FROM python:3.11-slim AS checked
ENV PYTHONDONTWRITEBYTECODE=1 \
    PYTHONUNBUFFERED=1 \
    HF_HOME=/tmp/researchbee-hf-cache
WORKDIR /app
COPY requirements.txt requirements-dev.txt ./
RUN python -m pip install --no-cache-dir -r requirements-dev.txt && python -m pip check
COPY . .
# Local records and mocked providers only; no API secrets needed for tests.
# Hugging Face stops the build here if the actual framework regressions fail.
RUN python -m compileall -q . && python -m pytest -q

FROM python:3.11-slim
ENV PYTHONDONTWRITEBYTECODE=1 \
    PYTHONUNBUFFERED=1 \
    HF_HOME=/tmp/researchbee-hf-cache
WORKDIR /app
COPY requirements.txt ./
RUN python -m pip install --no-cache-dir -r requirements.txt && python -m pip check \
    && useradd --create-home --uid 1000 researchbee
COPY --from=checked /app /app
USER 1000
EXPOSE 7860
CMD ["uvicorn", "app:app", "--host", "0.0.0.0", "--port", "7860", "--no-access-log"]