Dockerfile.test

# Pin base image by digest for supply-chain integrity (Scorecard PinnedDependencies, alert #41).
# Digest tracks the python:3.10-slim multi-arch manifest list; update the digest when bumping the tag.
FROM python:3.10-slim@sha256:5f9928ea39771e8ddf4fb9a96ab24f65f087793635614405a1dc9384f040852e

ENV UV_VERSION=0.11.3

# Install system dependencies
RUN apt-get update && apt-get install -y --no-install-recommends \
    build-essential \
    libgl1 \
    libglib2.0-0 \
    curl \
    git \
    && rm -rf /var/lib/apt/lists/*

# Install uv (pin to match .github/workflows/tests.yml)
RUN curl -LsSf https://astral.sh/uv/install.sh | env UV_INSTALL_DIR=/usr/local/bin sh

ENV PATH="/usr/local/bin:${PATH}"

WORKDIR /app

# Pre-warm dependencies only (source is mounted at runtime by Actions)
COPY pyproject.toml README.md ./
COPY src/newsdom_api/__init__.py ./src/newsdom_api/__init__.py

# Install dependencies using uv
# Install to system Python so that it's accessible without activating a venv
RUN uv pip install --system -e ".[dev]"

ENV PYTHONPATH=/app/src

HEALTHCHECK --interval=30s --timeout=5s --start-period=5s --retries=3 \
    CMD python -c "import importlib; importlib.import_module('newsdom_api')" || exit 1

# Run the test suite as an unprivileged user (Trivy DS-0002: image user should
# not be root). Create 'ciuser' and hand it ownership of the workdir so pytest
# can write its cache and coverage artifacts. This image is executed via
# `docker run` (CMD pytest); it is not consumed as a GitHub Actions `container:`
# job, so there are no bind-mounted runner directories that would require root.
RUN useradd --create-home --home-dir /home/ciuser --shell /usr/sbin/nologin ciuser \
    && chown -R ciuser:ciuser /app
USER ciuser

CMD ["pytest"]