FROM maven:3.9-eclipse-temurin-25 AS build
WORKDIR /workspace
COPY pom.xml ./
COPY .mvn .mvn
COPY tooling tooling
COPY ci ci
COPY agiledancers-be/pom.xml agiledancers-be/pom.xml
COPY agiledancers-be/src agiledancers-be/src
# Source builds run the same PostgreSQL tests as local/CI verification.
# Supply connection configuration as BuildKit secrets, which are not retained in image layers.
RUN --mount=type=secret,id=database_url,env=QUARKUS_DATASOURCE_JDBC_URL,required=true \
    --mount=type=secret,id=database_user,env=QUARKUS_DATASOURCE_USERNAME,required=true \
    --mount=type=secret,id=database_password,env=QUARKUS_DATASOURCE_PASSWORD,required=true \
    mvn -B -ntp clean verify

FROM eclipse-temurin:25-jre AS runtime
WORKDIR /app
USER 10001:10001
EXPOSE 8080
ENTRYPOINT ["java", "-jar", "/app/quarkus-run.jar"]

# CI packages the exact output that already passed mvn clean verify.
FROM runtime AS prebuilt
COPY --chown=10001:10001 agiledancers-be/target/quarkus-app/ ./

# Default standalone build still compiles and tests from source.
FROM runtime AS standalone
COPY --from=build --chown=10001:10001 /workspace/agiledancers-be/target/quarkus-app/ ./