Dockerfile

# ---- deps stage: needs git + a credentialed clone of the private ARF repos
#      (agentic_reliability_framework, ARF-Bayesian-Pricing-Calculator).
#      This stage is discarded after build -- the credential never reaches
#      the final image's layers, env, or git config. ----
FROM python:3.12-slim AS deps
ARG GH_PAT
RUN apt-get update && apt-get install -y git && rm -rf /var/lib/apt/lists/*
RUN git config --global url."https://${GH_PAT}@github.com/".insteadOf "https://github.com/"
RUN python -m venv /opt/venv
ENV PATH="/opt/venv/bin:$PATH"
WORKDIR /app
COPY requirements.txt .
RUN pip install --no-cache-dir -r requirements.txt

# ---- final stage: just the built venv + app code, no git, no credential ----
FROM python:3.12-slim
COPY --from=deps /opt/venv /opt/venv
ENV PATH="/opt/venv/bin:$PATH"
WORKDIR /app
COPY . .
CMD ["uvicorn", "app.main:app", "--host", "0.0.0.0", "--port", "7860"]