# Stage 1: Build the Go application
FROM --platform=$BUILDPLATFORM golang:1.26.2-alpine3.23@sha256:f85330846cde1e57ca9ec309382da3b8e6ae3ab943d2739500e08c86393a21b1 AS builder

ARG TARGETOS
ARG TARGETARCH

WORKDIR /app

# Download and verify dependencies before copying the application source.
COPY go.mod go.sum ./
RUN go mod download && go mod verify

# Copy the rest of the application source code
COPY . .

# Build the Go application for the target image platform.
# The binary will be named 'app'
RUN CGO_ENABLED=0 GOOS=${TARGETOS} GOARCH=${TARGETARCH} go build -v -o /app/main main.go

# Stage 2: Create the final image
FROM alpine:3.22@sha256:14358309a308569c32bdc37e2e0e9694be33a9d99e68afb0f5ff33cc1f695dce

# Install Terraform CLI and other utilities.
ARG TERRAFORM_VERSION=1.15.8
ARG TERRAFORM_AMD64_SHA256=d25ce7b6902013ad905db3d2eab0be4cd905887fe88b81a6171b8d5503c31f3d
ARG TERRAFORM_ARM64_SHA256=8891e9dcedc9e3b8950bc6af9d4d8af1f4cfade3062f53b9dc403a89f6ce8c9c
ARG GCLOUD_VERSION=578.0.0
ARG GCLOUD_AMD64_GENERATION=1785245315707220
ARG GCLOUD_AMD64_SHA256=322ac42ef7670cf2e16d46a1c3f827b36e55a865d2e26f34c64c914869e400f0
ARG GCLOUD_ARM64_GENERATION=1785245267279894
ARG GCLOUD_ARM64_SHA256=6a1f0dd3dc22a1a9cd8a37578bb0455f04644f56e1f6fd67680ab73e59106c33
ARG AWS_CLI_VERSION=1.46.0
ARG TARGETARCH
RUN apk add --no-cache wget unzip ca-certificates git openssh-client make curl python3 py3-pip bash

# Install Terraform from its checksummed release archive.
RUN case "${TARGETARCH}" in \
        amd64) TERRAFORM_ARCH=amd64; TERRAFORM_SHA256="${TERRAFORM_AMD64_SHA256}" ;; \
        arm64) TERRAFORM_ARCH=arm64; TERRAFORM_SHA256="${TERRAFORM_ARM64_SHA256}" ;; \
        *) echo "Unsupported Terraform architecture: ${TARGETARCH}" >&2; exit 1 ;; \
    esac && \
    wget -q https://releases.hashicorp.com/terraform/${TERRAFORM_VERSION}/terraform_${TERRAFORM_VERSION}_linux_${TERRAFORM_ARCH}.zip && \
    echo "${TERRAFORM_SHA256}  terraform_${TERRAFORM_VERSION}_linux_${TERRAFORM_ARCH}.zip" | sha256sum -c - && \
    unzip -q terraform_${TERRAFORM_VERSION}_linux_${TERRAFORM_ARCH}.zip -d /usr/local/bin && \
    rm terraform_${TERRAFORM_VERSION}_linux_${TERRAFORM_ARCH}.zip

# Install an exact AWS CLI release in an isolated environment.
RUN python3 -m venv /opt/aws-cli-venv && \
    /opt/aws-cli-venv/bin/pip install --no-cache-dir "awscli==${AWS_CLI_VERSION}" && \
    ln -s /opt/aws-cli-venv/bin/aws /usr/local/bin/aws

# Install Google Cloud CLI from an exact Google Cloud Storage generation.
RUN case "${TARGETARCH}" in \
        amd64) GCLOUD_ARCH=x86_64; GCLOUD_GENERATION="${GCLOUD_AMD64_GENERATION}"; GCLOUD_SHA256="${GCLOUD_AMD64_SHA256}" ;; \
        arm64) GCLOUD_ARCH=arm; GCLOUD_GENERATION="${GCLOUD_ARM64_GENERATION}"; GCLOUD_SHA256="${GCLOUD_ARM64_SHA256}" ;; \
        *) echo "Unsupported Google Cloud CLI architecture: ${TARGETARCH}" >&2; exit 1 ;; \
    esac && \
    wget -q -O google-cloud-cli.tar.gz "https://storage.googleapis.com/download/storage/v1/b/cloud-sdk-release/o/google-cloud-cli-${GCLOUD_VERSION}-linux-${GCLOUD_ARCH}.tar.gz?generation=${GCLOUD_GENERATION}&alt=media" && \
    echo "${GCLOUD_SHA256}  google-cloud-cli.tar.gz" | sha256sum -c - && \
    tar -xzf google-cloud-cli.tar.gz -C /opt && \
    test "$(cat /opt/google-cloud-sdk/VERSION)" = "${GCLOUD_VERSION}" && \
    rm google-cloud-cli.tar.gz
ENV PATH="/opt/google-cloud-sdk/bin:${PATH}"

# Create necessary directories and set permissions
RUN mkdir -p /lemc/private /lemc/public /app/terraform-config

# Copy the built application from the builder stage
COPY --from=builder /app/main /usr/local/bin/main

# Copy terraform configuration files into the image
# The main.go program expects 'terraform-config' in its current working directory
COPY terraform-config /app/terraform-config/

# Set up the working directory
WORKDIR /app

# Set default command, can be overridden
CMD ["main"]