FROM ${buildRegistry}/build/rust:${version} AS builder

RUN apt-get update && apt-get install -y --no-install-recommends \
    build-essential \
    protobuf-compiler \
    cmake \
    libprotobuf-dev \
    libssl-dev \
    pkg-config \
    openssh-client \
    ca-certificates \
    libsasl2-2 \
    libsasl2-dev \
    clang \
    libclang-dev \
<% build_packages.each { print "    ${it} \\\n" } %>
    && rm -rf /var/lib/apt/lists/*

WORKDIR /usr/src/app


COPY id_github_jenkins /root/.ssh/id_rsa

RUN ssh-keyscan github.com >> /root/.ssh/known_hosts && \
    chmod -R 600 /root/.ssh/ && \
    git config --global url."git@github.com:".insteadOf "https://github.com/"

# Copy source code
COPY . .

# Build release binary for the native architecture (amd64)
RUN cargo build --workspace --release

# Clean up SSH key from builder stage for security
RUN rm -rf /root/.ssh/

FROM asia-southeast1-docker.pkg.dev/meesho-devops-admin-0622/admin/build/debian:trixie-slim

# Install runtime dependencies if your app needs them (e.g., SSL)
RUN apt-get update && apt-get install -y --no-install-recommends \
    libssl3t64 \
    ca-certificates \
    libsasl2-2 \
<% runtime_packages.each { print "    ${it} \\\n" } %>
    && rm -rf /var/lib/apt/lists/*

# Set workdir for the binary
WORKDIR /app

# Copy the compiled amd64 binary from the builder
COPY --from=builder /usr/src/app/target/release/${binary_name} ./server
<% add_files.each { print "COPY ${it.path} ${it.target}\n" } %>

# Expose port if your app listens on it
EXPOSE 8080

# Start the application
CMD ["./server"]