FROM python:3.11-slim

# Force unbuffered stdout/stderr and UTF-8 encoding
ENV PYTHONUNBUFFERED=1
ENV PYTHONIOENCODING=UTF-8

# Install system tools
RUN apt-get update && apt-get install -y \
    git curl wget unzip jq docker.io \
    default-jre-headless \
    build-essential python3-dev libffi-dev libssl-dev \
    && rm -rf /var/lib/apt/lists/*

# Install TruffleHog - with timeout and error handling
RUN timeout 60 curl -sSfL https://raw.githubusercontent.com/trufflesecurity/trufflehog/main/scripts/install.sh | bash -s -- -b /usr/local/bin 2>&1 || echo "TruffleHog install skipped or failed"

# Install OSV-Scanner
RUN timeout 60 curl -L https://github.com/google/osv-scanner/releases/latest/download/osv-scanner_linux_amd64 \
    -o /usr/local/bin/osv-scanner && chmod +x /usr/local/bin/osv-scanner || echo "OSV-Scanner install failed"

# Install Semgrep
RUN pip install --no-cache-dir semgrep || echo "Semgrep install failed"

# Install Checkov with explicit pins to avoid resolver backtracking.
RUN pip install --no-cache-dir "networkx==2.8.8" "checkov==3.2.529" || echo "Checkov install failed"

# Install OWASP ZAP (Required for Layer 5 DAST scans)
RUN wget -q https://github.com/zaproxy/zap-archive/releases/download/zap-v2.14.0/ZAP_2.14.0_Linux.tar.gz -O /tmp/zap.tar.gz && \
    tar -xzf /tmp/zap.tar.gz -C /opt && \
    ln -s /opt/ZAP_2.14.0/zap.sh /usr/local/bin/zap.sh && \
    rm /tmp/zap.tar.gz

# Install Joern
RUN curl -L "https://github.com/joernio/joern/releases/latest/download/joern-install.sh" -o joern-install.sh && \
    chmod +x joern-install.sh && \
    ./joern-install.sh --without-plugins && \
    rm joern-install.sh

# Create a user with UID 1000 to comply with Hugging Face Spaces security policy
RUN groupadd -g 1000 scanner && \
    useradd -u 1000 -g scanner -m -s /bin/bash scanner && \
    chown -R scanner:scanner /opt/joern

WORKDIR /app
COPY requirements.txt .
RUN pip install --no-cache-dir -r requirements.txt

COPY --chown=scanner:scanner . .

RUN mkdir -p /data /tmp/scans && \
    chown -R scanner:scanner /data /tmp/scans /app

USER scanner

EXPOSE 7860
CMD exec uvicorn api.main:app --host 0.0.0.0 --port ${PORT:-7860}