Dockerfile

# syntax=docker/dockerfile:1

FROM python:3.12-slim AS build

RUN pip install --no-cache-dir uv

WORKDIR /app

COPY pyproject.toml uv.lock README.md ./

# Install dependencies before copying src/, so this layer only invalidates when
# pyproject.toml or uv.lock change, not on every application code change.
# --no-dev excludes the dev dependency group (pytest, mypy, ruff): only what
# the CLI needs at runtime is installed.
RUN uv sync --locked --no-dev --no-install-project

COPY src/ src/

RUN uv sync --locked --no-dev

FROM python:3.12-slim AS final

RUN useradd --create-home --shell /usr/sbin/nologin app
WORKDIR /app

COPY --from=build /app/.venv /app/.venv
COPY --from=build /app/src /app/src

ENV PATH="/app/.venv/bin:$PATH"

# The non-root user needs write access to /app to create debug/ itself when
# --debug is used without a volume mounted over it.
RUN chown app:app /app

USER app

ENTRYPOINT ["code-audit"]