FROM docker.io/golang:1.26 AS builder

WORKDIR /build

COPY go.mod go.sum ./
RUN go mod download

COPY . .

RUN make build

# distroless static ships /etc/ssl/certs/ca-certificates.crt, which the S3
# client needs to reach https://s3.ceph.unkin.net, and runs as an unprivileged
# user. No shell, no package manager.
FROM gcr.io/distroless/static-debian12:nonroot

COPY --from=builder /build/dist/go-cache-plugin /usr/local/bin/go-cache-plugin

ENTRYPOINT ["go-cache-plugin"]