1FROM node:24.21.0-alpine@sha256:ebfe2f90462722a7a4de65e91990e97fe0d401c70e0e762c5b53302f905ec1c1 AS web
 2WORKDIR /web
 3COPY web/package.json web/package-lock.json ./
 4RUN npm ci --no-audit --no-fund
 5COPY web/ ./
 6RUN npm run check && npm run build
 7
 8FROM golang:1.27.2-alpine@sha256:f92b6ef800e499660581efdabdf25d9d817a9d124eaf900924f0504e7e27e12d AS go-build
 9WORKDIR /src
10COPY go.mod ./
11COPY cmd/ ./cmd/
12COPY internal/ ./internal/
13RUN CGO_ENABLED=0 go build -trimpath -ldflags='-s -w' -o /review ./cmd/review
14
15FROM scratch
16COPY --from=go-build /etc/ssl/certs/ca-certificates.crt /etc/ssl/certs/ca-certificates.crt
17COPY --from=go-build /review /review
18COPY --from=web /web/build /web
19USER 10001:10001
20EXPOSE 8080
21ENTRYPOINT ["/review"]
22CMD ["serve", "--data", "/data", "--web", "/web"]