# gitea-review-bot — Spark container. Generic image; secrets/config via read-only mounts at runtime.
# Host networking (docker-compose) so it reaches Synapse (TLS), Gitea (LAN), and the Mac (SSH).
FROM python:3.12-slim

# openssh-client: the bot shells out to `ssh mac-bridge ...` to run the review + deploy on the Mac.
RUN apt-get update \
    && apt-get install -y --no-install-recommends openssh-client \
    && rm -rf /var/lib/apt/lists/*

WORKDIR /app

COPY requirements.txt .
RUN pip install --no-cache-dir -r requirements.txt

COPY src/ ./src/
COPY docker-entrypoint.sh /usr/local/bin/docker-entrypoint.sh
RUN chmod +x /usr/local/bin/docker-entrypoint.sh

# .env and config.toml arrive via read-only mounts at runtime (never baked).
ENTRYPOINT ["/usr/local/bin/docker-entrypoint.sh"]
CMD ["python", "-u", "src/bot.py"]