# Both arguments must be approved immutable image digests; no floating defaults.
ARG BUILD_IMAGE
ARG JAVA_IMAGE
FROM ${BUILD_IMAGE} AS zint-build
WORKDIR /zint-build
COPY vendor/ ./
COPY Dockerfile ./
# Build dependencies exist only in this discarded stage. Their actual versions,
# source hash, compiler and CMake invocation are shipped with corresponding source.
RUN apt-get update && apt-get install -y --no-install-recommends gcc g++ libc6-dev make cmake patch \
    && sh ./build-zint.sh

# The renderer's version comes from its parent, the repository reactor POM (../pom.xml). Build from this directory with that file as a named BuildKit context:
#   docker build --build-context reactor=<repository root> ...   (the reactor POM is copied to /pom.xml, where ../pom.xml resolves for /renderer/pom.xml)
FROM ${BUILD_IMAGE} AS build
COPY --from=reactor pom.xml /pom.xml
WORKDIR /renderer
COPY vendor/openhtml-1.1.105-qqq-p1 ./vendor/openhtml-1.1.105-qqq-p1
RUN sh ./vendor/openhtml-1.1.105-qqq-p1/build-openhtml.sh /renderer/openhtml-build /renderer/.m2
COPY pom.xml ./
COPY LICENSE NOTICE ./
COPY checkstyle ./checkstyle
COPY src ./src
RUN mvn -B -Dmaven.repo.local=/renderer/.m2 verify

FROM ${JAVA_IMAGE}
# Reviewed runtime family: Temurin 21.0.13+9 on Ubuntu noble. The approved digest
# contains Ubuntu's patched Brotli and omits the unused Pebble daemon entirely.
# Refuse an older/different base instead of silently installing mixed packages.
RUN . /etc/os-release \
    && test "$ID" = "ubuntu" \
    && test "$VERSION_ID" = "24.04" \
    && test "$JAVA_VERSION" = "jdk-21.0.13+9" \
    && dpkg --compare-versions "$(dpkg-query -W -f='${Version}' libbrotli1)" ge "1.1.0-2ubuntu0.1" \
    && test ! -e /usr/bin/pebble \
    && ! command -v pebble
WORKDIR /renderer
COPY --from=zint-build /zint-build/build/frontend/zint /usr/local/bin/zint
COPY --from=zint-build /zint-build/corresponding-source /usr/share/doc/qqq-zint
COPY --from=build /renderer/openhtml-build/corresponding-source /usr/share/doc/qqq-openhtml
COPY --from=build /renderer/target/qbit-document-renderer-0.1.0-SNAPSHOT.jar ./renderer.jar
COPY --from=build /renderer/target/lib ./lib
USER 65532:65532
ENTRYPOINT ["java", "-Xmx256m", "-XX:ActiveProcessorCount=1", "-Djava.awt.headless=true", "-Dpdfbox.fontcache=/tmp", "-jar", "/renderer/renderer.jar"]
