql \
    PYTHONUNBUFFERED=True \
    PYTHONDONTWRITEBYTECODE=1 \
    PYTHONHASHSEED=0

RUN mkdir /workspace
WORKDIR /workspace

# We are going to use an apt cache on the host, so disable the default debian
# docker clean up that deletes that cache on every apt install
RUN rm -f /etc/apt/apt.conf.d/docker-clean

# Add Microsoft package archive for installing MSSQL tooling
# Add deadsnakes PPA for installing new Python versions
RUN --mount=type=cache,target=/var/cache/apt \
    /usr/lib/apt/apt-helper download-file \
        "https://packages.microsoft.com/keys/microsoft.asc" \
        /etc/apt/trusted.gpg.d/microsoft.asc && \
    /usr/lib/apt/apt-helper download-file \
      "https://packages.microsoft.com/config/ubuntu/20.04/prod.list" \
      /etc/apt/sources.list.d/mssql-release.list && \
    echo "deb https://ppa.launchpadcontent.net/deadsnakes/ppa/ubuntu focal main" \
        > /etc/apt/sources.list.d/deadsnakes-ppa.list && \
    /usr/lib/apt/apt-helper download-file \
        'https://keyserver.ubuntu.com/pks/lookup?op=get&search=0xf23c5a6cf475977595c89f51ba6932366a755776' \
        /etc/apt/trusted.gpg.d/deadsnakes.asc

# Install root dependencies, including Python
COPY dependencies.txt /root/dependencies.txt
# use space efficient utility from base image
RUN --mount=type=cache,target=/var/cache/apt \
    /usr/bin/env ACCEPT_EULA=Y /root/docker-apt-install.sh /root/dependencies.txt

#################################################
#
# Next, use the dependencies image to create an image to build dependencies
FROM ehrql-dependencies as ehrql-builder

# install build time dependencies
COPY build-dependencies.txt /root/build-dependencies.txt
RUN /root/docker-apt-install.sh /root/build-dependencies.txt


# install everything in venv for isolation from system python libraries
# hadolint ignore=DL3013,DL3042
RUN --mount=type=cache,target=/root/.cache \
    /usr/bin/python3.11 -m venv /opt/venv && \
    /opt/venv/bin/python -m pip install -U pip setuptools wheel

COPY requirements.prod.txt /root/requirements.prod.txt
# hadolint ignore=DL3042
RUN --mount=type=cache,target=/root/.cache python -m pip install -r /root/requirements.prod.txt

# WARNING clever/ugly python packaging hacks alert
#
# Borrowed (with modifications) from:
# https://github.com/opensafely-core/cohort-extractor/blob/669e2d5d2e/Dockerfile#L54-L84
#
# We could just do `COPY . /app` and then `pip install /app`. However, this is
# not ideal for a number of reasons:
#
# 1) Any changes to the app files will invalidate this and all subsequent
#    layers, causing them to need rebuilding. This would mean basically
#    reinstalling dev dependencies every time.
#
# 2) We want to use the pinned versions of dependencies in
#    requirements.prod.txt rather than the unpinned versions in setup.py.
#
# 3) We want for developers be able to mount /app with their code and it Just
#    Works, without reinstalling anything.
#
# So, we do the following:
#
# 1) Copy a stripped down version of the pyproject.toml file, and install an
#    empty package from it alone (a test ensured the minimal version stays in
#    sync with the full version)
#
# 2) We install it without deps, as they've already been installed.
#
# 3) We have set PYTHONPATH=/app, so that code copied or mounted into /app will
#    be used automatically.
#
# Note: we only really need to install it at all to use setuptools entrypoints.
RUN mkdir /app
COPY pyproject.minimal.toml /app/pyproject.toml
# hadolint ignore=DL3042
RUN --mount=type=cache,target=/root/.cache \
  /opt/venv/bin/python -m pip install --no-deps /app


################################################
#
# A base image with the including the prepared venv and metadata.
FROM ehrql-dependencies as ehrql-base

# Some static metadata for this specific image, as defined by:
# https://github.com/opencontainers/image-spec/blob/master/annotations.md#pre-defined-annotation-keys
# The org.opensafely.action label is used by the jobrunner to indicate this is
# an approved action image to run.
LABEL org.opencontainers.image.title="ehrql" \
      org.opencontainers.image.description="ehrQL action for opensafely.org" \
      org.opencontainers.image.source="https://github.com/opensafely-core/ehrql" \
      org.opensafely.action="ehrql"

COPY --from=ehrql-builder /opt/venv /opt/venv


################################################
#
# Build the actual production image from the base
FROM ehrql-base as ehrql

# Copy app code. This will be automatically picked up by the virtualenv as per
# comment above
COPY ehrql /app/ehrql
RUN python -m compileall /app/ehrql
COPY bin /app/bin

# The following build details will change.
# These are the last step to make better use of Docker's build cache,
# avoiding rebuilding image layers unnecessarily.
ARG BUILD_DATE=unknown
LABEL org.opencontainers.image.created=$BUILD_DATE
ARG GITREF=unknown
LABEL org.opencontainers.image.revision=$GITREF