FROM golang:1.26-alpine AS build
RUN apk add --no-cache git ca-certificates
ARG UPSTREAM_COMMIT
RUN test -n "$UPSTREAM_COMMIT" && git clone https://github.com/brave/go-sync.git /src
WORKDIR /src
RUN git checkout --detach "$UPSTREAM_COMMIT" && test "$(git rev-parse HEAD)" = "$UPSTREAM_COMMIT"
RUN go test ./auth ./middleware
RUN CGO_ENABLED=0 go build -trimpath -ldflags='-s -w' -o /go-sync .

FROM alpine:3.23
RUN apk add --no-cache ca-certificates && addgroup -S bravesync && adduser -S -G bravesync bravesync
COPY --from=build /go-sync /usr/local/bin/go-sync
USER bravesync
EXPOSE 8295
ENTRYPOINT ["/usr/local/bin/go-sync"]