FROM rust:1.89-bookworm AS builder

WORKDIR /app
COPY . .
RUN cargo build --release -p compliance-agent

FROM debian:bookworm-slim
RUN apt-get update && apt-get install -y ca-certificates libssl3 git curl python3 python3-pip && rm -rf /var/lib/apt/lists/*

# Install syft for SBOM generation
RUN curl -sSfL https://raw.githubusercontent.com/anchore/syft/main/install.sh | sh -s -- -b /usr/local/bin

# Install gitleaks for secret detection
RUN curl -sSfL https://github.com/gitleaks/gitleaks/releases/download/v8.21.2/gitleaks_8.21.2_linux_x64.tar.gz \
    | tar -xz -C /usr/local/bin gitleaks

# Install semgrep for static analysis
RUN pip3 install --break-system-packages semgrep

# Install ruff for Python linting
RUN pip3 install --break-system-packages ruff

COPY --from=builder /app/target/release/compliance-agent /usr/local/bin/compliance-agent

EXPOSE 3001 3002

ENTRYPOINT ["compliance-agent"]