Containerfile.cli

ARG BUILDER_IMAGE=quay.io/light-factory/python-builder:latest@sha256:a2b3df73bfcc2bdda40250b91aa168aaf7923be88b1605cf1eec891c0a51984f

FROM quay.io/konflux-ci/oras:latest@sha256:1beeecce012c99794568f74265c065839f9703d28306a8430b667f639343a98b AS oras-bin
FROM ghcr.io/sigstore/cosign/cosign:v3.1.4@sha256:0f06154836d2de34f887a5c273506d52ca43edaa1d9e53e6510fa78a48f69c2d AS cosign-bin

# Install the package and locked runtime dependencies without development tools.
FROM ${BUILDER_IMAGE} AS task-package-build
# Root is needed only to assemble this intermediate environment.
# hadolint ignore=DL3002
USER 0
WORKDIR /opt/lightwell-source
ENV UV_PROJECT_ENVIRONMENT=/opt/lightwell \
    UV_PYTHON_DOWNLOADS=never \
    UV_LINK_MODE=copy
COPY pyproject.toml uv.lock README.md LICENSE NOTICE ./
COPY src ./src
RUN /src/venv/bin/uv sync --locked --no-dev --no-editable --python /src/venv/bin/python && \
    /src/venv/bin/uv pip check --python /opt/lightwell/bin/python


# Default target: native package builds, source preparation, and normalization.
FROM ${BUILDER_IMAGE} AS python-builder
USER 0
RUN dnf -y update
COPY --from=oras-bin /usr/bin/oras /usr/local/bin/oras
COPY --from=oras-bin /usr/local/bin/select-oci-auth /usr/local/bin/select-oci-auth
COPY --from=oras-bin /usr/local/bin/get-reference-base /usr/local/bin/get-reference-base
COPY --from=oras-bin /usr/bin/yq /usr/bin/yq
# Publication clients are installed here; the base supplies the build toolchain.
COPY --from=cosign-bin /ko-app/cosign /usr/local/bin/cosign
# Both stages share the base interpreter and the environment's absolute path.
COPY --from=task-package-build /opt/lightwell /opt/lightwell
COPY tests/check_runtime.py /usr/local/libexec/lightwell-check-runtime.py
# Fromager and existing builder scripts keep their original Python interpreter.
ENV PATH=${PATH}:/opt/lightwell/bin
ENV PYTHONDONTWRITEBYTECODE=1
ENV HOME=/home/builder
RUN mkdir -p /var/workdir /home/builder && \
    chown 1001:0 /var/workdir /home/builder && chmod 0775 /var/workdir /home/builder
WORKDIR /var/workdir
USER 1001
RUN /opt/lightwell/bin/python /usr/local/libexec/lightwell-check-runtime.py --profile builder
ENTRYPOINT ["manylinux-entrypoint"]
CMD ["lightwell-build-wheels", "--help"]