# Pin the base image by digest (digest of python:3.12-slim on 2026-11-09; refresh with Renovate/Dependabot).
FROM python:3.12-slim@sha256:5e2bdb1b0d542d5039cffb8181c65930093949194a65c365dfb1b0fe13a4fa5b AS build
WORKDIR /src
COPY fetch_vendor_data.py .
# The key is mounted for this one RUN only: it is never written to a layer, ARG or ENV.
RUN --mount=type=secret,id=api_key,target=/run/secrets/api_key \
    python fetch_vendor_data.py /run/secrets/api_key

FROM python:3.12-slim@sha256:5e2bdb1b0d542d5039cffb8181c65930093949194a65c365dfb1b0fe13a4fa5b
RUN groupadd --gid 10001 app \
 && useradd --uid 10001 --gid app --no-create-home --shell /usr/sbin/nologin app
WORKDIR /app
# Copy only what is needed; no 'COPY . .'
COPY --from=build --chown=10001:10001 /src/vendor-data.json ./vendor-data.json
COPY --chown=10001:10001 app.py ./
USER 10001:10001
EXPOSE 8080
CMD ["python", "app.py"]
